Ro_mien

Ja, daar geeft hij niet hetzelfde probleem.

Sorry, ik was op vakantie geweest en dit een beetje uit het oog verloren. Hier is het logje van speccy te vinden : http://speccy.piriform.com/results/oV6uUwURw1eqDKkWlwgcKt5

Geprobeerd (had nog een kabeltje van een andere WD externe harde schijf liggen) en is geen optie. Andere USB poort ook niet. Ik hoor het wel geluid maken en dan begint het lichtje te flikkeren vlak voor ik dat "automatisch opstarten" scherm krijg.

Hallo allemaal, Ik heb een probleempje met m'n USB station, of misschien beter gezegd, met de externe harde schijf die erop is aangesloten. Even kort : Ik heb een externe harde schijf die constant aangesloten is aan 1 en dezelfde USB poort (zo ééntje van WD). Dit is voor mijn automatische back ups met Norton. Ik haal hem er dus nooit af. Nu heb ik sinds eergisteren het probleem dat hij om de paar minuten opnieuw verbinding maakt met de pc en dan terug verbreekt (ja, weet niet hoe ik het juist moet uitleggen). Dus het is precies alsof ik hem eruit trek en er terug insteek, want het maakt net hetzelfde geluid als wanneer ik iets anders op een usb poort aansluit en hij geeft een schermpje weer met "automatisch afspelen". Dat scherm gaat soms na een paar seconden weg, soms blijft het staan. Het is heel erg vervelend. Weet iemand hoe ik dit kan oplossen? Ik heb echt weken lang goed geweest en het is zo plots opgekomen zonder één of andere instelling te veranderen.

Bon, in ieder geval bedankt voor de hulp, maar ik vrees dat ik zal moeten leven met een lange boottime... Er is geen oplossing uit de bus gekomen... Maar toch heel erg bedankt !

Wat een fantastisch programma Ik heb er wat HP en MSN rommel afgehaald. Zit nu op opstart van 3.52min ipv 4.03 niet veel, ik weet het, maar het meeste tijd verlies ik met : Systeem : 97 sec Norton : 36 sec Cvchost.exe : 19 sec ??? (wat is dit?) Windows defender : 17 sec En het kan idd kloppen, want ik heb een tijd geleden defender en norton 360 geinstalleerd. Ik ga defender terug afzetten, maar is er een mogelijkheid om wat van de seconden van norton af te pietsen? Groetjes, Romien Mijn pc heb ik overlaatst open gehaald en gestofzuigd ;-)

Hallo, Ik werk niet met gedeelde mappen. Ik was al een tijdje aan het werk toen ik het speccy logje had gemaakt. Qua opstart staan er maar 3 programma's tussen die opstarten (zie screenshot) En ik heb geen programma's gevonden die aan de basis van het probleem zouden kunnen liggen. Echt heeeel erg vreemd allemaal....

Hoi Dasle, bedankt voor je antwoord, hier is de link : http://speccy.piriform.com/results/uPNTMF4QuIbMDrz83SFjKdn

Niemand?

Nog iemand tips?

In veilige modus start hij op zoals hij zou moeten opstarten : in +/- 30 seconden tijd... Ik heb maar 3 progs die opstarten, al de rest staat afgevinkt

Ik heb het gevoel dat hij redelijk goed draait. De opstart is in ieder geval al IETS minder traag. Nu nog 1.30 minuut ipv +2.00 minuten Vroeger (= een maand of 2 geleden) startte hij echt binnen de minuut op. De PC zelf is enkele jaren oud. Ik vraag me echt af hoe het komt

Hoi, het is eindelijk gelukt Hier is het logje (was wel excel bestand??) APD21A7A29.dll\data001C:\Documents and Settings\ARBOCHIM NV\DoctorWeb\Quarantine\APD21A7A29.dllTrojan.Virtumod.569APD21A7A29.dllC:\Documents and Settings\ARBOCHIM NV\DoctorWeb\QuarantineContainer contains infected objectsVerplaatst.

Ik ben er mee bezig, ik probeer na het weekend een post te plakken... Het is gewoon dat het zo lang duurt en dit is mijn werk pc, dus ik moet een goed gaatje vinden om het programma te laten draaien.

Nu denk ik van wel, maar hij doet er nog altijd +/- 3 minuten over om op te starten Eens aangemeld gaat hij als een gek ervandoor, ik heb hem nog nooit zo snel mijn progjes weten opstarten ;-) Hier is logje. ComboFix 11-05-09.02 - ARBOCHIM NV 10/05/2011 10:12:16.10.2 - x86 Microsoft® Windows Vista™ Business 6.0.6002.2.1252.32.1043.18.2045.991 [GMT 2:00] Gestart vanuit: c:\users\ARBOCHIM NV\Desktop\ComboFix.exe gebruikte Opdracht switches :: c:\users\ARBOCHIM NV\Desktop\CFScript.txt AV: Norton 360 *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855} FW: Norton 360 *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E} SP: Norton 360 *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\found.002 c:\found.002\dir0000.chk\1033.mst c:\found.002\dir0000.chk\RoxioCentral.exe c:\users\ARBOCHIM NV\AppData\Local\{0335E3C3-C213-461F-880A-36E866C9F7C0} c:\users\ARBOCHIM NV\AppData\Local\{07DA4839-E1CD-4963-BD12-8BB3B7328C8B} c:\users\ARBOCHIM NV\AppData\Local\{08EE6891-09F4-4B03-B062-7B4A65FB5A91} c:\users\ARBOCHIM NV\AppData\Local\{140F786E-E0DC-4A6F-8122-97D8C8AAF279} c:\users\ARBOCHIM NV\AppData\Local\{189FB5BD-FA2C-4BB7-9CBF-797B5AFBD966} c:\users\ARBOCHIM NV\AppData\Local\{2F26501B-02A8-41B3-8848-6F4C80CFB133} c:\users\ARBOCHIM NV\AppData\Local\{2F621F99-8A4C-4876-9EAE-76F7179A1790} c:\users\ARBOCHIM NV\AppData\Local\{5411B0F9-3B1F-4281-B0C1-501EF52C7FE8} c:\users\ARBOCHIM NV\AppData\Local\{980410BC-C1D4-4655-A7AC-C4D09FE48344} c:\users\ARBOCHIM NV\AppData\Local\{9BB1FD93-FB51-4F98-8E29-0374069ADF69} c:\users\ARBOCHIM NV\AppData\Local\{B5C94EBC-A199-4648-8EFD-E5BC28E676D6} c:\users\ARBOCHIM NV\AppData\Local\{DE28E515-6E62-4FB8-8562-FD31CD8D030E} c:\users\ARBOCHIM NV\AppData\Local\{E2134571-CCF8-4604-88F5-BC6CBB213BAF} c:\users\ARBOCHIM NV\AppData\Local\{F518C4C8-D9F4-45B8-8A43-A99DC9C8DB4B} c:\users\ARBOCHIM NV\AppData\Local\{F88D5EA5-068B-4FA1-9654-D7747A8DBB42} c:\users\ARBOCHIM NV\AppData\Local\{FD2502FF-1356-4A25-93C4-FD092078910D} . . (((((((((((((((((((( Bestanden Gemaakt van 2011-04-10 to 2011-05-10 )))))))))))))))))))))))))))))) . . 2011-05-10 08:26 . 2011-05-10 08:26 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\temp 2011-05-10 08:26 . 2011-05-10 08:26 -------- d-----w- c:\users\Romina\AppData\Local\temp 2011-05-10 08:26 . 2011-05-10 08:26 -------- d-----w- c:\users\Romina.Arbochim\AppData\Local\temp 2011-05-10 08:26 . 2011-05-10 08:26 -------- d-----w- c:\users\RA\AppData\Local\temp 2011-05-10 08:26 . 2011-05-10 08:26 -------- d-----w- c:\users\Public\AppData\Local\temp 2011-05-10 08:26 . 2011-05-10 08:26 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-05-10 08:26 . 2011-05-10 08:26 -------- d-----w- c:\users\Administrator\AppData\Local\temp 2011-05-10 06:49 . 2011-04-11 07:04 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{300A75A0-78EB-4BE3-8B7C-793A5AFAA8A8}\mpengine.dll 2011-05-10 06:44 . 2011-05-10 06:44 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{A0426798-F74F-4265-AB40-4370AEB7DB1B} 2011-05-09 07:51 . 2007-03-23 02:05 29272 ----a-r- c:\windows\system32\AdobePDF.dll 2011-05-03 07:16 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2011-05-03 07:16 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2011-05-03 07:15 . 2011-03-12 21:55 876032 ----a-w- c:\windows\system32\XpsPrint.dll 2011-04-18 11:49 . 2011-04-18 11:49 -------- d-----w- c:\program files\Readiris Pro 11 2011-04-18 11:40 . 2011-04-19 11:00 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\Roxio 2011-04-15 11:52 . 2011-04-15 11:52 -------- d-----w- c:\windows\system32\N360_BACKUP 2011-04-15 10:09 . 2011-03-03 13:25 2041856 ----a-w- c:\windows\system32\win32k.sys 2011-04-15 10:09 . 2011-03-03 15:42 739328 ----a-w- c:\windows\system32\inetcomm.dll 2011-04-15 10:09 . 2011-02-17 06:23 420864 ----a-w- c:\windows\system32\vbscript.dll 2011-04-15 10:09 . 2011-03-03 10:50 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat 2011-04-15 10:09 . 2011-02-12 08:39 191488 ----a-w- c:\windows\system32\FXSCOVER.exe 2011-04-11 14:02 . 2011-04-11 14:02 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\Apple Computer . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-03-26 11:38 . 2011-04-06 11:08 4092928 ----a-w- c:\windows\system32\Redemption.dll 2011-03-16 07:13 . 2010-06-24 10:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-03-15 08:41 . 2011-03-15 08:36 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2011-03-03 15:40 . 2011-05-03 07:16 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll 2011-03-03 15:40 . 2011-05-03 07:16 542720 ----a-w- c:\windows\apppatch\AcLayers.dll 2011-03-03 15:40 . 2011-05-03 07:16 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll 2011-03-03 15:40 . 2011-05-03 07:16 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll 2011-03-01 10:12 . 2011-04-07 20:02 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll 2011-03-01 10:12 . 2011-04-07 20:02 53632 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll 2011-03-01 10:12 . 2011-04-07 20:02 29568 ----a-w- c:\windows\system32\LMIport.dll 2011-03-01 10:12 . 2011-04-07 20:02 87424 ----a-w- c:\windows\system32\LMIinit.dll 2011-02-22 14:13 . 2011-03-23 07:49 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll 2011-02-22 13:33 . 2011-03-23 07:49 1068544 ----a-w- c:\windows\system32\DWrite.dll 2011-02-22 13:33 . 2011-03-23 07:49 797696 ----a-w- c:\windows\system32\FntCache.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-05 68856] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders credssp.dll, schannel.dll . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk] backup=c:\windows\pss\Google Updater.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Ringo Launcher.lnk] backup=c:\windows\pss\Ringo Launcher.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDDMStatus.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDDMStatus.lnk backup=c:\windows\pss\WDDMStatus.lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0] 2008-10-14 19:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-01-22 05:05 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager] c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [bU] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCS2Service] 2005-10-19 16:19 49152 ----a-w- c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCSService] 2003-08-21 15:12 32768 ----a-w- c:\program files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link Air Utility] 2003-09-03 16:49 3358720 ----a-w- c:\program files\D-Link\Air Utility\AirCFG.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link AirPlus G] 2005-11-23 13:04 1544192 ----a-w- c:\program files\D-Link\AirPlus G\AirGCFG.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2007-05-08 15:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] 2006-09-29 11:39 151552 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2006-10-03 10:35 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2006-10-03 10:37 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray] 2010-12-21 09:53 1483264 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv] 2006-10-20 16:23 118784 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] 2007-05-06 16:10 405504 ----a-w- c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] 2006-11-10 11:35 90112 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2007-05-24 23:40 77824 ----a-w- c:\program files\Java\jre1.6.0\bin\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2007-12-05 14:18 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] 2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "SpybotSnD"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 135664] R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 135664] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] R4 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [x] R4 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x] R4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0403000.005\SYMDS.SYS [2010-02-04 328752] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0403000.005\SYMEFA.SYS [2010-04-22 173104] S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\BASHDefs\20110430.001\BHDrvx86.sys [2011-04-15 802936] S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0403000.005\ccHPx86.sys [2010-02-26 501888] S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\IPSDefs\20110506.001\IDSvix86.sys [2011-03-14 353912] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0403000.005\Ironx86.SYS [2010-04-29 116784] S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\N360\0403000.005\SYMTDIV.SYS [2010-05-06 339504] S2 N360;Norton 360;c:\program files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe [2010-02-26 126392] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-03-15 102448] . . --- Andere Services/Drivers In Geheugen --- . *NewlyCreated* - ERASERUTILDRV11110 *Deregistered* - EraserUtilDrv11110 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqddsvc hpqcxs08 LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache HPService REG_MULTI_SZ HPSLPSVC . Inhoud van de 'Gedeelde Taken' map . 2011-05-10 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-05 07:40] . 2011-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 09:38] . 2011-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 09:38] . 2011-05-10 c:\windows\Tasks\User_Feed_Synchronization-{A075225D-A541-4EC5-859A-ECF39CA174F5}.job - c:\windows\system32\msfeedssync.exe [2011-04-15 04:43] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.be/ uInternet Settings,ProxyOverride = *.local TCP: {DB831D54-4EE7-4AC8-8430-CC47C4154E06} = 195.238.2.21,195.238.2.22 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2011-05-10 10:26 Windows 6.0.6002 Service Pack 2 NTFS . scannen van verborgen processen ... . scannen van verborgen autostart items ... . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\N360] "ImagePath"="\"c:\program files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\4.3.0.5\diMaster.dll\" /prefetch:1" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\S-1-5-21-4193266179-2733219216-3454118930-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{073CF3BD-2341-0F7F-B711-41ACFDCDEE82}*] "bbhhklochnngdeeeeodffbelgdoohjoiiogl"=hex:61,61,00,00 "abhhklochnngdeeeeokgacnodcnlgnefdi"=hex:61,61,00,00 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Voltooingstijd: 2011-05-10 10:31:07 ComboFix-quarantined-files.txt 2011-05-10 08:31 ComboFix2.txt 2011-05-09 08:45 ComboFix3.txt 2011-05-09 07:25 ComboFix4.txt 2011-04-14 06:57 ComboFix5.txt 2011-05-10 08:05 . Pre-Run: 251,135,098,880 bytes beschikbaar Post-Run: 251,260,825,600 bytes beschikbaar . - - End Of File - - 5138E2C2DCB3E194B1906A7235E42F59

Nee, nog altijd erg traag. Hier is mijn nieuw logje. ComboFix 11-05-08.04 - ARBOCHIM NV 09/05/2011 10:26:50.9.2 - x86 Microsoft® Windows Vista™ Business 6.0.6002.2.1252.32.1043.18.2045.1039 [GMT 2:00] Gestart vanuit: c:\users\ARBOCHIM NV\Desktop\ComboFix.exe gebruikte Opdracht switches :: c:\users\ARBOCHIM NV\Desktop\CFScript.txt AV: Norton 360 *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855} FW: Norton 360 *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E} SP: Norton 360 *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((( Bestanden Gemaakt van 2011-04-09 to 2011-05-09 )))))))))))))))))))))))))))))) . . 2011-05-09 08:40 . 2011-05-09 08:40 -------- d-----w- c:\users\Romina\AppData\Local\temp 2011-05-09 08:40 . 2011-05-09 08:40 -------- d-----w- c:\users\Romina.Arbochim\AppData\Local\temp 2011-05-09 08:40 . 2011-05-09 08:40 -------- d-----w- c:\users\RA\AppData\Local\temp 2011-05-09 08:40 . 2011-05-09 08:40 -------- d-----w- c:\users\Public\AppData\Local\temp 2011-05-09 08:40 . 2011-05-09 08:40 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-05-09 08:40 . 2011-05-09 08:40 -------- d-----w- c:\users\Administrator\AppData\Local\temp 2011-05-09 07:51 . 2007-03-23 02:05 29272 ----a-r- c:\windows\system32\AdobePDF.dll 2011-05-09 06:33 . 2011-05-09 06:34 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{5411B0F9-3B1F-4281-B0C1-501EF52C7FE8} 2011-05-06 11:18 . 2011-04-11 07:04 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3DB0EFAC-B29D-49F2-B71B-21EC15D5C131}\mpengine.dll 2011-05-06 11:12 . 2011-05-06 11:13 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{0335E3C3-C213-461F-880A-36E866C9F7C0} 2011-05-05 06:54 . 2011-05-05 06:54 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{2F621F99-8A4C-4876-9EAE-76F7179A1790} 2011-05-04 06:36 . 2011-05-04 06:36 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{F518C4C8-D9F4-45B8-8A43-A99DC9C8DB4B} 2011-05-03 07:16 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2011-05-03 07:16 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2011-05-03 07:15 . 2011-03-12 21:55 876032 ----a-w- c:\windows\system32\XpsPrint.dll 2011-05-03 07:02 . 2011-05-03 07:02 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{DE28E515-6E62-4FB8-8562-FD31CD8D030E} 2011-05-02 06:22 . 2011-05-02 06:23 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{140F786E-E0DC-4A6F-8122-97D8C8AAF279} 2011-04-29 06:31 . 2011-04-29 06:31 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{2F26501B-02A8-41B3-8848-6F4C80CFB133} 2011-04-28 06:59 . 2011-04-28 06:59 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{08EE6891-09F4-4B03-B062-7B4A65FB5A91} 2011-04-27 06:34 . 2011-04-27 06:34 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{B5C94EBC-A199-4648-8EFD-E5BC28E676D6} 2011-04-26 06:22 . 2011-04-26 06:22 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{9BB1FD93-FB51-4F98-8E29-0374069ADF69} 2011-04-22 06:21 . 2011-04-22 06:22 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{980410BC-C1D4-4655-A7AC-C4D09FE48344} 2011-04-20 06:33 . 2011-04-20 06:33 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{F88D5EA5-068B-4FA1-9654-D7747A8DBB42} 2011-04-19 06:28 . 2011-04-19 06:28 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{E2134571-CCF8-4604-88F5-BC6CBB213BAF} 2011-04-18 11:49 . 2011-04-18 11:49 -------- d-----w- c:\program files\Readiris Pro 11 2011-04-18 11:40 . 2011-04-19 11:00 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\Roxio 2011-04-18 11:34 . 2011-04-18 11:34 -------- d-----w- C:\found.002 2011-04-18 06:32 . 2011-04-18 06:32 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{189FB5BD-FA2C-4BB7-9CBF-797B5AFBD966} 2011-04-15 11:52 . 2011-04-15 11:52 -------- d-----w- c:\windows\system32\N360_BACKUP 2011-04-15 10:09 . 2011-03-03 13:25 2041856 ----a-w- c:\windows\system32\win32k.sys 2011-04-15 10:09 . 2011-03-03 15:42 739328 ----a-w- c:\windows\system32\inetcomm.dll 2011-04-15 10:09 . 2011-02-17 06:23 420864 ----a-w- c:\windows\system32\vbscript.dll 2011-04-15 10:09 . 2011-03-03 10:50 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat 2011-04-15 10:09 . 2011-02-12 08:39 191488 ----a-w- c:\windows\system32\FXSCOVER.exe 2011-04-15 06:28 . 2011-04-15 06:28 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{07DA4839-E1CD-4963-BD12-8BB3B7328C8B} 2011-04-14 06:57 . 2011-05-09 08:40 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\temp 2011-04-14 06:18 . 2011-04-14 06:18 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{FD2502FF-1356-4A25-93C4-FD092078910D} 2011-04-11 14:02 . 2011-04-11 14:02 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\Apple Computer . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-03-26 11:38 . 2011-04-06 11:08 4092928 ----a-w- c:\windows\system32\Redemption.dll 2011-03-16 07:13 . 2010-06-24 10:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-03-15 08:41 . 2011-03-15 08:36 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2011-03-03 15:40 . 2011-05-03 07:16 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll 2011-03-03 15:40 . 2011-05-03 07:16 542720 ----a-w- c:\windows\apppatch\AcLayers.dll 2011-03-03 15:40 . 2011-05-03 07:16 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll 2011-03-03 15:40 . 2011-05-03 07:16 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll 2011-03-01 10:12 . 2011-04-07 20:02 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll 2011-03-01 10:12 . 2011-04-07 20:02 53632 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll 2011-03-01 10:12 . 2011-04-07 20:02 29568 ----a-w- c:\windows\system32\LMIport.dll 2011-03-01 10:12 . 2011-04-07 20:02 87424 ----a-w- c:\windows\system32\LMIinit.dll 2011-02-22 14:13 . 2011-03-23 07:49 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll 2011-02-22 13:33 . 2011-03-23 07:49 1068544 ----a-w- c:\windows\system32\DWrite.dll 2011-02-22 13:33 . 2011-03-23 07:49 797696 ----a-w- c:\windows\system32\FntCache.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-05 68856] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders credssp.dll, schannel.dll . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk] backup=c:\windows\pss\Google Updater.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Ringo Launcher.lnk] backup=c:\windows\pss\Ringo Launcher.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDDMStatus.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDDMStatus.lnk backup=c:\windows\pss\WDDMStatus.lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0] 2008-10-14 19:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-01-22 05:05 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager] c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [bU] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCS2Service] 2005-10-19 16:19 49152 ----a-w- c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCSService] 2003-08-21 15:12 32768 ----a-w- c:\program files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link Air Utility] 2003-09-03 16:49 3358720 ----a-w- c:\program files\D-Link\Air Utility\AirCFG.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link AirPlus G] 2005-11-23 13:04 1544192 ----a-w- c:\program files\D-Link\AirPlus G\AirGCFG.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2007-05-08 15:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] 2006-09-29 11:39 151552 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2006-10-03 10:35 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2006-10-03 10:37 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray] 2010-12-21 09:53 1483264 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv] 2006-10-20 16:23 118784 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] 2007-05-06 16:10 405504 ----a-w- c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] 2006-11-10 11:35 90112 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2007-05-24 23:40 77824 ----a-w- c:\program files\Java\jre1.6.0\bin\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2007-12-05 14:18 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] 2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "SpybotSnD"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 135664] R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 135664] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] R4 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [x] R4 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x] R4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0403000.005\SYMDS.SYS [2010-02-04 328752] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0403000.005\SYMEFA.SYS [2010-04-22 173104] S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\BASHDefs\20110430.001\BHDrvx86.sys [2011-04-15 802936] S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0403000.005\ccHPx86.sys [2010-02-26 501888] S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\IPSDefs\20110506.001\IDSvix86.sys [2011-03-14 353912] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0403000.005\Ironx86.SYS [2010-04-29 116784] S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\N360\0403000.005\SYMTDIV.SYS [2010-05-06 339504] S2 N360;Norton 360;c:\program files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe [2010-02-26 126392] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-03-15 102448] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqddsvc hpqcxs08 LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache HPService REG_MULTI_SZ HPSLPSVC . Inhoud van de 'Gedeelde Taken' map . 2011-05-09 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-05 07:40] . 2011-05-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 09:38] . 2011-05-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 09:38] . 2011-05-09 c:\windows\Tasks\User_Feed_Synchronization-{A075225D-A541-4EC5-859A-ECF39CA174F5}.job - c:\windows\system32\msfeedssync.exe [2011-04-15 04:43] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.be/ uInternet Settings,ProxyOverride = *.local TCP: {DB831D54-4EE7-4AC8-8430-CC47C4154E06} = 195.238.2.21,195.238.2.22 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2011-05-09 10:40 Windows 6.0.6002 Service Pack 2 NTFS . scannen van verborgen processen ... . scannen van verborgen autostart items ... . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\N360] "ImagePath"="\"c:\program files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\4.3.0.5\diMaster.dll\" /prefetch:1" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\S-1-5-21-4193266179-2733219216-3454118930-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{073CF3BD-2341-0F7F-B711-41ACFDCDEE82}*] "bbhhklochnngdeeeeodffbelgdoohjoiiogl"=hex:61,61,00,00 "abhhklochnngdeeeeokgacnodcnlgnefdi"=hex:61,61,00,00 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Voltooingstijd: 2011-05-09 10:45:02 ComboFix-quarantined-files.txt 2011-05-09 08:44 ComboFix2.txt 2011-05-09 07:25 ComboFix3.txt 2011-04-14 06:57 ComboFix4.txt 2011-04-13 13:11 ComboFix5.txt 2011-05-09 08:24 . Pre-Run: 246,484,004,864 bytes beschikbaar Post-Run: 246,451,933,184 bytes beschikbaar . - - End Of File - - B620A5323421D2DFB8342A747CB96B3A

ComboFix 11-05-08.04 - ARBOCHIM NV 09/05/2011 9:01.8.2 - x86 Microsoft® Windows Vista™ Business 6.0.6002.2.1252.32.1043.18.2045.797 [GMT 2:00] Gestart vanuit: c:\users\ARBOCHIM NV\Desktop\ComboFix.exe AV: Norton 360 *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855} FW: Norton 360 *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E} SP: Norton 360 *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\ARBOCHIM NV\Documents\Readiris.DUS . Besmet exemplaar van c:\windows\system32\userinit.exe werd aangetroffen en gedesinfecteerd Hersteld exemplaar van - c:\windows\ERDNT\cache\userinit.exe . . (((((((((((((((((((( Bestanden Gemaakt van 2011-04-09 to 2011-05-09 )))))))))))))))))))))))))))))) . . 2011-05-09 07:12 . 2011-05-09 07:12 -------- d-----w- c:\users\Romina\AppData\Local\temp 2011-05-09 07:12 . 2011-05-09 07:12 -------- d-----w- c:\users\Romina.Arbochim\AppData\Local\temp 2011-05-09 07:12 . 2011-05-09 07:12 -------- d-----w- c:\users\RA\AppData\Local\temp 2011-05-09 07:12 . 2011-05-09 07:12 -------- d-----w- c:\users\Public\AppData\Local\temp 2011-05-09 07:12 . 2011-05-09 07:12 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-05-09 07:12 . 2011-05-09 07:12 -------- d-----w- c:\users\Administrator\AppData\Local\temp 2011-05-09 06:33 . 2011-05-09 06:34 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{5411B0F9-3B1F-4281-B0C1-501EF52C7FE8} 2011-05-06 11:18 . 2011-04-11 07:04 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3DB0EFAC-B29D-49F2-B71B-21EC15D5C131}\mpengine.dll 2011-05-06 11:12 . 2011-05-06 11:13 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{0335E3C3-C213-461F-880A-36E866C9F7C0} 2011-05-05 06:54 . 2011-05-05 06:54 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{2F621F99-8A4C-4876-9EAE-76F7179A1790} 2011-05-04 06:36 . 2011-05-04 06:36 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{F518C4C8-D9F4-45B8-8A43-A99DC9C8DB4B} 2011-05-03 07:16 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2011-05-03 07:16 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2011-05-03 07:15 . 2011-03-12 21:55 876032 ----a-w- c:\windows\system32\XpsPrint.dll 2011-05-03 07:02 . 2011-05-03 07:02 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{DE28E515-6E62-4FB8-8562-FD31CD8D030E} 2011-05-02 06:22 . 2011-05-02 06:23 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{140F786E-E0DC-4A6F-8122-97D8C8AAF279} 2011-04-29 06:31 . 2011-04-29 06:31 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{2F26501B-02A8-41B3-8848-6F4C80CFB133} 2011-04-28 06:59 . 2011-04-28 06:59 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{08EE6891-09F4-4B03-B062-7B4A65FB5A91} 2011-04-27 06:34 . 2011-04-27 06:34 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{B5C94EBC-A199-4648-8EFD-E5BC28E676D6} 2011-04-26 06:22 . 2011-04-26 06:22 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{9BB1FD93-FB51-4F98-8E29-0374069ADF69} 2011-04-22 06:21 . 2011-04-22 06:22 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{980410BC-C1D4-4655-A7AC-C4D09FE48344} 2011-04-20 06:33 . 2011-04-20 06:33 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{F88D5EA5-068B-4FA1-9654-D7747A8DBB42} 2011-04-19 06:28 . 2011-04-19 06:28 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{E2134571-CCF8-4604-88F5-BC6CBB213BAF} 2011-04-18 11:49 . 2011-04-18 11:49 -------- d-----w- c:\program files\Readiris Pro 11 2011-04-18 11:40 . 2011-04-19 11:00 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\Roxio 2011-04-18 11:34 . 2011-04-18 11:34 -------- d-----w- C:\found.002 2011-04-18 06:32 . 2011-04-18 06:32 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{189FB5BD-FA2C-4BB7-9CBF-797B5AFBD966} 2011-04-15 11:52 . 2011-04-15 11:52 -------- d-----w- c:\windows\system32\N360_BACKUP 2011-04-15 10:09 . 2011-03-03 13:25 2041856 ----a-w- c:\windows\system32\win32k.sys 2011-04-15 10:09 . 2011-03-03 15:42 739328 ----a-w- c:\windows\system32\inetcomm.dll 2011-04-15 10:09 . 2011-02-17 06:23 420864 ----a-w- c:\windows\system32\vbscript.dll 2011-04-15 10:09 . 2011-03-03 10:50 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat 2011-04-15 10:09 . 2011-02-12 08:39 191488 ----a-w- c:\windows\system32\FXSCOVER.exe 2011-04-15 06:28 . 2011-04-15 06:28 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{07DA4839-E1CD-4963-BD12-8BB3B7328C8B} 2011-04-14 06:57 . 2011-05-09 07:17 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\temp 2011-04-14 06:18 . 2011-04-14 06:18 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{FD2502FF-1356-4A25-93C4-FD092078910D} 2011-04-11 14:02 . 2011-04-11 14:02 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\Apple Computer . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-03-26 11:38 . 2011-04-06 11:08 4092928 ----a-w- c:\windows\system32\Redemption.dll 2011-03-16 07:13 . 2010-06-24 10:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-03-15 08:41 . 2011-03-15 08:36 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2011-03-03 15:40 . 2011-05-03 07:16 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll 2011-03-03 15:40 . 2011-05-03 07:16 542720 ----a-w- c:\windows\apppatch\AcLayers.dll 2011-03-03 15:40 . 2011-05-03 07:16 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll 2011-03-03 15:40 . 2011-05-03 07:16 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll 2011-03-01 10:12 . 2011-04-07 20:02 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll 2011-03-01 10:12 . 2011-04-07 20:02 53632 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll 2011-03-01 10:12 . 2011-04-07 20:02 29568 ----a-w- c:\windows\system32\LMIport.dll 2011-03-01 10:12 . 2011-04-07 20:02 87424 ----a-w- c:\windows\system32\LMIinit.dll 2011-02-22 14:13 . 2011-03-23 07:49 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll 2011-02-22 13:33 . 2011-03-23 07:49 1068544 ----a-w- c:\windows\system32\DWrite.dll 2011-02-22 13:33 . 2011-03-23 07:49 797696 ----a-w- c:\windows\system32\FntCache.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-05 68856] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders credssp.dll, schannel.dll . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk] backup=c:\windows\pss\Google Updater.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Ringo Launcher.lnk] backup=c:\windows\pss\Ringo Launcher.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDDMStatus.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDDMStatus.lnk backup=c:\windows\pss\WDDMStatus.lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0] 2008-10-14 19:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-01-22 05:05 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager] c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [bU] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCS2Service] 2005-10-19 16:19 49152 ----a-w- c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCSService] 2003-08-21 15:12 32768 ----a-w- c:\program files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link Air Utility] 2003-09-03 16:49 3358720 ----a-w- c:\program files\D-Link\Air Utility\AirCFG.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link AirPlus G] 2005-11-23 13:04 1544192 ----a-w- c:\program files\D-Link\AirPlus G\AirGCFG.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2007-05-08 15:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] 2006-09-29 11:39 151552 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2006-10-03 10:35 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2006-10-03 10:37 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray] 2010-12-21 09:53 1483264 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv] 2006-10-20 16:23 118784 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] 2007-05-06 16:10 405504 ----a-w- c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] 2006-11-10 11:35 90112 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2007-05-24 23:40 77824 ----a-w- c:\program files\Java\jre1.6.0\bin\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2007-12-05 14:18 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] 2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "SpybotSnD"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 135664] R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 135664] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] R4 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [x] R4 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x] R4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0403000.005\SYMDS.SYS [2010-02-04 328752] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0403000.005\SYMEFA.SYS [2010-04-22 173104] S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\BASHDefs\20110430.001\BHDrvx86.sys [2011-04-15 802936] S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0403000.005\ccHPx86.sys [2010-02-26 501888] S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\IPSDefs\20110506.001\IDSvix86.sys [2011-03-14 353912] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0403000.005\Ironx86.SYS [2010-04-29 116784] S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\N360\0403000.005\SYMTDIV.SYS [2010-05-06 339504] S2 N360;Norton 360;c:\program files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe [2010-02-26 126392] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-03-15 102448] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqddsvc hpqcxs08 LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache HPService REG_MULTI_SZ HPSLPSVC . Inhoud van de 'Gedeelde Taken' map . 2011-05-09 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-05 07:40] . 2011-05-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 09:38] . 2011-05-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 09:38] . 2011-05-09 c:\windows\Tasks\User_Feed_Synchronization-{A075225D-A541-4EC5-859A-ECF39CA174F5}.job - c:\windows\system32\msfeedssync.exe [2011-04-15 04:43] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.be/ uInternet Settings,ProxyOverride = *.local TCP: {DB831D54-4EE7-4AC8-8430-CC47C4154E06} = 195.238.2.21,195.238.2.22 . . ------- Bestandsassociaties ------- . .txt= . - - - - ORPHANS VERWIJDERD - - - - . Toolbar-Locked - (no file) . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2011-05-09 09:17 Windows 6.0.6002 Service Pack 2 NTFS . scannen van verborgen processen ... . scannen van verborgen autostart items ... . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\N360] "ImagePath"="\"c:\program files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\4.3.0.5\diMaster.dll\" /prefetch:1" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\S-1-5-21-4193266179-2733219216-3454118930-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{073CF3BD-2341-0F7F-B711-41ACFDCDEE82}*] "bbhhklochnngdeeeeodffbelgdoohjoiiogl"=hex:61,61,00,00 "abhhklochnngdeeeeokgacnodcnlgnefdi"=hex:61,61,00,00 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Geladen Onder Lopende Processen --------------------- . - - - - - - - > 'Explorer.exe'(2616) c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_dut.nlr c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr . ------------------------ Andere Aktieve Processen ------------------------ . c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE c:\windows\system32\DRIVERS\xaudio.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\windows\system32\WUDFHost.exe c:\windows\system32\DllHost.exe c:\windows\system32\wbem\unsecapp.exe c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe c:\progra~1\HP\DIGITA~1\bin\hpqbam08.exe c:\progra~1\HP\DIGITA~1\bin\hpqgpc01.exe c:\windows\servicing\TrustedInstaller.exe . ************************************************************************** . Voltooingstijd: 2011-05-09 09:25:35 - machine werd herstart ComboFix-quarantined-files.txt 2011-05-09 07:25 ComboFix2.txt 2011-04-14 06:57 ComboFix3.txt 2011-04-13 13:11 ComboFix4.txt 2011-04-13 08:21 ComboFix5.txt 2011-05-09 06:55 . Pre-Run: 246,992,781,312 bytes beschikbaar Post-Run: 248,223,006,720 bytes beschikbaar . - - End Of File - - C0997EEB9B5B41288388F18CD57C7171

Hoi Dasle, Hier is mijn logje ! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:58:51, on 5/05/2011 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.19048) Boot mode: Normal Running processes: C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\PROGRA~1\HP\DIGITA~1\bin\hpqbam08.exe C:\PROGRA~1\HP\DIGITA~1\bin\hpqgpc01.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer aangeboden door Dell R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\4.3.0.5\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\4.3.0.5\IPSBHO.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.3.0.5\coIEPlg.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CAB O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{DB831D54-4EE7-4AC8-8430-CC47C4154E06}: NameServer = 195.238.2.21,195.238.2.22 O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 5265 bytes

Sinds een tijdje start mijn pc héééél erg traag op (van zwart scherm tot aanmeldingsscherm, pc zelf is redelijk snel). Hier is een logje van in eventvwr (boottime = 221298 !!!) Kan iemand me helpen om dit sneller te maken? -System -Provider[ Name] Microsoft-Windows-Diagnostics-Performance[ Guid] {cfc18ec0-96b1-4eba-961b-622caee05b0a} EventID100Version1Level1Task4002Opcode34Keywords0x8000000000010000-TimeCreated[ SystemTime] 2011-05-03T11:21:54.189Z EventRecordID9604-Correlation[ ActivityID] {00000000-C6C8-0000-149B-0BC28309CC01} -Execution[ ProcessID] 1716[ ThreadID] 2036 ChannelMicrosoft-Windows-Diagnostics-Performance/OperationalComputerArbochim-Security[ UserID] S-1-5-19 -EventData BootTsVersion2BootStartTime2011-05-03T11:17:58.780ZBootEndTime2011-05-03T11:21:51.912ZSystemBootInstance1296UserBootInstance1236BootTime221298MainPathBootTime144098BootKernelInitTime34BootDriverInitTime13908BootDevicesInitTime305BootPrefetchInitTime66256BootPrefetchBytes123342848BootAutoChkTime0BootSmssInitTime9028BootCriticalServicesInitTime3230BootUserProfileProcessingTime1988BootMachineProfileProcessingTime2685BootExplorerInitTime14302BootNumStartupApps3BootPostBootTime77200BootIsRebootAfterInstallfalseBootRootCauseStepImprovementBits0BootRootCauseGradualImprovementBits0BootRootCauseStepDegradationBits0BootRootCauseGradualDegradationBits0BootIsDegradationfalseBootIsStepDegradationfalseBootIsGradualDegradationfalseBootImprovementDelta0BootDegradationDelta0BootIsRootCauseIdentifiedfalse

Roxio helemaal gedeinstalleerd en raar maar waar, krijg geen error scherm meer !! Bedankt allemaal voor jullie hulp xoxo Romien

Jep, is helemaal geinstalleerd op m'n pc

@ Stegisoft : Ik heb de Roxio dvd hier liggen en heb ik er ook al ingestoken : helpt ook niet... @ Clarkie : rechtstreeks werkt het ook niet @ Kweezie : ik zal eens proberen

Hallo allemaal, Niet echt een erg probleem, maar zou toch leuk zijn moest het opgelost zijn... FileAmigo7 is een progje dat ik enkele jaren geleden van internet gedownload heb. Ik gebruik het voor mijn klassement op het werk. Al sinds het begin dat ik het gebruik, geeft hij vanaf dat ik klik op de snelkoppeling om de toepassing te starten het scherm van Windows installer weer (2 schermen), zie bijlage. Als ik op annuleren klik, opent hij gewoon het programma. Heeft iemand een oplossing om meteen het programma te openen ipv die 2 schermpjes te krijgen? Alvast bedankt...

Heel erg bedankt allemaal om me te helpen hiermee !! Groetjes, Romien

Oeps Hier is het wel gelukt denk ik : ComboFix 11-04-12.02 - ARBOCHIM NV 14/04/2011 8:40.7.2 - x86 Microsoft® Windows Vista™ Business 6.0.6002.2.1252.32.1043.18.2045.1042 [GMT 2:00] Gestart vanuit: c:\users\ARBOCHIM NV\Desktop\ComboFix.exe gebruikte Opdracht switches :: c:\users\ARBOCHIM NV\Desktop\CFScript.txt AV: Norton 360 *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855} FW: Norton 360 *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E} SP: Norton 360 *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\found.002 c:\found.002\dir0000.chk\1919E340A9E8E223B8EC22E551A63EC0 c:\found.002\dir0000.chk\3F91113AA641003C457F35348D05C8C1 c:\found.002\dir0000.chk\462549F02D231022C93C525083C5E866 c:\found.002\dir0000.chk\567D1B9852135933D3491D2B9530EFBF c:\found.002\dir0000.chk\58569415E6C7B994E6D0A3C578D0960E c:\found.002\dir0000.chk\58C5F954B3B686934AA56F38F8E22068 c:\found.002\dir0000.chk\5E693708625470C7F500B78EA9C1188F c:\found.002\dir0000.chk\6500E3CDD9404D91B9F991B827F7C7EF c:\found.002\dir0000.chk\6ED7EBCB9C9CC4EF7FFFA85E0DAA54F8 c:\found.002\dir0000.chk\80893376C9DFC5655926CD021099EE11 c:\found.002\dir0000.chk\B047220813AE2A676262F9630A10A19B c:\users\ARBOCHIM NV\AppData\Local\{0ACC3772-F270-4B33-A6D9-06060F2B9F22} c:\users\ARBOCHIM NV\AppData\Local\{11DDB9AC-DFB1-450F-A58E-FEE50C524546} c:\users\ARBOCHIM NV\AppData\Local\{23150AF2-011E-4DBD-B9BF-462570BD25C5} c:\users\ARBOCHIM NV\AppData\Local\{310C55AA-4916-4772-AD21-E4B6AB7A7D9A} c:\users\ARBOCHIM NV\AppData\Local\{58C0F413-67F0-482C-BBFF-F39DC4A2B798} c:\users\ARBOCHIM NV\AppData\Local\{6F2DFA25-E6FB-4F0A-A6D8-45B2D836B721} c:\users\ARBOCHIM NV\AppData\Local\{9E743355-A1C9-47DA-9461-9223734F4BF2} c:\users\ARBOCHIM NV\AppData\Local\{D0410E33-59AB-4C72-8367-9371C173556F} . . (((((((((((((((((((( Bestanden Gemaakt van 2011-03-14 to 2011-04-14 )))))))))))))))))))))))))))))) . . 2011-04-14 06:53 . 2011-04-14 06:53 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\temp 2011-04-14 06:53 . 2011-04-14 06:53 -------- d-----w- c:\users\Romina\AppData\Local\temp 2011-04-14 06:53 . 2011-04-14 06:53 -------- d-----w- c:\users\RA\AppData\Local\temp 2011-04-14 06:53 . 2011-04-14 06:53 -------- d-----w- c:\users\Public\AppData\Local\temp 2011-04-14 06:53 . 2011-04-14 06:53 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-04-14 06:18 . 2011-04-14 06:18 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{FD2502FF-1356-4A25-93C4-FD092078910D} 2011-04-11 14:02 . 2011-04-11 14:02 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\Apple Computer 2011-04-07 20:38 . 2011-04-07 21:05 -------- d-----w- c:\users\Romina.Arbochim 2011-04-07 20:02 . 2011-03-01 10:12 53632 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll 2011-04-07 20:02 . 2011-03-01 10:12 29568 ----a-w- c:\windows\system32\LMIport.dll 2011-04-07 20:02 . 2011-03-01 10:12 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll 2011-04-07 20:02 . 2010-09-17 13:40 47640 ----a-w- c:\windows\system32\drivers\LMIRfsDriver.sys 2011-04-07 20:02 . 2011-03-01 10:12 87424 ----a-w- c:\windows\system32\LMIinit.dll 2011-04-07 20:02 . 2011-04-11 14:15 -------- d-----w- c:\programdata\LogMeIn 2011-04-07 20:01 . 2011-04-11 14:15 -------- d-----w- c:\program files\LogMeIn 2011-04-07 11:42 . 2011-04-07 11:42 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Roaming\TeamViewer 2011-04-06 13:59 . 2011-04-06 14:00 -------- d-----w- c:\users\Administrator 2011-04-06 11:09 . 2011-04-06 11:09 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\Recovery Toolbox for Outlook 2011-04-06 11:08 . 2011-03-26 11:38 4092928 ----a-w- c:\windows\system32\Redemption.dll 2011-04-01 07:17 . 2011-04-01 07:17 -------- d-----w- c:\program files\Common Files\PCSuite 2011-04-01 07:17 . 2011-04-01 07:17 -------- d-----w- c:\program files\Common Files\Nokia 2011-04-01 07:17 . 2008-08-26 07:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys 2011-04-01 07:17 . 2011-04-01 07:17 -------- d-----w- c:\program files\PC Connectivity Solution 2011-03-23 07:49 . 2011-02-22 13:33 1068544 ----a-w- c:\windows\system32\DWrite.dll 2011-03-23 07:49 . 2011-02-22 14:13 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll 2011-03-23 07:49 . 2011-02-22 13:33 797696 ----a-w- c:\windows\system32\FntCache.dll 2011-03-15 08:41 . 2009-05-18 21:17 26600 ----a-r- c:\windows\system32\drivers\GEARAspiWDM.sys 2011-03-15 08:41 . 2008-04-17 20:12 107368 ----a-r- c:\windows\system32\GEARAspi.dll 2011-03-15 08:36 . 2011-03-15 08:41 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2011-03-15 08:35 . 2011-03-15 08:41 -------- d-----w- c:\program files\Symantec 2011-03-15 08:35 . 2011-03-17 07:30 -------- d-----w- c:\windows\system32\drivers\N360 2011-03-15 08:34 . 2011-03-15 08:35 -------- d-----w- c:\program files\Norton 360 2011-03-15 08:34 . 2011-03-15 08:34 -------- d-----w- c:\program files\NortonInstaller . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-03-16 07:13 . 2010-06-24 10:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-01-20 16:37 . 2011-02-09 13:01 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys 2011-01-20 16:08 . 2011-02-09 13:01 478720 ----a-w- c:\windows\system32\dxgi.dll 2011-01-20 16:08 . 2011-02-09 13:01 219648 ----a-w- c:\windows\system32\d3d10_1core.dll 2011-01-20 16:08 . 2011-02-09 13:01 160768 ----a-w- c:\windows\system32\d3d10_1.dll 2011-01-20 16:08 . 2011-02-09 13:01 1029120 ----a-w- c:\windows\system32\d3d10.dll 2011-01-20 16:08 . 2011-02-09 13:01 189952 ----a-w- c:\windows\system32\d3d10core.dll 2011-01-20 16:07 . 2011-02-09 13:01 37376 ----a-w- c:\windows\system32\cdd.dll 2011-01-20 16:07 . 2011-02-09 13:01 258048 ----a-w- c:\windows\system32\winspool.drv 2011-01-20 16:07 . 2011-02-09 13:01 586240 ----a-w- c:\windows\system32\stobject.dll 2011-01-20 16:06 . 2011-02-09 13:01 2873344 ----a-w- c:\windows\system32\mf.dll 2011-01-20 16:06 . 2011-02-09 13:01 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll 2011-01-20 16:04 . 2011-02-09 13:01 209920 ----a-w- c:\windows\system32\mfplat.dll 2011-01-20 16:04 . 2011-02-09 13:01 98816 ----a-w- c:\windows\system32\mfps.dll 2011-01-20 14:28 . 2011-02-09 13:01 1554432 ----a-w- c:\windows\system32\xpsservices.dll 2011-01-20 14:27 . 2011-02-09 13:01 876032 ----a-w- c:\windows\system32\XpsPrint.dll 2011-01-20 14:26 . 2011-02-09 13:01 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe 2011-01-20 14:25 . 2011-02-09 13:01 847360 ----a-w- c:\windows\system32\OpcServices.dll 2011-01-20 14:24 . 2011-02-09 13:01 135680 ----a-w- c:\windows\system32\XpsRasterService.dll 2011-01-20 14:15 . 2011-02-09 13:01 979456 ----a-w- c:\windows\system32\MFH264Dec.dll 2011-01-20 14:14 . 2011-02-09 13:01 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll 2011-01-20 14:14 . 2011-02-09 13:01 302592 ----a-w- c:\windows\system32\mfmp4src.dll 2011-01-20 14:14 . 2011-02-09 13:01 261632 ----a-w- c:\windows\system32\mfreadwrite.dll 2011-01-20 14:12 . 2011-02-09 13:01 1172480 ----a-w- c:\windows\system32\d3d10warp.dll 2011-01-20 14:11 . 2011-02-09 13:01 486400 ----a-w- c:\windows\system32\d3d10level9.dll 2011-01-20 13:47 . 2011-02-09 13:01 683008 ----a-w- c:\windows\system32\d2d1.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-05 68856] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-01-22 40368] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders credssp.dll, schannel.dll . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk] backup=c:\windows\pss\Digital Line Detect.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk] backup=c:\windows\pss\Google Updater.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Ringo Launcher.lnk] backup=c:\windows\pss\Ringo Launcher.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TimeLeft.exe] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\TimeLeft.exe backup=c:\windows\pss\TimeLeft.exe.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDDMStatus.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDDMStatus.lnk backup=c:\windows\pss\WDDMStatus.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^Users^ARBOCHIM NV^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Rapid Antivirus.lnk] backup=c:\windows\pss\Rapid Antivirus.lnk.Startup backupExtension=.Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide [X] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0] 2008-10-14 19:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-01-22 05:05 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager] c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [bU] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCS2Service] 2005-10-19 16:19 49152 ----a-w- c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCSService] 2003-08-21 15:12 32768 ----a-w- c:\program files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CallControl 4.7] c:\program files\FAXTALK COMMUNICATOR\FTCtrl32.exe [bU] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link Air Utility] 2003-09-03 16:49 3358720 ----a-w- c:\program files\D-Link\Air Utility\AirCFG.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link AirPlus G] 2005-11-23 13:04 1544192 ----a-w- c:\program files\D-Link\AirPlus G\AirGCFG.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] 2006-09-29 11:39 151552 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2006-10-03 10:35 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2006-10-03 10:37 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] c:\program files\iTunes\iTunesHelper.exe [bU] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI] c:\program files\LogMeIn\x86\LogMeInSystray.exe [bU] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent] c:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe [bU] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray] 2010-12-21 09:53 1483264 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv] 2006-10-20 16:23 118784 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-03-17 19:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray] 2006-11-05 10:22 221184 ----a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] 2007-05-06 16:10 405504 ----a-w- c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] 2006-11-10 11:35 90112 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2007-05-24 23:40 77824 ----a-w- c:\program files\Java\jre1.6.0\bin\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2007-12-05 14:18 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] 2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "SpybotSnD"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] R4 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 135664] R4 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [x] R4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0403000.005\SYMDS.SYS [2010-02-04 328752] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0403000.005\SYMEFA.SYS [2010-04-22 173104] S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\BASHDefs\20110309.001\BHDrvx86.sys [2011-03-09 800376] S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0403000.005\ccHPx86.sys [2010-02-26 501888] S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\IPSDefs\20110412.001\IDSvix86.sys [2011-03-14 353912] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0403000.005\Ironx86.SYS [2010-04-29 116784] S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\N360\0403000.005\SYMTDIV.SYS [2010-05-06 339504] S2 N360;Norton 360;c:\program files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe [2010-02-26 126392] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-03-15 102448] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqddsvc hpqcxs08 LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache HPService REG_MULTI_SZ HPSLPSVC . Inhoud van de 'Gedeelde Taken' map . 2011-04-14 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-05 07:40] . 2011-04-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 09:38] . 2011-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 09:38] . 2011-04-13 c:\windows\Tasks\User_Feed_Synchronization-{A075225D-A541-4EC5-859A-ECF39CA174F5}.job - c:\windows\system32\msfeedssync.exe [2011-02-09 04:47] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.be/ uInternet Settings,ProxyOverride = *.local IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html TCP: {DB831D54-4EE7-4AC8-8430-CC47C4154E06} = 195.238.2.21,195.238.2.22 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2011-04-14 08:53 Windows 6.0.6002 Service Pack 2 NTFS . scannen van verborgen processen ... . scannen van verborgen autostart items ... . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\N360] "ImagePath"="\"c:\program files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\4.3.0.5\diMaster.dll\" /prefetch:1" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\S-1-5-21-4193266179-2733219216-3454118930-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{073CF3BD-2341-0F7F-B711-41ACFDCDEE82}*] "bbhhklochnngdeeeeodffbelgdoohjoiiogl"=hex:61,61,00,00 "abhhklochnngdeeeeokgacnodcnlgnefdi"=hex:61,61,00,00 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Voltooingstijd: 2011-04-14 08:57:56 ComboFix-quarantined-files.txt 2011-04-14 06:57 ComboFix2.txt 2011-04-13 13:11 ComboFix3.txt 2011-04-13 08:21 ComboFix4.txt 2011-01-17 08:14 . Pre-Run: 245,657,018,368 bytes beschikbaar Post-Run: 245,969,330,176 bytes beschikbaar . - - End Of File - - 54E4C8B5E8567BD88F2A0F7E95EC0AD9