Verschillende problemen met het herinstaleren van Windows en het Formateren

Liné · 3 oktober 2010

hardstikke bedankt voor de info tot zover, heb net met hijack de eerste stap gedaan heb nu geen tijd om verder te gaan maar ga hier van de week mee verder, zodra ik dat gedaan heb post ik de nieuwe logjes hier.

stegisoft · 3 oktober 2010

Dat is prima.

Liné · 8 oktober 2010

Malware logje:

Malwarebytes' Anti-Malware 1.46

Malwarebytes

Databaseversie: 4775

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.11

8-10-2010 13:48:39

mbam-log-2010-10-08 (13-48-39).txt

Scantype: Snelle scan

Objecten gescand: 215496

Verstreken tijd: 34 minuut/minuten, 8 seconde(n)

Geheugenprocessen geïnfecteerd: 0

Geheugenmodulen geïnfecteerd: 0

Registersleutels geïnfecteerd: 6

Registerwaarden geïnfecteerd: 1

Registerdata geïnfecteerd: 1

Mappen geïnfecteerd: 0

Bestanden geïnfecteerd: 2

Geheugenprocessen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registersleutels geïnfecteerd:

HKEY_CLASSES_ROOT\Typelib\{9233c3c0-1472-4091-a505-5580a23bb4ac} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4e7bd74f-2b8d-469e-86bd-fd60bb9aae3a} (Adware.OneToolBar) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Cognac (Rogue.Multiple) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox (Trojan.Agent) -> Quarantined and deleted successfully.

Registerwaarden geïnfecteerd:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4e7bd74f-2b8d-469e-86bd-fd60bb9aae3a} (Adware.OneToolBar) -> Quarantined and deleted successfully.

Registerdata geïnfecteerd:

HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Mappen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Bestanden geïnfecteerd:

C:\Documents and Settings\liné\Local Settings\Temporary Internet Files\Content.IE5\8PSHY10J\smile[2].gif (Trojan.Zbot) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\PFKoC6M8.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.

Hijack Logje:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 14:29:27, on 8-10-2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.17080)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\PROGRA~1\AVG\AVG8\avgam.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\vsnpstd.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\HP-All-in-one\HP Software Update\HPWuSchd2.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\DivX\DivX Update\DivXUpdate.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Program Files\FTD Watchdog\FtdMonitor.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

C:\Program Files\HP-All-in-one\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\HP-All-in-one\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\hj\Trend Micro\HiJackThis\HiJackThis.exe

C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O1 - Hosts: 127.255.255.255 195.137.236.101

O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com

O1 - Hosts: 127.255.255.255 CD and DVD Burning Software - Alcohol Soft copy and virtual drive software Alcohol 120 and 52% Free Edition

O1 - Hosts: 127.255.255.255 images.alcohol-soft.com

O1 - Hosts: 127.255.255.255 trial.alcohol-soft.com

O1 - Hosts: 127.255.255.255 support.alcohol-soft.com

O1 - Hosts: 127.255.255.255 users.alcohol-soft.com

O1 - Hosts: 127.255.255.255 shop.alcohol-soft.com

O1 - Hosts: 127.255.255.255 195.137.236.101

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe

O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [vdrdpup] C:\WINDOWS\system32\rundll32 C:\WINDOWS\system32\vdrdpup.dll,RegisterVirtualChannel

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP-All-in-one\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

O4 - HKCU\..\Run: [FTD Watchdog Monitor] "C:\Program Files\FTD Watchdog\FtdMonitor.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Dragon NaturallySpeaking.lnk = C:\Program Files\Nuance\NaturallySpeaking9\Program\natspeak.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP-All-in-one\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MI699F~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\Line\Application Data\DVDVideoSoftIEHelpers\youtubetomp3.htm

O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra 'Tools' menuitem: Mobiele favorieten maken... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI699F~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://cache.hyves-static.net/statics/Aurigma/ImageUploader4.cab

O16 - DPF: {705EC6D4-B138-4079-A307-EF13E40C2416} (InstallerWeb Control) - https://sslvpn.accent.nl/CACHE/sdesktop/install/binaries/instweb.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 10984 bytes

Liné · 8 oktober 2010

moet ik perse nod32 verwijderen of mag ik die ook houden?

Want die houd ik eigenlijk liever tenzij jullie zeggen dat avg beter is..?

stegisoft · 8 oktober 2010

Het blijft het zelfde als je NOD32 of AVG neemt maar niet de twee samen.

Ik meen dat ik onze expert had gevraagd om naar uw log te kijken. Dus even geduld.

Liné · 8 oktober 2010

oke danku dan gaat avg eraf, zoals ik al zei, geen haast.

kape · 8 oktober 2010

Start Hijackthis op. Selecteer “Scan”. Selecteer alleen de items die hieronder zijn genoemd:

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

Klik op 'Fix checked' om de items te verwijderen.

Download HostsXpert

Unzip het programma naar je Bureaublad.

Open de map en dubbelklik op Hoster.exe

Klik op "Restore Microsofts Original Hosts File"

Klik op "OK" en sluit het programma.

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:
Klik hier
Als het je niet lukt om ze uit te schakelen, ga dan gewoon door naar de volgende stap.
Dubbelklik op ComboFix.exe en volg de meldingen op het scherm.
ComboFix zal controleren of dat de Microsoft Windows Recovery Console reeds is geïnstalleerd.
**Let op: Als de Microsoft Windows Recovery Console al is geïnstalleerd, dan krijg je de volgende schermen niet te zien en zal ComboFix automatisch verder gaan met het scannen naar malware.
Volg de meldingen op het scherm om ComboFix de Microsoft Windows Recovery Console te laten downloaden en installeren.

Je krijgt de volgende melding te zien wanneer ComboFix de Microsoft Windows Recovery Console succesvol heeft geïnstalleerd:

Klik op Ja om verder te gaan met het scannen naar malware.

Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht, samen met een nieuw log van HijackThis.

Liné · 8 oktober 2010

die 2 dingen die ik moet verwijderen in hijack staan er niet tussen..

?

kape · 8 oktober 2010

Vreemd ... maar ga dan maar gewoon verder met de volgende opdrachten.

Liné · 8 oktober 2010

Combofix logje:

ComboFix 10-10-07.02 - Line 09-10-2010 1:18.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1023.718 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Line\Bureaublad\ComboFix.exe

AV: Eset NOD32 antivirus system 2.51 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

* Aanwezig AV is actief

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Line\WebVpnRegKey6-sslvpn-accent-nl.dll

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-09-08 to 2010-10-08 ))))))))))))))))))))))))))))))

.

2010-10-08 10:56 . 2010-10-08 10:56 -------- d-----w- c:\documents and settings\Line\Application Data\Malwarebytes

2010-10-08 10:56 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-08 10:56 . 2010-10-08 10:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes

2010-10-08 10:56 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-10-08 10:55 . 2010-10-08 10:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-10-03 00:44 . 2010-10-03 00:44 -------- d-----w- c:\program files\Speccy

2010-10-03 00:16 . 2010-10-03 00:16 388096 ----a-r- c:\documents and settings\Line\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-10-03 00:15 . 2010-10-03 00:15 -------- d-----w- c:\program files\hj

2010-10-03 00:01 . 2010-10-03 00:01 -------- d-----w- c:\program files\Lavalys

2010-10-02 16:03 . 2010-10-02 16:03 -------- d-----w- c:\program files\Magical Jelly Bean

2010-09-26 00:18 . 2010-10-01 14:35 -------- d-----w- c:\program files\Call of Duty

2010-09-16 21:52 . 2010-09-01 17:56 52224 ----a-w- c:\documents and settings\Line\Application Data\Mozilla\Firefox\Profiles\vucxs13e.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll

2010-09-16 21:52 . 2010-09-01 17:56 101376 ----a-w- c:\documents and settings\Line\Application Data\Mozilla\Firefox\Profiles\vucxs13e.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll

2010-09-16 21:52 . 2010-08-30 12:33 43008 ----a-w- c:\documents and settings\Line\Application Data\Mozilla\Firefox\Profiles\vucxs13e.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll

2010-09-16 21:52 . 2010-08-30 12:33 338944 ----a-w- c:\documents and settings\Line\Application Data\Mozilla\Firefox\Profiles\vucxs13e.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll

2010-09-16 21:52 . 2010-08-30 12:34 1496064 ----a-w- c:\documents and settings\Line\Application Data\Mozilla\Firefox\Profiles\vucxs13e.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

2010-09-16 21:52 . 2010-08-30 12:33 346112 ----a-w- c:\documents and settings\Line\Application Data\Mozilla\Firefox\Profiles\vucxs13e.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-25 21:46 . 2009-02-27 21:33 -------- d-----w- c:\documents and settings\Line\Application Data\DivX

2010-09-05 05:14 . 2006-08-15 13:00 96384 ---ha-w- c:\windows\system32\drivers\sptd1517.sys

2010-09-05 00:35 . 2006-02-12 14:41 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-09-04 22:21 . 2010-09-04 22:21 -------- d-----w- c:\program files\Microsoft Games

2010-09-04 17:29 . 2010-05-28 17:41 -------- d-----w- c:\program files\Asprate

2010-09-04 17:26 . 2007-06-15 15:29 -------- d-----w- c:\program files\Bonjour

2010-09-04 13:20 . 2009-02-24 16:38 -------- d-----w- c:\program files\Microsoft Silverlight

2010-09-02 23:05 . 2007-03-24 20:13 -------- d-----w- c:\documents and settings\Line\Application Data\Screenshot Sender

2010-08-27 15:15 . 2004-08-04 12:00 92828 ---ha-w- c:\windows\system32\perfc013.dat

2010-08-27 15:15 . 2004-08-04 12:00 513440 ---ha-w- c:\windows\system32\perfh013.dat

2010-08-21 17:51 . 2010-05-21 14:40 -------- d-----w- c:\program files\Common Files\DVDVideoSoft

2010-08-21 17:51 . 2010-05-21 14:40 -------- d-----w- c:\program files\DVDVideoSoft

2010-08-19 16:48 . 2010-08-19 16:46 -------- d-----w- c:\program files\iTunes

2010-08-19 16:48 . 2010-08-19 16:46 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2010-08-19 16:46 . 2006-08-15 10:21 -------- d-----w- c:\program files\iPod

2010-08-19 16:46 . 2008-11-19 14:55 -------- d-----w- c:\program files\Common Files\Apple

2010-08-19 16:42 . 2010-08-19 16:42 -------- d-----w- c:\program files\QuickTime

2010-08-19 16:40 . 2006-12-02 12:20 -------- d-----w- c:\program files\Apple Software Update

2010-08-19 16:37 . 2008-11-19 14:55 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Apple

2010-08-16 18:16 . 2010-08-16 18:16 503808 ----a-w- c:\documents and settings\Line\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6cd2d8cf-n\msvcp71.dll

2010-08-16 18:16 . 2010-08-16 18:16 499712 ----a-w- c:\documents and settings\Line\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6cd2d8cf-n\jmc.dll

2010-08-16 18:16 . 2010-08-16 18:16 348160 ----a-w- c:\documents and settings\Line\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-6cd2d8cf-n\msvcr71.dll

2010-08-16 18:16 . 2010-08-16 18:16 61440 ----a-w- c:\documents and settings\Line\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-17400f2d-n\decora-sse.dll

2010-08-16 18:16 . 2010-08-16 18:16 12800 ----a-w- c:\documents and settings\Line\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-17400f2d-n\decora-d3d.dll

2010-08-16 16:08 . 2010-08-16 16:08 503808 ----a-w- c:\documents and settings\Pe\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3a2ef5f0-n\msvcp71.dll

2010-08-16 16:08 . 2010-08-16 16:08 499712 ----a-w- c:\documents and settings\Pe\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3a2ef5f0-n\jmc.dll

2010-08-16 16:08 . 2010-08-16 16:08 348160 ----a-w- c:\documents and settings\Pe\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3a2ef5f0-n\msvcr71.dll

2010-08-16 16:08 . 2010-08-16 16:08 61440 ----a-w- c:\documents and settings\Pe\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-67608a1a-n\decora-sse.dll

2010-08-16 16:08 . 2010-08-16 16:08 12800 ----a-w- c:\documents and settings\Pe\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-67608a1a-n\decora-d3d.dll

2010-08-13 10:17 . 2010-08-13 10:17 -------- d-----w- c:\documents and settings\Pe\Application Data\DivX

2010-08-12 12:46 . 2010-08-12 12:45 -------- d-----w- c:\documents and settings\Pe\Application Data\Tibia

2010-08-12 08:30 . 2010-08-12 08:30 125 ----a-w- c:\documents and settings\Pe\Local Settings\Application Data\fusioncache.dat

2010-08-09 20:27 . 2010-08-09 20:27 57344 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll

2010-08-09 20:27 . 2010-08-09 20:27 56765 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe

2010-08-09 20:27 . 2010-08-09 20:27 56997 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\WebPlayer\Uninstaller.exe

2010-08-09 20:26 . 2010-08-09 20:26 53600 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\Update\Uninstaller.exe

2010-08-09 20:26 . 2010-08-09 20:26 57715 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\Player\Uninstaller.exe

2010-08-09 20:24 . 2010-08-09 20:24 84054 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\TransferWizard\Uninstaller.exe

2010-08-09 20:24 . 2010-08-09 20:24 57054 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DSDesktopComponents\Uninstaller.exe

2010-08-09 20:24 . 2010-08-09 20:24 54166 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DSAVCDecoder\Uninstaller.exe

2010-08-09 20:24 . 2010-08-09 20:24 57532 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DSASPDecoder\Uninstaller.exe

2010-08-09 20:24 . 2010-08-09 20:24 56458 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DivXDecoderShortcut\Uninstaller.exe

2010-08-09 20:24 . 2010-08-09 20:24 54174 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DSAACDecoder\Uninstaller.exe

2010-08-09 20:24 . 2010-08-09 20:24 54153 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\DFXPlugin\Uninstaller.exe

2010-08-09 20:24 . 2010-08-09 20:24 54128 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\Converter\Uninstaller.exe

2010-08-09 20:24 . 2010-08-09 20:24 54644 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\TranscodeEngine\Uninstaller.exe

2010-08-09 20:23 . 2010-08-09 20:23 54101 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\MPEG2Plugin\Uninstaller.exe

2010-08-09 20:23 . 2010-08-09 20:23 57409 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\ControlPanel\Uninstaller.exe

2010-08-09 20:23 . 2010-08-09 20:23 52963 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe

2010-08-09 20:23 . 2010-08-09 20:23 54073 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\Qt4.5\Uninstaller.exe

2010-08-09 20:23 . 2010-08-09 20:23 56969 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\ASPEncoder\Uninstaller.exe

2010-08-09 20:14 . 2010-08-09 20:27 1062184 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\Setup\Resource.dll

2010-08-09 20:13 . 2010-08-09 20:27 895256 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX\Setup\DivXSetup.exe

2010-07-21 14:30 . 2010-07-21 14:30 73000 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe

2004-06-13 15:04 . 2004-06-13 15:04 626688 ----a-w- c:\program files\Common Files\PowerButton.ocx

2003-03-20 11:21 . 2003-03-20 11:21 409600 ----a-w- c:\program files\Common Files\activelock1884.ocx

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"FTD Watchdog Monitor"="c:\program files\FTD Watchdog\FtdMonitor.exe" [2009-03-14 176640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMan"="SOUNDMAN.EXE" [2004-06-18 67584]

"NeroCheck"="c:\windows\system32\\NeroCheck.exe" [2001-07-09 155648]

"snpstd"="c:\windows\vsnpstd.exe" [2003-12-31 40960]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

"nwiz"="nwiz.exe" [2006-10-22 1622016]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]

"vdrdpup"="c:\windows\system32\vdrdpup.dll" [2005-11-02 94208]

"HP Software Update"="c:\program files\HP-All-in-one\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Line\Menu Start\Programma's\Opstarten\

Dragon NaturallySpeaking.lnk - c:\program files\Nuance\NaturallySpeaking9\Program\natspeak.exe [2007-4-26 2524776]

c:\documents and settings\All Users.WINDOWS\Menu Start\Programma's\Opstarten\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

HP Digital Imaging Monitor.lnk - c:\program files\HP-All-in-one\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP-All-in-one\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Call of Duty\\CoDMP.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 Tetri5;Tetri5 driver;c:\windows\system32\drivers\Tetri5.sys [22-9-2006 9:15 53088]

S1 ctredr15.sys;ctredr15.sys;\??\c:\windows\system32\drivers\ctredr15.sys --> c:\windows\system32\drivers\ctredr15.sys [?]

S1 oreans32;oreans32;\??\c:\windows\system32\drivers\oreans32.sys --> c:\windows\system32\drivers\oreans32.sys [?]

S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [15-8-2006 15:06 223128]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [15-8-2006 15:00 643072]

.

Inhoud van de 'Gedeelde Taken' map

2010-09-30 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]

.

------- Bijkomende Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MI699F~1\OFFICE11\EXCEL.EXE/3000

IE: Free YouTube to Mp3 Converter - c:\documents and settings\Line\Application Data\DVDVideoSoftIEHelpers\youtubetomp3.htm

LSP: c:\windows\system32\imon.dll

DPF: {705EC6D4-B138-4079-A307-EF13E40C2416} - hxxps://sslvpn.accent.nl/CACHE/sdesktop/install/binaries/instweb.cab

FF - ProfilePath - c:\documents and settings\Line\Application Data\Mozilla\Firefox\Profiles\vucxs13e.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=18&q=

FF - prefs.js: browser.search.selectedEngine - Fast Browser Search

FF - prefs.js: browser.startup.homepage - Google

FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=18&tid={61F691EB-6146-75B7-DF11-F98C116D670C}&q=

FF - component: c:\documents and settings\Line\Application Data\Mozilla\Firefox\Profiles\vucxs13e.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll

FF - component: c:\documents and settings\Line\Application Data\Mozilla\Firefox\Profiles\vucxs13e.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll

FF - plugin: c:\documents and settings\All Users.WINDOWS\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll

FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

- - - - ORPHANS VERWIJDERD - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\S-1-5-21-2025429265-343818398-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

@Denied: (Full) (LocalSystem)

[HKEY_USERS\S-1-5-21-2025429265-343818398-725345543-1004\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\ActiveSync]

"Name"="ActiveSync"

"DisplayName"="Microsoft ActiveSync"

"Param1"="ActiveSync"

"Type"="wellknown"

"Order"=dword:00000001

"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-2025429265-343818398-725345543-1004\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\IESettings]

"Name"="IESettings"

"Type"="IESettings"

"Order"=dword:00000004

"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-2025429265-343818398-725345543-1004\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\MediaFiles]

"Name"="MediaFiles"

"Type"="MediaFiles"

"Order"=dword:00000003

"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-2025429265-343818398-725345543-1004\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\NPW]

"Name"="NPW"

"Param1"="NPW"

"Type"="wellknown"

"Order"=dword:00000002

"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-2025429265-343818398-725345543-1004\Software\Microsoft\Windows Mobile Disc\W*i*n*d*o*w*s* *M*o*b*i*l*e*"!\CriticalAppInstall\Outlook]

"Name"="Outlook"

"DisplayName"="Microsoft Outlook"

"Param1"="Outlook"

"Type"="wellknown"

"Order"=dword:00000000

"State"=dword:00000020

[HKEY_USERS\S-1-5-21-2025429265-343818398-725345543-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:87,31,ee,43,37,b6,2f,3c,5b,4c,ae,55,bd,dd,2d,78,df,01,ad,7c,d9,07,c5,

90,49,86,74,ea,3d,ef,18,f0,13,7d,58,3a,22,19,c7,9b,87,1d,f0,4f,b8,60,b4,b1,\

"??"=hex:9c,18,62,f8,c6,d8,a2,f3,e1,a4,2a,de,df,b4,1a,e1

[HKEY_USERS\S-1-5-21-2025429265-343818398-725345543-1004\Software\SecuROM\License information*]

"datasecu"=hex:7d,1b,66,db,5b,89,c9,63,e6,e8,43,54,02,03,bd,2d,83,2b,fa,4c,92,

dc,0e,df,0a,9e,2a,38,76,70,89,fc,07,e3,e5,c7,6b,53,2c,55,2c,6e,53,be,ac,56,\

"rkeysecu"=hex:2e,12,ed,35,83,17,17,51,a4,95,30,88,b9,6e,a8,5a

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]

"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'lsass.exe'(704)

c:\windows\system32\imon.dll

.

Voltooingstijd: 2010-10-09 01:27:08

ComboFix-quarantined-files.txt 2010-10-08 23:27

Pre-Run: 70.522.114.048 bytes beschikbaar

Post-Run: 71.739.826.176 bytes beschikbaar

WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 9EF1078F1F5492846A9901B33656EB10

Hijack Logje:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 1:31:00, on 9-10-2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.17080)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\notepad.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\hj\Trend Micro\HiJackThis\HiJackThis.exe

C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)