cd speler kan niet branden, wel afspelen

[kweezie wabbit]

Klik met de rechter muisknop op de icoon van Hijackthis en kies dan voor “Run as administrator" of "Uitvoeren als administrator".

Selecteer “Do a system scan only”.

Vink alleen de items aan die hieronder zijn genoemd:

R3 - URLSearchHook: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuz2.dll

O2 - BHO: Vuze Remote - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuz2.dll

O3 - Toolbar: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuz2.dll

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...81/mcfscan.cab

Klik op 'Fix checked' om de items te verwijderen.

Download MBAM (Malwarebytes Anti-Malware)

Dubbelklik op mbam-setup.exe om het programma te installeren.

Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Start Malwarebytes' Anti-Malware, Klik daarna op "Voltooien".

Indien een update gevonden werd, zal die gedownload en geïnstalleerd worden.

Wanneer het programma volledig up to date is, selecteer dan in het tabblad Scanner : "Snelle Scan", daarna klik op Scan.

Het scannen kan een tijdje duren, dus wees geduldig.

Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.

Zorg ervoor dat daar alles aangevinkt is, daarna klik op: Verwijder geselecteerde.

Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie verder).

Indien er de rootkit (TDSS) aanwezig is, zal MBAM vragen te herstarten. Doe dit dan ook.

MBAM zal na de herstart opnieuw scannen en de rootkit verwijderen.

Het log wordt automatisch bewaard door MBAM en kan je terugvinden door op de "Logs" tab te klikken in het programma.

Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken.

Daarna zal het vragen om de computer opnieuw op te starten... Dus sta toe dat MBAM de computer opnieuw opstart.

Plak de inhoud van het logje in je volgende bericht, samen met een nieuw HijackThis log.

[albada53]

Bijgaand de MBAM-log:

Malwarebytes Anti-Malware 1.65.0.1400

Malwarebytes : Free anti-malware download

Databaseversie: v2012.09.16.11

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

albert :: WEB-BY3NR533HTV [administrator]

16-9-2012 21:01:04

mbam-log-2012-09-16 (21-01-04).txt

Scantype: Snelle scan

Ingeschakelde scanopties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM

Uitgeschakelde scanopties: P2P

Objecten gescand: 223281

Verstreken tijd: 13 minuut/minuten, 9 seconde(n)

Geheugenprocessen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Registersleutels gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Registerdata gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Mappen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Bestanden gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

(einde)

En de HijackThis-log:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 21:29:13, on 16-9-2012

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Unable to get Internet Explorer version!

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\drivers\CDAC11BA.EXE

C:\Program Files\PC Veilig\Anti-Virus\fsgk32st.exe

C:\Program Files\PC Veilig\Common\FSMA32.EXE

C:\Program Files\PC Veilig\Anti-Virus\FSGK32.EXE

C:\Program Files\PC Veilig\Common\FSHDLL32.EXE

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\PC Veilig\FWES\Program\fsdfwd.exe

C:\Program Files\PC Veilig\Anti-Virus\fssm32.exe

C:\Program Files\PC Veilig\Anti-Virus\fsav32.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Logitech\iTouch\iTouch.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\PC Veilig\Common\FSM32.EXE

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Documents and Settings\albert\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\albert\Local Settings\Application Data\Google\Update\1.3.21.115\GoogleCrashHandler.exe

C:\WINDOWS\notepad.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE

C:\Program Files\Microsoft Office\Office10\WINWORD.EXE

C:\Documents and Settings\albert\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\albert\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\albert\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\albert\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll

O2 - BHO: LitmusBHO - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files\PC Veilig\NRS\iescript\baselitmus.dll

O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: Browsing Protection Toolbar - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files\PC Veilig\NRS\iescript\baselitmus.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup

O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\PC Veilig\Common\FSM32.EXE" /splash

O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\PC Veilig\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Documents and Settings\albert\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun

O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [LDM] \Program\

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\albert\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/7.20.0003/OCI/setup.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1342552226406

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {D83C1BD1-DCBB-11D4-9425-0050BF33FA6E} - http://www.cyclomedia.nl/download/components/CycloScopeLite.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - http://chat.msn.com/controls/msnchat45.cab

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE

O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\PC Veilig\Anti-Virus\fsgk32st.exe

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\PC Veilig\FWES\Program\fsdfwd.exe

O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\PC Veilig\Common\FSMA32.EXE

O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\PC Veilig\ORSP Client\fsorsp.exe

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe

O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe

--

End of file - 10392 bytes

[kweezie wabbit]

Dit ziet er al goed uit.

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

• Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:
  Klik hier
  Als het je niet lukt om ze uit te schakelen, ga dan gewoon door naar de volgende stap.
  
• Dubbelklik op ComboFix.exe en volg de meldingen op het scherm.
  
• ComboFix zal controleren of dat de Microsoft Windows Recovery Console reeds is geïnstalleerd.
  **Let op: Als de Microsoft Windows Recovery Console al is geïnstalleerd, dan krijg je de volgende schermen niet te zien en zal ComboFix automatisch verder gaan met het scannen naar malware.
  
• Volg de meldingen op het scherm om ComboFix de Microsoft Windows Recovery Console te laten downloaden en installeren.
  

Je krijgt de volgende melding te zien wanneer ComboFix de Microsoft Windows Recovery Console succesvol heeft geïnstalleerd:

Klik op Ja om verder te gaan met het scannen naar malware.

Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion", herstart dan de computer.

Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Indien je problemen hebt bij het uitvoeren van ComboFix, gelieve dit te melden.

[albada53]

Bijgaand de log van ComboFix:

ComboFix 12-09-16.01 - albert 17-09-2012 0:21.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.512.236 [GMT 2:00]

Gestart vanuit: c:\documents and settings\albert\Mijn documenten\Downloads\ComboFix.exe

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

AV: PC Veilig 9.12 *Disabled/Updated* {E7512ED5-4245-4B4D-AF3A-382D3F313F15}

FW: PC Veilig 9.12 *Disabled* {D4747503-0346-49EB-9262-997542F79BF4}

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\albert\Application Data\facemoods.com

c:\documents and settings\albert\Application Data\PriceGong

c:\documents and settings\albert\Application Data\PriceGong\Data\1.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\1.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\2258.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\371.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\4489.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\450.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\a.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\a.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\b.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\b.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\c.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\c.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\d.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\d.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\e.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\e.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\f.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\f.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\g.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\g.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\h.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\h.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\i.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\i.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\j.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\J.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\k.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\k.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\l.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\l.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\m.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\m.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\n.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\n.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\o.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\o.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\p.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\p.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\q.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\q.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\r.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\r.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\s.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\s.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\t.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\t.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\u.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\u.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\v.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\v.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\w.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\w.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\wlu.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\x.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\x.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\y.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\y.xml

c:\documents and settings\albert\Application Data\PriceGong\Data\z.txt

c:\documents and settings\albert\Application Data\PriceGong\Data\z.xml

c:\documents and settings\albert\WINDOWS

c:\documents and settings\All Users\Application Data\TEMP

c:\program files\DealPly

c:\program files\DealPly\DealPly.crx

c:\program files\DealPly\icon.ico

c:\program files\DealPly\uninst.exe

c:\program files\Need2Find

c:\program files\Need2Find\bar\1.bin\N2FFXTBR.JAR

c:\program files\Need2Find\bar\1.bin\N2NTSTBR.JAR

c:\program files\Need2Find\bar\1.bin\PARTNER.DAT

c:\program files\Need2Find\bar\Cache\00AB0B0C

c:\program files\Need2Find\bar\Cache\00AB0E38

c:\program files\Need2Find\bar\Cache\files.ini

c:\program files\Need2Find\bar\History\search

c:\program files\Need2Find\bar\Settings\prevcfg.htm

c:\program files\RegGenie

c:\program files\RegGenie\Backups\41103,9645128009

c:\program files\RegGenie\RegGenie.ini

c:\windows\CdaC13BA.EXE

c:\windows\CdaC14BA.DLL

c:\windows\Fonts\acrsec.fon

c:\windows\IsUn0413.exe

c:\windows\system32\ctfmon(2).exe

c:\windows\system32\SET6B.tmp

c:\windows\system32\SET6C.tmp

c:\windows\system32\SET6D.tmp

c:\windows\system32\SET6E.tmp

c:\windows\system32\SET6F.tmp

c:\windows\system32\SET72.tmp

c:\windows\system32\SET73.tmp

c:\windows\system32\SET76.tmp

c:\windows\system32\SET7B.tmp

c:\windows\system32\SET7D.tmp

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-08-16 to 2012-09-16 ))))))))))))))))))))))))))))))

.

.

2012-09-16 22:00 . 2012-09-16 22:00 29904 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8C56D00D-194D-4DCB-BFDF-50C785E730BF}\MpKsla57e6d86.sys

2012-09-16 18:14 . 2012-08-23 07:15 7022536 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8C56D00D-194D-4DCB-BFDF-50C785E730BF}\mpengine.dll

2012-09-15 07:35 . 2012-08-23 07:15 7022536 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-09-02 19:06 . 2012-09-16 19:29 -------- d--h--r- c:\documents and settings\albert\Onlangs geopend

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-08-17 09:42 . 2012-04-05 10:34 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-08-17 09:42 . 2012-04-05 10:34 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-08-13 12:38 . 2012-03-26 16:15 44240 ----a-w- c:\windows\system32\drivers\fsbts.sys

2012-07-14 01:12 . 2012-07-14 01:12 388096 ----a-r- c:\documents and settings\albert\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-07-06 13:58 . 2003-04-08 12:00 78336 ----a-w- c:\windows\system32\browser.dll

2012-07-04 14:05 . 2003-06-21 14:47 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-07-03 18:23 . 2003-04-08 12:00 1866240 ----a-w- c:\windows\system32\win32k.sys

2012-07-02 17:38 . 2004-08-23 18:35 916992 ----a-w- c:\windows\system32\wininet.dll

2012-07-02 17:38 . 2003-04-08 12:00 43520 ------w- c:\windows\system32\licmgr10.dll

2012-07-02 17:38 . 2003-04-08 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

2012-07-02 12:05 . 2004-08-04 07:55 385024 ------w- c:\windows\system32\html.iec

2012-03-23 05:29 . 2012-03-23 05:29 0 -c--a-w- c:\program files\GUT3F.tmp

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LDM"="\Program\" [X]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-22 39408]

"Octoshape Streaming Services"="c:\documents and settings\albert\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2009-01-12 70936]

"NvMediaCenter"="c:\windows\System32\NVMCTRAY.DLL" [2003-05-02 49152]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-04-05 202256]

"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 144384]

"SpeedTouch USB Diagnostics"="c:\program files\Alcatel\SpeedTouch USB\Dragdiag.exe" [2002-11-12 860672]

"nwiz"="nwiz.exe" [2003-05-02 323584]

"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-02 4640768]

"Logitech Utility"="Logi_MwX.Exe" [2002-11-08 19968]

"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]

"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"C-Media Mixer"="Mixer.exe" [2002-10-15 1818624]

"F-Secure Manager"="c:\program files\PC Veilig\Common\FSM32.EXE" [2009-11-18 201128]

"F-Secure TNB"="c:\program files\PC Veilig\FSGUI\TNBUtil.exe" [2009-11-18 1655208]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

.

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2005-2-12 450560]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\dreamboxedit\\dreamboxedit.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Vuze\\Azureus.exe"=

.

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [26-3-2012 18:15 44240]

R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [26-3-2012 18:14 81864]

R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\PC Veilig\HIPS\drivers\fshs.sys [26-3-2012 18:14 69928]

R1 MpKsla57e6d86;MpKsla57e6d86;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8C56D00D-194D-4DCB-BFDF-50C785E730BF}\MpKsla57e6d86.sys [17-9-2012 0:00 29904]

R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\PC Veilig\Anti-Virus\minifilter\fsgk.sys [26-3-2012 18:13 149672]

S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8-2-2010 21:34 135664]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [5-4-2012 12:34 250056]

S3 FSORSPClient;F-Secure ORSP Client;c:\program files\PC Veilig\ORSP Client\fsorsp.exe [26-3-2012 18:14 61088]

S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [11-7-2008 14:20 13352]

S3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [8-2-2010 21:34 135664]

S4 F-Secure Filter;F-Secure File System Filter;c:\program files\PC Veilig\Anti-Virus\win2k\fsfilter.sys [26-3-2012 18:13 41640]

S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\PC Veilig\Anti-Virus\win2k\fsrec.sys [26-3-2012 18:13 27048]

.

--- Andere Services/Drivers In Geheugen ---

.

*NewlyCreated* - MPKSLA57E6D86

.

Inhoud van de 'Gedeelde Taken' map

.

2012-09-16 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 09:42]

.

2012-09-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-08 19:34]

.

2012-09-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-08 19:34]

.

2012-09-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-746137067-1844237615-725345543-1004Core.job

- c:\documents and settings\albert\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-26 05:29]

.

2012-09-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-746137067-1844237615-725345543-1004UA.job

- c:\documents and settings\albert\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-26 05:29]

.

2012-09-16 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job

- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-03-26 15:03]

.

2011-10-07 c:\windows\Tasks\prismShakeIcon.job

- c:\program files\NCH Software\Prism\prism.exe [2011-10-07 15:51]

.

2012-09-16 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-746137067-1844237615-725345543-1004.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 20:09]

.

2012-07-15 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-746137067-1844237615-725345543-1004.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 20:09]

.

2011-10-07 c:\windows\Tasks\videopadSevenDays.job

- c:\program files\NCH Software\VideoPad\videopad.exe [2011-10-07 15:52]

.

2011-10-07 c:\windows\Tasks\videopadShakeIcon.job

- c:\program files\NCH Software\VideoPad\videopad.exe [2011-10-07 15:52]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.nl/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = localhost

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

LSP: c:\program files\PC Veilig\FSPS\program\FSLSP.DLL

TCP: DhcpNameServer = 192.168.1.254

DPF: {D83C1BD1-DCBB-11D4-9425-0050BF33FA6E} - hxxp://www.cyclomedia.nl/download/components/CycloScopeLite.cab

.

- - - - ORPHANS VERWIJDERD - - - -

.

Toolbar-10 - (no file)

WebBrowser-{E6570CD8-9978-4621-B1F9-6A62436F0466} - (no file)

WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)

WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)

WebBrowser-{48405D3D-2674-4CD8-B1EF-9A719443BD3F} - (no file)

WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)

AddRemove-CdaC13Ba - c:\windows\CdaC13BA.EXE

AddRemove-DealPly - c:\program files\DealPly\uninst.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-09-17 00:36

Windows 5.1.2600 Service Pack 3 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'winlogon.exe'(520)

c:\program files\PC Veilig\FWES\Program\fsdc32.dll

.

- - - - - - - > 'lsass.exe'(576)

c:\program files\PC Veilig\FSPS\program\FSLSP.DLL

c:\program files\PC Veilig\FWES\Program\fsdc32.dll

.

- - - - - - - > 'csrss.exe'(496)

c:\program files\PC Veilig\FWES\Program\fsdc32.dll

.

Voltooingstijd: 2012-09-17 00:41:51

ComboFix-quarantined-files.txt 2012-09-16 22:41

.

Pre-Run: 22.720.258.048 bytes beschikbaar

Post-Run: 22.853.046.272 bytes beschikbaar

.

WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

.

- - End Of File - - 2B739C716E9E7637B4338B2197DC66E5

[kweezie wabbit]

Dit ziet er niet slecht uit.

Verwijder het vetgedrukte bestand c:\program files\GUT3F.tmp

Als je andere gelijkaardige bestanden vind, mag je die ook verwijderen.

[albada53]

Ik heb het betreffende bestand verwijderd. Het is nu weer mogelijk om met de rechtermuisknop bestanden naar de cd-rom te kopieren. Echter wanneer zij klaar staan om te branden en ik links aangeef in Windows XP: bestanden op cd zetten, dan gebeurt er niets. Haal ik de schijf er uit, dan krijg ik de wizard branden, dat er items klaarstaan om te branden, klik ik op volgende om het branden alsnog te starten dan gebeurt er weer niets. Voorheen kreeg ik de Media Player en zag je dat de bestanden werden gebrand. Het lijkt alsof de cd-rom nog steeds niet kan branden

[clarkie]

Je kan als test altijd gratis brandsoftware (klik erop) installeren en kijken of je daar wel mee je cd kan branden i.p.v. de ingebouwde software van Windows te gebruiken.

[albada53]

Ik heb de brandsoftware gedownload en het werkt!! Ik heb net weer een cd gebrand. Geweldig! Ik had ook nog eerst de installatiecd van Nero opnieuw geinstalleerd maar dat loste het probleem niet op.

Heel erg bedankt voor uw tijd en enorme hulp!

[kweezie wabbit]

Dan mag je nog het volgende doen.

Verwijder Combofix: Start -> Uitvoeren en typ: ComboFix /Uninstall (met spatie voor de /)

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Indien aanwezig mag je de map C:\Qoobox manueel verwijderen.