[OPGELOST] Beestjes

Ik denk dat ik het al vlaggen heb ...

mijn computer doet soms echt raar en gaat dan weer heel snel, dan weer traag bij bv het opstarten en ik heb er al eens mee op een onveilig netwerk mee gesurfd zonder door te hebben dat de firewall afstond. :s

Dit is het resultaat van hijack this:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:44:09, on 12/05/2008

Platform: Windows Vista (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16643)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\DellTPad\Apoint.exe

C:\Windows\OEM02Mon.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Java\jre1.6.0\bin\jusched.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Dell\MediaDirect\PCMService.exe

C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Dell Support Center\bin\sprtcmd.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\PROGRA~1\McAfee.com\Agent\mcagent.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\igfxsrvc.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Program Files\DellTPad\HidFind.exe

C:\Program Files\DellTPad\Apntex.exe

C:\Windows\system32\conime.exe

C:\Program Files\Creative Live! Cam\VideoFX\StartFX.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Search

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer aangeboden door Dell

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll

O2 - BHO: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: Best Security Tips Toolbar - {da30eff8-ccc6-4162-a20d-67402a26a215} - C:\Program Files\Best_Security_Tips\tbBest.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe

O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe

O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"

O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"

O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey

O4 - HKLM\..\Run: [sASSystemPrep] C:\SCIENC~1\SASSET~1\SAS\SASLES~1\srw\setup.exe "ranonce" -reboot -l9 "CmdLineFile:C:\Users\Anja\AppData\Local\Temp\{DFDAD~1\SRWCMD~1.INI" /a3 "update"011000 "AutoPwd:Sleutel3"

O4 - HKLM\..\Run: [sigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Microsoft Office2000\Office\OSA9.EXE

O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)

O13 - Gopher Prefix:

O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe

O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe

O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 9604 bytes

Als iemand toevallig weet of je de touchpad kan uitzetten en hoe?

En hoe je in windows vista de opstartprogramma's kan veranderen, zou ik ook heel dankbaar zijn.

Wat je logje betreft, moet je dit even uitvoeren :

Download Combofix en zet het op je Bureaublad.

Indien je Combofix al eerder hebt gebruikt, gelieve die versie te verwijderen en Combofix opnieuw te downloaden via bovenstaande link, want Combofix wordt dagelijks geupdate.

Indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download Combofix opnieuw. Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

Start Hijackthis op en kies voor 'Do a system scan only'. Selecteer alleen de items hieronder genoemd:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [sASSystemPrep] C:\SCIENC~1\SASSET~1\SAS\SASLES~1\srw\setup.exe "ranonce" -reboot -l9 "CmdLineFile:C:\Users\Anja\AppData\Local\Temp\{DFDAD~1\SRWCMD~1.INI" /a3 "update"011000 "AutoPwd:Sleutel3"

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)

Klik op 'Fix checked' om de items te verwijderen.

Dubbelklik op Combofix.exe en volg de instructies, aanvaard de disclaimer door y te typen. Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

Wanneer de fix voltooid is en na herstart, zal de log combofix.txt openen.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

Als ik Combofxi opstart (door het opnieuw te downloaden, want er is op mijn hele pc geen combofix.exe bestand te vinden) is het eerste wat er in het blauwe kadertje komt de foutmelding: 'kan het bericht voor berichtnummer 0x8 niet vinden in berichtenbestand voor system'. Iets verder verschijnt dit bericht opnieuw, maar toch begint hij te scannen.

Tijdens de scan komt de voorgeïnstalleerde McCaffee me melden dat er een virus op mijn pc zit. Het heet EICAR-test file.

Terwijl ik dit bericht typ is mijn taakbalk ook verdwenen en staat er in de plaats een zwarte balk. Als ik dit programma minimaliseer gaat het boven die zwarte balk staan, zodat ik het nog kan openen... (Ik heb mogelijk wel per ongeluk op een aantal toetsen tegelijk gedrukt hiervoor). Ook mijn bureaublad is volledig zwart...

Ofwel gebruik ik deze laptop heel verkeerd, maar ik zou eigenlijk niet weten wat ik misdoe, ofwel is er echt [en hop, de taakbalk verscheen weer even :-s ] iets heel erg mis met deze laptop. :-(

Bon, ik ga heropstarten.

Als ik Combofxi opstart (door het opnieuw te downloaden, want er is op mijn hele pc geen combofix.exe bestand te vinden) is het eerste wat er in het blauwe kadertje komt de foutmelding: 'kan het bericht voor berichtnummer 0x8 niet vinden in berichtenbestand voor system'. Iets verder verschijnt dit bericht opnieuw, maar toch begint hij te scannen.

Tijdens de scan komt de voorgeïnstalleerde McCaffee me melden dat er een virus op mijn pc zit. Het heet EICAR-test file.

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Download opnieuw Combofix en zet het op je Bureaublad.

Dubbelklik op Combofix.exe en volg de instructies, aanvaard de disclaimer door y te typen. Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen. Wanneer de fix voltooid is en na herstart, zal de log combofix.txt openen.

Indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download Combofix opnieuw. Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

Hang het log van Combofix (als alles gelukt is) aan je volgende bericht.

Oké! Bedankt!

Ik heb het opnieuw gedaan en kreeg dezelfde foutmelding, maar verder heeft het programma gewoon doorgedaan.

Mijn laptop heeft zich wel niet herstart alvorens de log te geven.

ComboFix 08-05-15.3 - Anja 2008-05-19 4:40:19.2 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1043.18.1016 [GMT 2:00]

Gestart vanuit: C:\Downloaded with mozilla\ComboFix2.exe

* Nieuw herstelpunt werd aangemaakt

* Resident AV is active

.

(((((((((((((((((((( Bestanden Gemaakt van 2008-04-19 to 2008-05-19 ))))))))))))))))))))))))))))))

.

Geen nieuwe bestanden aangemaakt in deze periode

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-05-18 17:48 --------- d-----w C:\Program Files\McAfee

2008-05-16 22:45 --------- d-----w C:\Program Files\IrfanView

2008-05-16 11:50 --------- d-----w C:\Program Files\K-Lite Codec Pack

2008-05-14 00:07 --------- d-----w C:\Program Files\Windows Mail

2008-05-12 19:43 812,344 ----a-w C:\Users\Anja\HJTInstall.exe

2008-05-12 19:43 --------- d-----w C:\Program Files\Trend Micro

2008-05-10 17:19 --------- d-----w C:\Program Files\BitComet

2008-05-10 16:29 5,742,544 ----a-w C:\Users\Anja\bitcomet_setup.exe

2008-05-06 21:45 --------- d-----w C:\Program Files\Common Files\Adobe

2008-05-05 20:41 690,648 ----a-w C:\Users\Anja\installer-9258-865-Ares.exe

2008-05-04 20:56 174 --sha-w C:\Program Files\desktop.ini

2008-05-04 20:48 --------- d-----w C:\Program Files\Windows Sidebar

2008-05-04 20:48 --------- d-----w C:\Program Files\Windows Photo Gallery

2008-05-04 20:48 --------- d-----w C:\Program Files\Windows Journal

2008-05-04 20:48 --------- d-----w C:\Program Files\Windows Defender

2008-05-04 20:48 --------- d-----w C:\Program Files\Windows Collaboration

2008-05-04 20:48 --------- d-----w C:\Program Files\Windows Calendar

2008-05-04 20:33 79,872 ----a-w C:\Windows\System32\axaltocm.dll

2008-05-04 20:33 101,376 ----a-w C:\Windows\System32\ifxcardm.dll

2008-04-30 15:43 318,904 ----a-w C:\Users\Anja\wmpfirefoxplugin.exe

2008-04-30 15:32 --------- d-----w C:\Program Files\Dell

2008-04-30 15:31 --------- d-----w C:\Program Files\PCCheckupOnline

2008-04-30 13:48 --------- d-----w C:\ProgramData\Dell

2008-04-30 13:46 31,542,424 ----a-w C:\Users\Anja\R180808-3.exe

2008-04-30 13:05 895,016 ----a-w C:\Users\Anja\WGAPluginInstall.exe

2008-04-28 18:43 --------- d-----w C:\Program Files\Conduit

2008-04-28 18:43 --------- d-----w C:\Program Files\Best_Security_Tips

2008-04-28 18:43 --------- d-----w C:\Program Files\Ares Galaxy Turbo Accelerator

2008-04-28 18:42 --------- d-----w C:\Users\Anja\AppData\Roaming\Download Manager

2008-04-28 18:41 128,376 ----a-w C:\Users\Anja\Download_AresGalaxyTurboAccelerator_installer.exe

2008-04-28 15:54 --------- d-----w C:\Program Files\Ares

2008-04-28 15:52 690,648 ----a-w C:\Users\Anja\installer-5130-865-Ares-Galaxy.exe

2008-04-27 19:37 --------- d-----w C:\Program Files\Advanced Diary

2008-04-27 19:35 --------- d-----w C:\Program Files\iDailyDiary

2008-04-26 21:47 --------- d-----w C:\Users\Anja\AppData\Roaming\Microsoft Web Folders

2008-04-26 21:30 2,018,372 ----a-w C:\Users\Anja\aresregular209_installer.exe

2008-04-26 20:43 --------- d-----w C:\Program Files\Bullfrog

2008-04-26 19:42 1,495,112 ----a-w C:\Users\Anja\install_flash_player.exe

2008-04-26 18:48 --------- d-----w C:\Program Files\SPSSEval

2008-04-26 18:36 --------- d-----w C:\Program Files\Common Files\InstallShield

2008-04-26 18:33 --------- d-----w C:\Users\Anja\AppData\Roaming\SAS

2008-04-26 18:33 --------- d-----w C:\ProgramData\SAS

2008-04-26 17:42 --------- d-----w C:\ProgramData\Lavasoft

2008-04-26 17:41 --------- d-----w C:\Program Files\Lavasoft

2008-04-26 17:39 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard

2008-04-26 17:04 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-04-26 17:04 --------- d-----w C:\Program Files\SAS

2008-04-26 14:47 --------- d-----w C:\ProgramData\Messenger Plus!

2008-04-25 23:56 194,560 ----a-w C:\Windows\System32\WebClnt.dll

2008-04-25 23:56 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys

2008-04-25 23:55 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys

2008-04-25 23:55 41,984 ----a-w C:\Windows\system32\drivers\monitor.sys

2008-04-25 23:55 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe

2008-04-25 23:55 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe

2008-04-25 23:55 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys

2008-04-25 23:55 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys

2008-04-25 23:55 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys

2008-04-25 23:55 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys

2008-04-25 23:55 110,136 ----a-w C:\Windows\system32\drivers\ataport.sys

2008-04-25 23:55 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys

2008-04-25 23:54 806,400 ----a-w C:\Windows\system32\drivers\tcpip.sys

2008-04-25 23:54 24,064 ----a-w C:\Windows\System32\netcfg.exe

2008-04-25 23:54 22,016 ----a-w C:\Windows\System32\netiougc.exe

2008-04-25 23:54 217,144 ----a-w C:\Windows\system32\drivers\netio.sys

2008-04-25 23:54 2,027,008 ----a-w C:\Windows\System32\win32k.sys

2008-04-25 23:54 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll

2008-04-25 23:53 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll

2008-04-25 23:53 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll

2008-04-25 23:53 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll

2008-04-25 23:53 296,448 ----a-w C:\Windows\System32\gdi32.dll

2008-04-25 23:53 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll

2008-04-25 23:53 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll

2008-04-25 23:53 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll

2008-04-25 23:53 1,686,528 ----a-w C:\Windows\System32\gameux.dll

2008-04-25 23:51 83,968 ----a-w C:\Windows\System32\dnsrslvr.dll

2008-04-25 23:51 826,368 ----a-w C:\Windows\System32\wininet.dll

2008-04-25 23:51 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll

2008-04-25 23:51 26,624 ----a-w C:\Windows\System32\ieUnatt.exe

2008-04-25 23:51 24,576 ----a-w C:\Windows\System32\dnscacheugc.exe

2008-04-25 23:50 56,320 ----a-w C:\Windows\System32\iesetup.dll

2008-04-25 23:50 1,244,672 ----a-w C:\Windows\System32\mcmde.dll

2008-04-25 21:07 126 ----a-w C:\Users\Anja\AppData\Roaming\wklnhst.dat

2008-04-25 20:50 --------- d-----w C:\Users\Anja\AppData\Roaming\Template

2008-04-25 19:23 --------- d-----w C:\Program Files\Messenger Plus! Live

2008-04-25 18:54 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller

2008-04-25 18:54 --------- d-----w C:\Program Files\Windows Live

2008-04-25 18:44 --------- d-----w C:\ProgramData\WLInstaller

2008-04-25 18:37 --------- d-----w C:\Program Files\Zone Labs

2008-04-25 18:31 53,080 ----a-w C:\Windows\System32\wuauclt.exe

2008-04-25 18:31 43,352 ----a-w C:\Windows\System32\wups2.dll

2008-04-25 18:31 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll

2008-04-25 18:31 1,524,224 ----a-w C:\Windows\System32\wucltux.dll

2008-04-25 18:29 80,896 ----a-w C:\Windows\System32\wudriver.dll

2008-04-25 18:29 549,720 ----a-w C:\Windows\System32\wuapi.dll

2008-04-25 18:29 33,624 ----a-w C:\Windows\System32\wups.dll

2008-04-25 18:29 31,232 ----a-w C:\Windows\System32\wuapp.exe

2008-04-25 18:29 163,000 ----a-w C:\Windows\System32\wuwebv.dll

2008-04-25 18:19 --------- d-----w C:\Users\Anja\AppData\Roaming\CyberLink

2008-04-23 19:04 --------- d-----w C:\Users\Anja\AppData\Roaming\Creative

2008-04-23 18:38 --------- d-sh--w C:\ProgramData\Sjablonen

.

------- Sigcheck -------

.

((((((((((((((((((((((((((((( snapshot@2008-05-14_ 8.34.20,16 )))))))))))))))))))))))))))))))))))))))))

.

- 2008-05-14 06:05:25 67,584 --s-a-w C:\Windows\bootstat.dat

+ 2008-05-19 02:17:17 67,584 --s-a-w C:\Windows\bootstat.dat

- 2008-05-14 06:05:26 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2008-05-18 12:58:15 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2008-05-14 06:05:26 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2008-05-18 12:58:15 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2008-05-14 06:29:48 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat

+ 2008-05-17 00:27:26 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat

- 2008-05-14 06:06:36 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT

+ 2008-05-19 02:37:24 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT

+ 2008-05-19 02:37:24 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1

- 2008-05-14 06:27:55 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat

+ 2008-05-17 00:25:27 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat

- 2008-05-14 06:06:29 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT

+ 2008-05-18 13:06:20 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT

+ 2008-05-18 13:06:20 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1

- 2008-05-14 06:11:09 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2008-05-18 22:36:39 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2008-05-14 06:11:09 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2008-05-18 22:36:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2008-05-14 06:11:09 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2008-05-18 22:36:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2008-05-14 06:27:52 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat

+ 2008-05-19 02:40:04 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat

+ 2008-05-19 02:40:04 262,144 ---ha-w C:\Windows\System32\config\systemprofile\ntuser.dat.LOG1

+ 2008-03-31 21:25:46 682,496 ----a-w C:\Windows\System32\divx.dll

+ 2008-03-21 20:28:54 81,920 ----a-w C:\Windows\System32\dpl100.dll

+ 2008-03-28 17:41:32 7,680 ----a-w C:\Windows\System32\ff_vfw.dll

- 2008-04-05 20:56:22 19,836,024 ----a-w C:\Windows\System32\mrt.exe

+ 2008-05-09 21:35:04 16,863,864 ----a-w C:\Windows\System32\mrt.exe

- 2008-05-14 06:12:41 108,190 ----a-w C:\Windows\System32\perfc009.dat

+ 2008-05-18 13:04:05 108,190 ----a-w C:\Windows\System32\perfc009.dat

- 2008-05-14 06:12:41 127,992 ----a-w C:\Windows\System32\perfc013.dat

+ 2008-05-18 13:04:05 127,992 ----a-w C:\Windows\System32\perfc013.dat

- 2008-05-14 06:12:41 620,384 ----a-w C:\Windows\System32\perfh009.dat

+ 2008-05-18 13:04:05 620,384 ----a-w C:\Windows\System32\perfh009.dat

- 2008-05-14 06:12:41 701,190 ----a-w C:\Windows\System32\perfh013.dat

+ 2008-05-18 13:04:05 701,190 ----a-w C:\Windows\System32\perfh013.dat

+ 2008-03-21 20:30:08 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll

- 2008-05-14 06:06:57 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT

+ 2008-05-14 06:40:29 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT

+ 2007-09-04 16:56:10 164,352 ----a-w C:\Windows\System32\unrar.dll

- 2008-05-14 06:08:52 4,604 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-857107312-1383821795-3718403111-1000_UserData.bin

+ 2008-05-18 13:07:47 4,822 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-857107312-1383821795-3718403111-1000_UserData.bin

- 2008-05-14 06:08:33 58,712 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin

+ 2008-05-18 13:07:41 59,182 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin

- 2008-05-14 06:07:59 32,170 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2008-05-18 13:07:19 33,480 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2008-01-10 12:15:30 755,027 ----a-w C:\Windows\System32\xvidcore.dll

+ 2008-01-10 12:16:20 159,839 ----a-w C:\Windows\System32\xvidvfw.dll

+ 2004-01-25 16:18:44 217,088 ----a-w C:\Windows\System32\yv12vfw.dll

.

-- Snapshot reset to current date --

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{da30eff8-ccc6-4162-a20d-67402a26a215}]

2008-01-16 10:32 1530904 --a------ C:\Program Files\Best_Security_Tips\tbBest.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= "C:\Program Files\Best_Security_Tips\tbBest.dll" [2008-01-16 10:32 1530904]

[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]

"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= C:\Program Files\Best_Security_Tips\tbBest.dll [2008-01-16 10:32 1530904]

[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]

"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2008-02-13 20:21 202544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-04-19 22:03 1006264]

"ECenter"="C:\Dell\E-Center\EULALauncher.exe" [2008-01-18 13:40 17920]

"Apoint"="C:\Program Files\DellTPad\Apoint.exe" [2007-09-07 08:49 159744]

"OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [2007-08-28 07:51 36864]

"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2008-03-06 09:58 141848]

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2008-03-06 09:58 166424]

"Persistence"="C:\Windows\system32\igfxpers.exe" [2008-03-06 09:58 133656]

"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2008-04-19 14:30 77824]

"DELL Webcam Manager"="C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 17:43 118784]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 14:00 174872]

"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-19 14:39 1838592]

"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-02-13 20:21 16384]

"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-11-01 16:39 189736]

"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992]

"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-11-12 13:07 405504]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\

Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-04-19 14:31:45 50688]

Microsoft Office.lnk - C:\Microsoft Office2000\Office\OSA9.EXE [1999-02-17 21:05:56 65588]

QuickSet.lnk - C:\Program Files\Dell\QuickSet\quickset.exe [2007-09-07 17:27:08 1180952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"RunStartupScriptSync"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.divxa32"= divxa32.acm

"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{CE00D137-CA7F-4FB2-A737-D8994271EE92}"= C:\Program Files\Dell\MediaDirect\MediaDirect.exe:Dell MediaDirect

"{27C619EE-3650-482C-AC2C-1DE1A7A365D1}"= C:\Program Files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program

"{26B2406F-85D3-4744-8B98-3D2A0C6D53A4}"= C:\Program Files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine

"{76BCF467-4FF3-4618-BCBA-2B85E5D5D2D6}"= C:\Program Files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server

"{B15E3911-7638-4F88-9FAA-820B81B03026}"= Profile=Private|Profile=Public|C:\Program Files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent

"{BD35F392-DF6D-4A4E-A51B-8B76E59BEBD4}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"DoNotAllowExceptions"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]

"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"= 0 (0x0)

R2 AESTFilters;Andrea ST Filters Service;C:\Windows\system32\aestsrv.exe [2007-11-12 13:07]

R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2008-02-13 20:21]

R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-08-05 02:39]

R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-03-06 09:58]

R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;C:\Windows\system32\drivers\IntcHdmi.sys [2008-03-06 09:58]

R3 OEM02Dev;Creative Camera OEM002 Driver;C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-08-28 07:51]

R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-08-28 07:51]

R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-09-29 07:31]

S2 0184681211132918mcinstcleanup;McAfee Application Installer Cleanup (0184681211132918);C:\Windows\TEMP\018468~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini []

S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 09:36]

.

Inhoud van de 'Gedeelde Taken' map

"2008-04-19 12:50:53 C:\Windows\Tasks\McDefragTask.job"

- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'

"2008-04-19 12:50:54 C:\Windows\Tasks\McQcTask.job"

- c:\PROGRA~1\mcafee\mqc\QcConsol.exe

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-05-19 04:44:25

Windows 6.0.6000 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

Voltooingstijd: 2008-05-19 4:45:53

ComboFix-quarantined-files.txt 2008-05-19 02:45:34

ComboFix2.txt 2008-05-14 06:34:59

Kan het bericht voor berichtnummer 0x2379 niet vinden in berichtenbestand voor Application.

Kan het bericht voor berichtnummer 0x2379 niet vinden in berichtenbestand voor Application.

269 --- E O F --- 2008-05-17 22:54:33

Eerst nog een vraagje. Heb je alles van Best Security Tips bewust zelf geïnstalleerd, want dat is iets waar ik sterk mijn twijfels over heb ? Mocht het niet het geval zijn, dan moeten we heel deze boel mee opruimen.

Eerst nog een vraagje. Heb je alles van Best Security Tips bewust zelf geïnstalleerd, want dat is iets waar ik sterk mijn twijfels over heb ? Mocht het niet het geval zijn, dan moeten we heel deze boel mee opruimen.

Heu, neen... wat is dat?

Deze laptop is wel pas n ieuw en er stond vanalles op geïnstalleerd, hij is van dell en die hebben blijkbaar een heel aantal eigen programma's. Is het iets wat ik niet meer nodig heb? Veiligheidstips (als het echte zijn tenminste) lijken me misschien wel belangrijker, maar jij bent de expert.

Veiligheidstips (als het echte zijn tenminste) lijken me misschien wel belangrijker, maar jij bent de expert.

Mijn optie is om deze te verwijderen met een nieuwe ingreep van Combofix. Mocht je ze echt nodig hebben - maar dat blijkt niet zo te zijn omdat ik uit je verhaal afleid dat je het niet kende - kan je het nog altijd opnieuw downloaden - wat ik dan weer zou afraden, maar goed.

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Folder::

C:\Program Files\Best_Security_Tips

Registry::

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{da30eff8-ccc6-4162-a20d-67402a26a215}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]

[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

Ik ben zelf ook geen fan van allerlei werkbalken (en ik zie er eigenlijk ook geen, maar ik surf met Mozilla) dus het zal ofwel malware zijn, of iets dat ik in ieder geval niet gebruikte. (En waarschijnlijk nooit had opgemerkt zonder jou. Bedankt!)

Ik kreeg weer dezelfde foutmelding als vroeger. En nadat hij gedaan had kreeg ik een zwart scherm en kon ik niets meer, behalve heropstarten via ctrl alt del. Verder is alles oké gegaan. Hier is het logje.

ComboFix 08-05-12.1 - ***** 2008-05-21 20:32:37.3 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1043.18.943 [GMT 2:00]

Gestart vanuit: C:\Downloaded with mozilla\ComboFix.exe

Command switches used :: C:\Users\****\Desktop\CFScript.txt

* Nieuw herstelpunt werd aangemaakt

* Resident AV is active

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Program Files\Best_Security_Tips

C:\Program Files\Best_Security_Tips\INSTALL.LOG

C:\Program Files\Best_Security_Tips\tbBest.dll

C:\Program Files\Best_Security_Tips\toolbar.cfg

C:\Program Files\Best_Security_Tips\UNWISE.EXE

.

(((((((((((((((((((( Bestanden Gemaakt van 2008-04-21 to 2008-05-21 ))))))))))))))))))))))))))))))

.

Geen nieuwe bestanden aangemaakt in deze periode

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-05-21 14:07 --------- d-----w C:\Program Files\Google

2008-05-21 10:17 --------- d-----w C:\Program Files\McAfee

2008-05-16 22:45 --------- d-----w C:\Program Files\IrfanView

2008-05-16 11:50 --------- d-----w C:\Program Files\K-Lite Codec Pack

2008-05-14 00:07 --------- d-----w C:\Program Files\Windows Mail

2008-05-12 19:43 812,344 ----a-w C:\Users\Anja\HJTInstall.exe

2008-05-12 19:43 --------- d-----w C:\Program Files\Trend Micro

2008-05-10 17:19 --------- d-----w C:\Program Files\BitComet

2008-05-10 16:29 5,742,544 ----a-w C:\Users\Anja\bitcomet_setup.exe

2008-05-06 21:45 --------- d-----w C:\Program Files\Common Files\Adobe

2008-05-05 20:41 690,648 ----a-w C:\Users\Anja\installer-9258-865-Ares.exe

2008-05-04 20:56 174 --sha-w C:\Program Files\desktop.ini

2008-05-04 20:48 --------- d-----w C:\Program Files\Windows Sidebar

2008-05-04 20:48 --------- d-----w C:\Program Files\Windows Photo Gallery

2008-05-04 20:48 --------- d-----w C:\Program Files\Windows Journal

2008-05-04 20:48 --------- d-----w C:\Program Files\Windows Defender

2008-05-04 20:48 --------- d-----w C:\Program Files\Windows Collaboration

2008-05-04 20:48 --------- d-----w C:\Program Files\Windows Calendar

2008-05-04 20:33 79,872 ----a-w C:\Windows\System32\axaltocm.dll

2008-05-04 20:33 101,376 ----a-w C:\Windows\System32\ifxcardm.dll

2008-04-30 15:43 318,904 ----a-w C:\Users\Anja\wmpfirefoxplugin.exe

2008-04-30 15:32 --------- d-----w C:\Program Files\Dell

2008-04-30 15:31 --------- d-----w C:\Program Files\PCCheckupOnline

2008-04-30 13:48 --------- d-----w C:\ProgramData\Dell

2008-04-30 13:46 31,542,424 ----a-w C:\Users\Anja\R180808-3.exe

2008-04-30 13:05 895,016 ----a-w C:\Users\Anja\WGAPluginInstall.exe

2008-04-28 18:43 --------- d-----w C:\Program Files\Conduit

2008-04-28 18:43 --------- d-----w C:\Program Files\Ares Galaxy Turbo Accelerator

2008-04-28 18:42 --------- d-----w C:\Users\Anja\AppData\Roaming\Download Manager

2008-04-28 18:41 128,376 ----a-w C:\Users\Anja\Download_AresGalaxyTurboAccelerator_installer.exe

2008-04-28 15:54 --------- d-----w C:\Program Files\Ares

2008-04-28 15:52 690,648 ----a-w C:\Users\Anja\installer-5130-865-Ares-Galaxy.exe

2008-04-27 19:37 --------- d-----w C:\Program Files\Advanced Diary

2008-04-27 19:35 --------- d-----w C:\Program Files\iDailyDiary

2008-04-26 21:47 --------- d-----w C:\Users\Anja\AppData\Roaming\Microsoft Web Folders

2008-04-26 21:30 2,018,372 ----a-w C:\Users\Anja\aresregular209_installer.exe

2008-04-26 20:43 --------- d-----w C:\Program Files\Bullfrog

2008-04-26 19:42 1,495,112 ----a-w C:\Users\Anja\install_flash_player.exe

2008-04-26 18:48 --------- d-----w C:\Program Files\SPSSEval

2008-04-26 18:36 --------- d-----w C:\Program Files\Common Files\InstallShield

2008-04-26 18:33 --------- d-----w C:\Users\Anja\AppData\Roaming\SAS

2008-04-26 18:33 --------- d-----w C:\ProgramData\SAS

2008-04-26 17:42 --------- d-----w C:\ProgramData\Lavasoft

2008-04-26 17:41 --------- d-----w C:\Program Files\Lavasoft

2008-04-26 17:39 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard

2008-04-26 17:04 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-04-26 17:04 --------- d-----w C:\Program Files\SAS

2008-04-26 14:47 --------- d-----w C:\ProgramData\Messenger Plus!

2008-04-25 23:56 194,560 ----a-w C:\Windows\System32\WebClnt.dll

2008-04-25 23:56 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys

2008-04-25 23:55 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys

2008-04-25 23:55 41,984 ----a-w C:\Windows\system32\drivers\monitor.sys

2008-04-25 23:55 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe

2008-04-25 23:55 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe

2008-04-25 23:55 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys

2008-04-25 23:55 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys

2008-04-25 23:55 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys

2008-04-25 23:55 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys

2008-04-25 23:55 110,136 ----a-w C:\Windows\system32\drivers\ataport.sys

2008-04-25 23:55 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys

2008-04-25 23:54 806,400 ----a-w C:\Windows\system32\drivers\tcpip.sys

2008-04-25 23:54 24,064 ----a-w C:\Windows\System32\netcfg.exe

2008-04-25 23:54 22,016 ----a-w C:\Windows\System32\netiougc.exe

2008-04-25 23:54 217,144 ----a-w C:\Windows\system32\drivers\netio.sys

2008-04-25 23:54 2,027,008 ----a-w C:\Windows\System32\win32k.sys

2008-04-25 23:54 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll

2008-04-25 23:53 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll

2008-04-25 23:53 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll

2008-04-25 23:53 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll

2008-04-25 23:53 296,448 ----a-w C:\Windows\System32\gdi32.dll

2008-04-25 23:53 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll

2008-04-25 23:53 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll

2008-04-25 23:53 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll

2008-04-25 23:53 1,686,528 ----a-w C:\Windows\System32\gameux.dll

2008-04-25 23:51 83,968 ----a-w C:\Windows\System32\dnsrslvr.dll

2008-04-25 23:51 826,368 ----a-w C:\Windows\System32\wininet.dll

2008-04-25 23:51 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll

2008-04-25 23:51 26,624 ----a-w C:\Windows\System32\ieUnatt.exe

2008-04-25 23:51 24,576 ----a-w C:\Windows\System32\dnscacheugc.exe

2008-04-25 23:50 56,320 ----a-w C:\Windows\System32\iesetup.dll

2008-04-25 23:50 1,244,672 ----a-w C:\Windows\System32\mcmde.dll

2008-04-25 21:07 126 ----a-w C:\Users\Anja\AppData\Roaming\wklnhst.dat

2008-04-25 20:50 --------- d-----w C:\Users\Anja\AppData\Roaming\Template

2008-04-25 19:23 --------- d-----w C:\Program Files\Messenger Plus! Live

2008-04-25 18:54 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller

2008-04-25 18:54 --------- d-----w C:\Program Files\Windows Live

2008-04-25 18:44 --------- d-----w C:\ProgramData\WLInstaller

2008-04-25 18:37 --------- d-----w C:\Program Files\Zone Labs

2008-04-25 18:31 53,080 ----a-w C:\Windows\System32\wuauclt.exe

2008-04-25 18:31 43,352 ----a-w C:\Windows\System32\wups2.dll

2008-04-25 18:31 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll

2008-04-25 18:31 1,524,224 ----a-w C:\Windows\System32\wucltux.dll

2008-04-25 18:29 80,896 ----a-w C:\Windows\System32\wudriver.dll

2008-04-25 18:29 549,720 ----a-w C:\Windows\System32\wuapi.dll

2008-04-25 18:29 33,624 ----a-w C:\Windows\System32\wups.dll

2008-04-25 18:29 31,232 ----a-w C:\Windows\System32\wuapp.exe

2008-04-25 18:29 163,000 ----a-w C:\Windows\System32\wuwebv.dll

2008-04-25 18:19 --------- d-----w C:\Users\Anja\AppData\Roaming\CyberLink

2008-04-23 19:04 --------- d-----w C:\Users\Anja\AppData\Roaming\Creative

2008-04-23 18:38 --------- d-sh--w C:\ProgramData\Sjablonen

.

------- Sigcheck -------

.

((((((((((((((((((((((((((((( snapshot_2008-05-19_ 4.45.08.56 )))))))))))))))))))))))))))))))))))))))))

.

- 2008-05-19 02:17:17 67,584 --s-a-w C:\Windows\bootstat.dat

+ 2008-05-21 16:02:32 67,584 --s-a-w C:\Windows\bootstat.dat

- 2008-05-18 12:58:15 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2008-05-20 17:06:31 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2008-05-18 12:58:15 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2008-05-20 17:06:31 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2008-05-19 02:37:24 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT

+ 2008-05-20 17:08:28 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT

+ 2008-05-20 17:08:28 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1

- 2008-05-18 13:06:20 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT

+ 2008-05-20 17:08:23 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT

- 2008-05-18 22:36:39 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2008-05-21 14:36:39 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2008-05-18 22:36:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2008-05-21 14:36:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2008-05-18 22:36:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2008-05-21 14:36:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2008-05-19 02:40:04 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat

+ 2008-05-21 18:32:23 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat

+ 2008-05-21 18:32:23 262,144 ---ha-w C:\Windows\System32\config\systemprofile\ntuser.dat.LOG1

- 2008-05-18 13:04:05 108,190 ----a-w C:\Windows\System32\perfc009.dat

+ 2008-05-19 22:35:22 108,190 ----a-w C:\Windows\System32\perfc009.dat

- 2008-05-18 13:04:05 127,992 ----a-w C:\Windows\System32\perfc013.dat

+ 2008-05-19 22:35:22 127,992 ----a-w C:\Windows\System32\perfc013.dat

- 2008-05-18 13:04:05 620,384 ----a-w C:\Windows\System32\perfh009.dat

+ 2008-05-19 22:35:22 620,384 ----a-w C:\Windows\System32\perfh009.dat

- 2008-05-18 13:04:05 701,190 ----a-w C:\Windows\System32\perfh013.dat

+ 2008-05-19 22:35:22 701,190 ----a-w C:\Windows\System32\perfh013.dat

- 2008-05-18 13:07:47 4,822 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-857107312-1383821795-3718403111-1000_UserData.bin

+ 2008-05-20 17:10:08 4,822 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-857107312-1383821795-3718403111-1000_UserData.bin

- 2008-05-18 13:07:41 59,182 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin

+ 2008-05-20 17:10:07 59,230 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin

- 2008-05-18 13:07:19 33,480 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2008-05-20 17:29:58 33,722 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin

.

-- Snapshot reset to current date --

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{da30eff8-ccc6-4162-a20d-67402a26a215}]

C:\Program Files\Best_Security_Tips\tbBest.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= "C:\Program Files\Best_Security_Tips\tbBest.dll" [ ]

[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]

"{DA30EFF8-CCC6-4162-A20D-67402A26A215}"= C:\Program Files\Best_Security_Tips\tbBest.dll [ ]

[HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]

"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2008-02-13 20:21 202544]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-19 14:39 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-04-19 22:03 1006264]

"ECenter"="C:\Dell\E-Center\EULALauncher.exe" [2008-01-18 13:40 17920]

"Apoint"="C:\Program Files\DellTPad\Apoint.exe" [2007-09-07 08:49 159744]

"OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [2007-08-28 07:51 36864]

"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2008-03-06 09:58 141848]

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2008-03-06 09:58 166424]

"Persistence"="C:\Windows\system32\igfxpers.exe" [2008-03-06 09:58 133656]

"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2008-04-19 14:30 77824]

"DELL Webcam Manager"="C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 17:43 118784]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 14:00 174872]

"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-19 14:39 1838592]

"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-02-13 20:21 16384]

"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-11-01 16:39 189736]

"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992]

"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-11-12 13:07 405504]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\

Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-04-19 14:31:45 50688]

Microsoft Office.lnk - C:\Microsoft Office2000\Office\OSA9.EXE [1999-02-17 21:05:56 65588]

QuickSet.lnk - C:\Program Files\Dell\QuickSet\quickset.exe [2007-09-07 17:27:08 1180952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"RunStartupScriptSync"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.divxa32"= divxa32.acm

"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{CE00D137-CA7F-4FB2-A737-D8994271EE92}"= C:\Program Files\Dell\MediaDirect\MediaDirect.exe:Dell MediaDirect

"{27C619EE-3650-482C-AC2C-1DE1A7A365D1}"= C:\Program Files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program

"{26B2406F-85D3-4744-8B98-3D2A0C6D53A4}"= C:\Program Files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine

"{76BCF467-4FF3-4618-BCBA-2B85E5D5D2D6}"= C:\Program Files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server

"{B15E3911-7638-4F88-9FAA-820B81B03026}"= Profile=Private|Profile=Public|C:\Program Files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent

"{BD35F392-DF6D-4A4E-A51B-8B76E59BEBD4}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"DoNotAllowExceptions"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]

"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"= 0 (0x0)

R2 AESTFilters;Andrea ST Filters Service;C:\Windows\system32\aestsrv.exe [2007-11-12 13:07]

R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2008-02-13 20:21]

R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-08-05 02:39]

R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-03-06 09:58]

R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;C:\Windows\system32\drivers\IntcHdmi.sys [2008-03-06 09:58]

R3 OEM02Dev;Creative Camera OEM002 Driver;C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-08-28 07:51]

R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-08-28 07:51]

R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-09-29 07:31]

S2 0228761211365058mcinstcleanup;McAfee Application Installer Cleanup (0228761211365058);C:\Windows\TEMP\022876~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini []

S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 09:36]

.

Inhoud van de 'Gedeelde Taken' map

"2008-04-19 12:50:53 C:\Windows\Tasks\McDefragTask.job"

- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'

"2008-04-19 12:50:54 C:\Windows\Tasks\McQcTask.job"

- c:\PROGRA~1\mcafee\mqc\QcConsol.exe

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-05-21 20:37:06

Windows 6.0.6000 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

Voltooingstijd: 2008-05-21 20:38:32

ComboFix-quarantined-files.txt 2008-05-21 18:38:23

ComboFix2.txt 2008-05-19 02:45:54

ComboFix3.txt 2008-05-14 06:34:59

Kan het bericht voor berichtnummer 0x2379 niet vinden in berichtenbestand voor Application.

Kan het bericht voor berichtnummer 0x2379 niet vinden in berichtenbestand voor Application.

263 --- E O F --- 2008-05-17 22:54:33

Download The Avenger en plaats het op je bureaublad:

Unzip het.

Start het programma door op avenger.exe te klikken.

In het venster "Input Script here", plak je het volgende (vetgedrukte):

Registry keys to delete:

HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{da30eff8-ccc6-4162-a20d-67402a26a215}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar

HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser

HKEY_CLASSES_ROOT\clsid\{da30eff8-ccc6-4162-a20d-67402a26a215}

Klik daarna op de knop "Execute".

Avenger zal aangeven dat de computer gaat herstarten, sta dit toe.

Na nieuwe opstart opent een logfile (avenger.txt).

Verwijder volgende vetgedrukte map (indien nog aanwezig) :

C:\Program Files\Best_Security_Tips

Download MBAM (Malwarebytes' Anti-Malware).

Dubbelklik op mbam-setup.exe om het programma te installeren.

Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Start Malwarebytes' Anti-Malware, Klik daarna op "Voltooien".

Indien een update gevonden werd, zal die gedownload en geïnstalleerd worden.

Wanneer het programma volledig up to date is, selecteer dan in het tabblad Scanner : "Snelle Scan", daarna klik op Scan.

Het scannen kan een tijdje duren, dus wees geduldig.

Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.

Zorg ervoor dat daar alles aangevinkt is, daarna klik op: Verwijder geselecteerde.

Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie verder)

De log wordt automatisch bewaard door MBAM en kan je terugvinden door op de "Logs" tab te klikken in MBAM.

Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken.Daarna zal het vragen om de Computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.

Plak de inhoud van het logje van The Avenger en MBAM in je volgende bericht, samen met een nieuw HijackThis log.