nancyvang
-
Items
17 -
Registratiedatum
-
Laatst bezocht
Inhoudstype
Profielen
Forums
Store
Berichten die geplaatst zijn door nancyvang
-
-
Ik heb mijn emailaccount per ongeluk verwijderd kan ik mijn emails nog terug krijgen.
Zo ja kan iemand mij daar bij helpen.
Bedankt alvast.
-
windows vista restore staat nog als snelkoppeling op mijn bureaublad dit kwam steeds voor toen het virus er nog op zat.
Als ik op start druk blijft het linkervenster leeg rechts staan mijn programma's zoals documenten afbeeldingen enz.
En ik heb nog geen internet teken. Ik maak steeds verbinding via netwerkcentrum.
Dit zijn de dingen die mij opvallen.
---------- Post toegevoegd om 11:37 ---------- Vorige post was om 11:35 ----------
Ik heb inmiddels internetteken gevonden.
---------- Post toegevoegd om 11:42 ---------- Vorige post was om 11:37 ----------
En hij geeft nog aan dat sommige opstart programma's zijn geblokkeerd
-
hier een nieuwe log ik hoop dat deze wel goed is.
ComboFix 11-06-19.0r1 - Nancy 20-06-2011 22:40:49.3.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.31.1043.18.2037.1010 [GMT 2:00]
Gestart vanuit: c:\users\Nancy\Desktop\ComboFix.exe
gebruikte Opdracht switches :: c:\users\Nancy\Desktop\CFScript.txt..txt
AV: Norton AntiVirus *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\ConduitEngine.tmp"
.
.
(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Conduit
c:\program files\Conduit\Community Alerts\Alert.dll
c:\program files\InnoGames_International
c:\program files\InnoGames_International\GottenAppsContextMenu.xml
c:\program files\InnoGames_International\InnoGames_InternationalToolbarHelper.exe
c:\program files\InnoGames_International\ldrtbInno.dll
c:\program files\InnoGames_International\OtherAppsContextMenu.xml
c:\program files\InnoGames_International\prxtbInno.dll
c:\program files\InnoGames_International\SharedAppsContextMenu.xml
c:\program files\InnoGames_International\tbInno.dll
c:\program files\InnoGames_International\toolbar.cfg
c:\program files\InnoGames_International\ToolbarContextMenu.xml
c:\program files\InnoGames_International\uninstall.exe
c:\users\Nancy\AppData\Local\{0B37F928-84AD-4098-9C93-ABB7779AA081}
c:\users\Nancy\AppData\Local\{0F03B390-2011-47B2-9336-2FDA2B4A4360}
c:\users\Nancy\AppData\Local\{0F752173-ED2D-4B7F-A37B-B8AEC2DCBCCD}
c:\users\Nancy\AppData\Local\{10321860-2BDF-4E78-BDB3-5BCD07AD629D}
c:\users\Nancy\AppData\Local\{11D7D134-D62D-4565-86C5-3C3FA205F9B7}
c:\users\Nancy\AppData\Local\{2366CA52-A42F-4C02-8B66-6E7413266579}
c:\users\Nancy\AppData\Local\{24AA0B77-3005-4350-A855-BFEAFEF6F74A}
c:\users\Nancy\AppData\Local\{2BBF3D80-17C0-4CA6-ADB0-D974AE317FDB}
c:\users\Nancy\AppData\Local\{2BF7FE24-A06A-420B-9649-EB418974AAD0}
c:\users\Nancy\AppData\Local\{2E311ACA-3649-450A-92AC-8D0D230D7F51}
c:\users\Nancy\AppData\Local\{2E3D7290-AD94-4171-A7A8-D2BCEC78021A}
c:\users\Nancy\AppData\Local\{2F8574D1-E0CA-4E9E-A57E-3736C21462EB}
c:\users\Nancy\AppData\Local\{45692F7C-B55D-4749-B797-45233B117F34}
c:\users\Nancy\AppData\Local\{4BABDD26-206E-4298-998C-F077AAE04A58}
c:\users\Nancy\AppData\Local\{4D6A9A06-0957-4D52-92CB-8E69DDBD4CB4}
c:\users\Nancy\AppData\Local\{4DE5EE15-2C05-4B22-9628-8C99B70B4C0C}
c:\users\Nancy\AppData\Local\{4E0A34E5-C147-4B9F-ACF5-4C604628D904}
c:\users\Nancy\AppData\Local\{527569DB-3B2F-4FE7-8EE5-9CA8502B136B}
c:\users\Nancy\AppData\Local\{585AAEA6-CDA6-48D1-AA7A-939BFE92542B}
c:\users\Nancy\AppData\Local\{66E4BAF8-6C76-442C-90D8-7248F48B4CDD}
c:\users\Nancy\AppData\Local\{69CFC663-C1D2-4177-8AEF-03E14B316570}
c:\users\Nancy\AppData\Local\{6A60A271-6D8E-4C47-B521-712850B3EA75}
c:\users\Nancy\AppData\Local\{746AFE7F-06CA-4AAE-8892-3E630E900FD0}
c:\users\Nancy\AppData\Local\{75BA0DB9-3BB4-4655-9649-A659B8E1EC96}
c:\users\Nancy\AppData\Local\{7BCB44D8-D4FB-402A-A6BA-9774902EAAB3}
c:\users\Nancy\AppData\Local\{89040DCA-974D-4F14-A85D-3C90DC375D20}
c:\users\Nancy\AppData\Local\{89AD610B-15F9-4286-8484-F9A94803146D}
c:\users\Nancy\AppData\Local\{8AF9163F-B6CC-4B75-8002-65E658370B13}
c:\users\Nancy\AppData\Local\{92572B97-72EF-4417-A512-13BB18D53462}
c:\users\Nancy\AppData\Local\{95E50AE5-193D-45AB-882C-EF03D6472765}
c:\users\Nancy\AppData\Local\{96F2A133-5B19-4979-AF8B-DFABCE0B7F78}
c:\users\Nancy\AppData\Local\{97D375D6-35F7-4EE0-B6D2-3359F15F30CB}
c:\users\Nancy\AppData\Local\{992D8976-D0B3-41A2-AC72-94C5005089C0}
c:\users\Nancy\AppData\Local\{A332EBF1-FFFE-4E33-B5FF-615DAF4C4F6C}
c:\users\Nancy\AppData\Local\{ABE64375-0416-45A0-B69F-7938DB5B6D16}
c:\users\Nancy\AppData\Local\{AED600EE-A22F-4B20-B275-15BDAB4F6C8E}
c:\users\Nancy\AppData\Local\{AF964F8F-2B7C-4A25-BB67-DAF3C9F62AF5}
c:\users\Nancy\AppData\Local\{B491E160-7296-45AD-BF4E-B52BEE091015}
c:\users\Nancy\AppData\Local\{B8993139-1FF1-4AD2-A902-35D445465D45}
c:\users\Nancy\AppData\Local\{C8A7EC52-DF0E-44E7-8DFE-8AF70F70C21D}
c:\users\Nancy\AppData\Local\{C99141CF-1998-4D5D-98EE-3D321D8FBFAB}
c:\users\Nancy\AppData\Local\{CE243EB9-B936-4FA7-8E4A-BC5EE678CBF3}
c:\users\Nancy\AppData\Local\{D52379C4-6D54-49C3-99DD-BB01A472835C}
c:\users\Nancy\AppData\Local\{D95AA3A4-F1D5-4578-8A9F-23CAEAA3B0D4}
c:\users\Nancy\AppData\Local\{E561CC4B-00EE-475A-A7F6-8374E7288BBD}
c:\users\Nancy\AppData\Local\{E610BA14-1123-47F0-9D9B-DE5D315792B6}
c:\users\Nancy\AppData\Local\{EBA9D5F0-FE17-4B12-86AE-1939BED5812A}
c:\users\Nancy\AppData\Local\{F101C60C-0A91-4FDE-9771-38838673E9BA}
c:\users\Nancy\AppData\Local\{F15279E2-7B52-4839-869A-68902F5918B9}
c:\users\Nancy\AppData\Local\{FA9AA1D7-87BB-4A81-B016-80FE0CDCC336}
c:\users\Nancy\AppData\Local\{FC8F4A5A-3751-494D-8C04-66A3EAFFEB36}
c:\users\Nancy\AppData\Local\Conduit
c:\users\Nancy\AppData\Local\Conduit\CT2832595\InnoGames_InternationalAutoUpdateHelper.exe
c:\windows\system32\ConduitEngine.tmp
.
.
(((((((((((((((((((( Bestanden Gemaakt van 2011-05-20 to 2011-06-20 ))))))))))))))))))))))))))))))
.
.
2011-06-20 21:00 . 2011-06-20 21:01 -------- d-----w- c:\users\Nancy\AppData\Local\temp
2011-06-20 21:00 . 2011-06-20 21:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-18 18:06 . 2011-06-18 18:06 -------- d-----w- c:\users\Nancy\AppData\Roaming\Malwarebytes
2011-06-18 18:05 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\programdata\Malwarebytes
2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-06-18 18:05 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-18 16:48 . 2011-06-18 16:48 -------- d-----w- c:\users\Nancy\AppData\Roaming\Reviversoft
2011-06-18 16:29 . 2011-05-17 12:51 16704 ----a-w- c:\windows\system32\roboot.exe
2011-06-18 16:02 . 2011-06-18 16:02 388096 ----a-r- c:\users\Nancy\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-06-18 16:02 . 2011-06-18 16:02 -------- d-----w- c:\program files\Trend Micro
2011-06-18 15:06 . 2011-05-09 20:46 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83DCB7F6-5579-4AE1-A3E3-C30D5DBE326C}\mpengine.dll
2011-06-18 14:54 . 2011-06-19 09:20 126584 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-06-18 14:47 . 2011-06-19 13:28 -------- d-----w- c:\windows\system32\drivers\NAV
2011-06-18 14:46 . 2011-06-18 14:47 -------- d-----w- c:\program files\Norton AntiVirus
2011-06-18 14:44 . 2011-06-18 14:44 -------- d-----w- c:\program files\NortonInstaller
2011-06-18 14:20 . 2011-06-18 14:20 -------- d-----w- c:\program files\AVG
2011-06-16 07:59 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-06-16 07:59 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-06-16 07:59 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-06-15 21:34 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2011-06-15 21:33 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-15 21:33 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-15 21:33 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-15 21:33 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-15 21:32 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-15 21:32 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 21:32 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 21:32 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-15 21:32 . 2011-05-02 12:02 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-06-07 19:35 . 2011-06-07 19:35 -------- d-----w- c:\program files\ConduitEngine
2011-06-02 21:38 . 2011-06-02 21:38 -------- d-----w- c:\program files\Navigram
2011-05-26 20:57 . 2011-05-26 21:01 -------- d-----w- c:\users\Nancy\AppData\Roaming\TeamViewer
2011-05-26 20:56 . 2011-05-26 20:56 -------- d-----w- c:\program files\TeamViewer
2011-05-24 12:57 . 2011-06-15 20:19 -------- d-----w- c:\programdata\Skype Extras
2011-05-24 12:56 . 2011-05-24 12:56 -------- d-----w- c:\program files\Common Files\Skype
.
.
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2011-03-09 247728]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-28 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-28 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-28 137752]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-06-30 159744]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-09-30 181544]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-27 202032]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]
.
c:\users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Schermopname en Snel starten.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1ca05a05a2d3ab0;Google Updateservice (gupdate1ca05a05a2d3ab0);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
R3 DCamUSBNW800;CIF USB Camera (2110);c:\windows\system32\DRIVERS\pcam800.sys [2002-07-27 210792]
R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1206000.01D\SYMDS.SYS [2011-01-27 340088]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1206000.01D\SYMEFA.SYS [2011-03-15 744568]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20110616.003\BHDrvx86.sys [2011-06-15 810616]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20110615.001\IDSvix86.sys [2011-06-10 367736]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1206000.01D\Ironx86.SYS [2011-01-27 136312]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NAV\1206000.01D\SYMTDIV.SYS [2011-03-22 331384]
S2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\18.6.0.29\ccSvcHst.exe [2011-04-17 130008]
S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-04-15 2280312]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-03-09 92592]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-06-18 105592]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Inhoud van de 'Gedeelde Taken' map
.
2011-06-20 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-15 23:01]
.
2011-06-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02]
.
2011-06-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.nl/
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: navigram.com\www
TCP: DhcpNameServer = 194.134.5.5 194.134.0.97
.
- - - - ORPHANS VERWIJDERD - - - -
.
AddRemove-InnoGames_International Toolbar - c:\program files\InnoGames_International\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-06-20 23:01
Windows 6.0.6002 Service Pack 2 NTFS
.
scannen van verborgen processen ...
.
scannen van verborgen autostart items ...
.
scannen van verborgen bestanden ...
.
Scan succesvol afgerond
verborgen bestanden: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\18.6.0.29\diMaster.dll\" /prefetch:1"
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
.
[HKEY_USERS\S-1-5-21-1799926568-97698467-2023138869-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2594D239-90E4-6F0A-46B8-4DB5907FD91E}*]
"oaigdonmkdndpahonfnedjgjaabbbm"=hex:6a,61,64,68,62,69,66,61,63,63,68,6f,69,66,
6a,66,6b,6e,65,6b,00,f7
"pacifjomjapaepmhaimimddiahmfacmn"=hex:6a,61,67,66,68,68,62,70,67,63,66,70,6c,
61,64,6a,6a,6f,68,6c,00,f7
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Voltooingstijd: 2011-06-20 23:11:59
ComboFix-quarantined-files.txt 2011-06-20 21:11
ComboFix2.txt 2011-06-19 13:21
ComboFix3.txt 2011-06-18 20:38
.
Pre-Run: 20.479.864.832 bytes beschikbaar
Post-Run: 20.164.423.680 bytes beschikbaar
.
- - End Of File - - DAAD397C662A81D78BDA91562A3ABF47
-
nee ik heb echt het bestandje in de rode cobofix snelkoppeling gesleept
Maar ik zal het nog eens proberen.
-
hier een nieuwe log
ComboFix 11-06-17.04 - Nancy 19-06-2011 14:57:04.2.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.31.1043.18.2037.961 [GMT 2:00]
Gestart vanuit: c:\users\Nancy\Desktop\ComboFix.exe
gebruikte Opdracht switches :: c:\users\Nancy\Desktop\CFScript.txt. - Snelkoppeling.lnk
AV: Norton AntiVirus *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
SP: Norton AntiVirus *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((( Bestanden Gemaakt van 2011-05-19 to 2011-06-19 ))))))))))))))))))))))))))))))
.
.
2011-06-19 13:14 . 2011-06-19 13:15 -------- d-----w- c:\users\Nancy\AppData\Local\temp
2011-06-19 13:14 . 2011-06-19 13:14 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-19 12:50 . 2011-06-19 12:52 -------- d-----w- C:\32788R22FWJFW
2011-06-18 18:06 . 2011-06-18 18:06 -------- d-----w- c:\users\Nancy\AppData\Roaming\Malwarebytes
2011-06-18 18:05 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\programdata\Malwarebytes
2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-06-18 18:05 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-18 16:48 . 2011-06-18 16:48 -------- d-----w- c:\users\Nancy\AppData\Roaming\Reviversoft
2011-06-18 16:29 . 2011-05-17 12:51 16704 ----a-w- c:\windows\system32\roboot.exe
2011-06-18 16:02 . 2011-06-18 16:02 388096 ----a-r- c:\users\Nancy\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-06-18 16:02 . 2011-06-18 16:02 -------- d-----w- c:\program files\Trend Micro
2011-06-18 15:06 . 2011-05-09 20:46 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83DCB7F6-5579-4AE1-A3E3-C30D5DBE326C}\mpengine.dll
2011-06-18 14:54 . 2011-06-19 09:20 126584 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-06-18 14:47 . 2011-06-18 20:22 -------- d-----w- c:\windows\system32\drivers\NAV
2011-06-18 14:46 . 2011-06-18 14:47 -------- d-----w- c:\program files\Norton AntiVirus
2011-06-18 14:44 . 2011-06-18 14:44 -------- d-----w- c:\program files\NortonInstaller
2011-06-18 14:20 . 2011-06-18 14:20 -------- d-----w- c:\program files\AVG
2011-06-18 13:51 . 2011-06-18 13:51 -------- d-----w- c:\users\Nancy\AppData\Local\{E561CC4B-00EE-475A-A7F6-8374E7288BBD}
2011-06-18 11:26 . 2011-06-18 11:26 -------- d-----w- c:\users\Nancy\AppData\Local\{585AAEA6-CDA6-48D1-AA7A-939BFE92542B}
2011-06-18 11:01 . 2011-06-18 11:01 -------- d-----w- c:\users\Nancy\AppData\Local\{4BABDD26-206E-4298-998C-F077AAE04A58}
2011-06-17 07:32 . 2011-06-17 07:32 -------- d-----w- c:\users\Nancy\AppData\Local\{2BF7FE24-A06A-420B-9649-EB418974AAD0}
2011-06-16 19:19 . 2011-06-16 19:19 -------- d-----w- c:\users\Nancy\AppData\Local\{F15279E2-7B52-4839-869A-68902F5918B9}
2011-06-16 07:59 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-06-16 07:59 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-06-16 07:59 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-06-16 07:18 . 2011-06-16 07:19 -------- d-----w- c:\users\Nancy\AppData\Local\{4DE5EE15-2C05-4B22-9628-8C99B70B4C0C}
2011-06-15 21:34 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2011-06-15 21:33 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-15 21:33 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-15 21:33 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-15 21:33 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-15 21:32 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-15 21:32 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 21:32 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 21:32 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-15 21:32 . 2011-05-02 12:02 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-06-15 15:27 . 2011-06-15 15:27 -------- d-----w- c:\users\Nancy\AppData\Local\{2F8574D1-E0CA-4E9E-A57E-3736C21462EB}
2011-06-14 22:15 . 2011-06-14 22:15 -------- d-----w- c:\users\Nancy\AppData\Local\{2E3D7290-AD94-4171-A7A8-D2BCEC78021A}
2011-06-14 10:15 . 2011-06-14 10:15 -------- d-----w- c:\users\Nancy\AppData\Local\{95E50AE5-193D-45AB-882C-EF03D6472765}
2011-06-13 22:14 . 2011-06-13 22:14 -------- d-----w- c:\users\Nancy\AppData\Local\{AED600EE-A22F-4B20-B275-15BDAB4F6C8E}
2011-06-13 10:13 . 2011-06-13 10:14 -------- d-----w- c:\users\Nancy\AppData\Local\{10321860-2BDF-4E78-BDB3-5BCD07AD629D}
2011-06-12 22:13 . 2011-06-12 22:13 -------- d-----w- c:\users\Nancy\AppData\Local\{96F2A133-5B19-4979-AF8B-DFABCE0B7F78}
2011-06-12 09:17 . 2011-06-12 09:17 -------- d-----w- c:\users\Nancy\AppData\Local\{0B37F928-84AD-4098-9C93-ABB7779AA081}
2011-06-11 11:44 . 2011-06-11 11:45 -------- d-----w- c:\users\Nancy\AppData\Local\{75BA0DB9-3BB4-4655-9649-A659B8E1EC96}
2011-06-10 23:44 . 2011-06-10 23:44 -------- d-----w- c:\users\Nancy\AppData\Local\{D95AA3A4-F1D5-4578-8A9F-23CAEAA3B0D4}
2011-06-10 07:03 . 2011-06-10 07:03 -------- d-----w- c:\users\Nancy\AppData\Local\{746AFE7F-06CA-4AAE-8892-3E630E900FD0}
2011-06-09 18:39 . 2011-06-09 18:39 -------- d-----w- c:\users\Nancy\AppData\Local\{92572B97-72EF-4417-A512-13BB18D53462}
2011-06-09 06:38 . 2011-06-09 06:38 -------- d-----w- c:\users\Nancy\AppData\Local\{CE243EB9-B936-4FA7-8E4A-BC5EE678CBF3}
2011-06-08 18:37 . 2011-06-08 18:38 -------- d-----w- c:\users\Nancy\AppData\Local\{FA9AA1D7-87BB-4A81-B016-80FE0CDCC336}
2011-06-08 06:37 . 2011-06-08 06:37 -------- d-----w- c:\users\Nancy\AppData\Local\{4E0A34E5-C147-4B9F-ACF5-4C604628D904}
2011-06-07 19:36 . 2011-06-07 19:36 -------- d-----w- c:\program files\Conduit
2011-06-07 19:35 . 2011-06-07 19:35 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-06-07 19:35 . 2011-06-07 19:35 -------- d-----w- c:\users\Nancy\AppData\Local\Conduit
2011-06-07 19:35 . 2011-06-07 19:35 -------- d-----w- c:\program files\InnoGames_International
2011-06-07 10:52 . 2011-06-07 10:53 -------- d-----w- c:\users\Nancy\AppData\Local\{C8A7EC52-DF0E-44E7-8DFE-8AF70F70C21D}
2011-06-06 18:29 . 2011-06-06 18:29 -------- d-----w- c:\users\Nancy\AppData\Local\{2BBF3D80-17C0-4CA6-ADB0-D974AE317FDB}
2011-06-06 06:28 . 2011-06-06 06:28 -------- d-----w- c:\users\Nancy\AppData\Local\{7BCB44D8-D4FB-402A-A6BA-9774902EAAB3}
2011-06-05 11:26 . 2011-06-05 11:26 -------- d-----w- c:\users\Nancy\AppData\Local\{992D8976-D0B3-41A2-AC72-94C5005089C0}
2011-06-04 23:25 . 2011-06-04 23:25 -------- d-----w- c:\users\Nancy\AppData\Local\{89040DCA-974D-4F14-A85D-3C90DC375D20}
2011-06-04 10:56 . 2011-06-04 10:56 -------- d-----w- c:\users\Nancy\AppData\Local\{89AD610B-15F9-4286-8484-F9A94803146D}
2011-06-03 22:55 . 2011-06-03 22:55 -------- d-----w- c:\users\Nancy\AppData\Local\{2E311ACA-3649-450A-92AC-8D0D230D7F51}
2011-06-03 10:11 . 2011-06-03 10:12 -------- d-----w- c:\users\Nancy\AppData\Local\{6A60A271-6D8E-4C47-B521-712850B3EA75}
2011-06-02 21:38 . 2011-06-02 21:38 -------- d-----w- c:\program files\Navigram
2011-06-02 21:01 . 2011-06-02 21:02 -------- d-----w- c:\users\Nancy\AppData\Local\{2366CA52-A42F-4C02-8B66-6E7413266579}
2011-06-02 09:01 . 2011-06-02 09:01 -------- d-----w- c:\users\Nancy\AppData\Local\{11D7D134-D62D-4565-86C5-3C3FA205F9B7}
2011-06-01 21:00 . 2011-06-01 21:00 -------- d-----w- c:\users\Nancy\AppData\Local\{C99141CF-1998-4D5D-98EE-3D321D8FBFAB}
2011-06-01 15:51 . 2011-06-01 15:52 -------- d-----w- c:\users\Nancy\AppData\Local\{A332EBF1-FFFE-4E33-B5FF-615DAF4C4F6C}
2011-05-31 22:03 . 2011-05-31 22:03 -------- d-----w- c:\users\Nancy\AppData\Local\{FC8F4A5A-3751-494D-8C04-66A3EAFFEB36}
2011-05-31 06:17 . 2011-05-31 06:17 -------- d-----w- c:\users\Nancy\AppData\Local\{ABE64375-0416-45A0-B69F-7938DB5B6D16}
2011-05-30 16:48 . 2011-05-30 16:48 -------- d-----w- c:\users\Nancy\AppData\Local\{24AA0B77-3005-4350-A855-BFEAFEF6F74A}
2011-05-29 21:54 . 2011-05-29 21:54 -------- d-----w- c:\users\Nancy\AppData\Local\{97D375D6-35F7-4EE0-B6D2-3359F15F30CB}
2011-05-29 09:53 . 2011-05-29 09:53 -------- d-----w- c:\users\Nancy\AppData\Local\{69CFC663-C1D2-4177-8AEF-03E14B316570}
2011-05-28 11:26 . 2011-05-28 11:27 -------- d-----w- c:\users\Nancy\AppData\Local\{E610BA14-1123-47F0-9D9B-DE5D315792B6}
2011-05-27 23:26 . 2011-05-27 23:26 -------- d-----w- c:\users\Nancy\AppData\Local\{D52379C4-6D54-49C3-99DD-BB01A472835C}
2011-05-27 06:53 . 2011-05-27 06:53 -------- d-----w- c:\users\Nancy\AppData\Local\{0F752173-ED2D-4B7F-A37B-B8AEC2DCBCCD}
2011-05-26 20:57 . 2011-05-26 21:01 -------- d-----w- c:\users\Nancy\AppData\Roaming\TeamViewer
2011-05-26 20:56 . 2011-05-26 20:56 -------- d-----w- c:\program files\TeamViewer
2011-05-26 18:52 . 2011-05-26 18:52 -------- d-----w- c:\users\Nancy\AppData\Local\{B491E160-7296-45AD-BF4E-B52BEE091015}
2011-05-26 06:52 . 2011-05-26 06:52 -------- d-----w- c:\users\Nancy\AppData\Local\{4D6A9A06-0957-4D52-92CB-8E69DDBD4CB4}
2011-05-25 15:13 . 2011-05-25 15:13 -------- d-----w- c:\users\Nancy\AppData\Local\{66E4BAF8-6C76-442C-90D8-7248F48B4CDD}
2011-05-24 18:26 . 2011-05-24 18:26 -------- d-----w- c:\users\Nancy\AppData\Local\{EBA9D5F0-FE17-4B12-86AE-1939BED5812A}
2011-05-24 12:57 . 2011-06-15 20:19 -------- d-----w- c:\programdata\Skype Extras
2011-05-24 12:56 . 2011-05-24 12:56 -------- d-----w- c:\program files\Common Files\Skype
2011-05-24 06:25 . 2011-05-24 06:25 -------- d-----w- c:\users\Nancy\AppData\Local\{AF964F8F-2B7C-4A25-BB67-DAF3C9F62AF5}
2011-05-23 16:43 . 2011-05-23 16:43 -------- d-----w- c:\users\Nancy\AppData\Local\{B8993139-1FF1-4AD2-A902-35D445465D45}
2011-05-22 22:51 . 2011-05-22 22:51 -------- d-----w- c:\users\Nancy\AppData\Local\{527569DB-3B2F-4FE7-8EE5-9CA8502B136B}
2011-05-22 09:54 . 2011-05-22 09:54 -------- d-----w- c:\users\Nancy\AppData\Local\{F101C60C-0A91-4FDE-9771-38838673E9BA}
2011-05-21 12:08 . 2011-05-21 12:08 -------- d-----w- c:\users\Nancy\AppData\Local\{8AF9163F-B6CC-4B75-8002-65E658370B13}
2011-05-20 21:35 . 2011-05-20 21:35 -------- d-----w- c:\users\Nancy\AppData\Local\{45692F7C-B55D-4749-B797-45233B117F34}
.
.
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2011-03-09 247728]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-28 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-28 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-28 137752]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-06-30 159744]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-09-30 181544]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-27 202032]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]
.
c:\users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Schermopname en Snel starten.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1ca05a05a2d3ab0;Google Updateservice (gupdate1ca05a05a2d3ab0);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
R3 DCamUSBNW800;CIF USB Camera (2110);c:\windows\system32\DRIVERS\pcam800.sys [2002-07-27 210792]
R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1206000.01D\SYMDS.SYS [2011-01-27 340088]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1206000.01D\SYMEFA.SYS [2011-03-15 744568]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20110616.003\BHDrvx86.sys [2011-06-15 810616]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20110615.001\IDSvix86.sys [2011-06-10 367736]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1206000.01D\Ironx86.SYS [2011-01-27 136312]
S2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\18.6.0.29\ccSvcHst.exe [2011-04-17 130008]
S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-04-15 2280312]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-03-09 92592]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-06-18 105592]
S3 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\NAV\1201000.025\SYMTDIV.SYS [2010-07-13 331312]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Inhoud van de 'Gedeelde Taken' map
.
2011-06-19 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-15 23:01]
.
2011-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02]
.
2011-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.nl/
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: navigram.com\www
TCP: DhcpNameServer = 194.134.5.5 194.134.0.97
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-19 15:15
Windows 6.0.6002 Service Pack 2 NTFS
.
scannen van verborgen processen ...
.
scannen van verborgen autostart items ...
.
scannen van verborgen bestanden ...
.
Scan succesvol afgerond
verborgen bestanden: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\18.6.0.29\diMaster.dll\" /prefetch:1"
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
.
[HKEY_USERS\S-1-5-21-1799926568-97698467-2023138869-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2594D239-90E4-6F0A-46B8-4DB5907FD91E}*]
"oaigdonmkdndpahonfnedjgjaabbbm"=hex:6a,61,64,68,62,69,66,61,63,63,68,6f,69,66,
6a,66,6b,6e,65,6b,00,f7
"pacifjomjapaepmhaimimddiahmfacmn"=hex:6a,61,67,66,68,68,62,70,67,63,66,70,6c,
61,64,6a,6a,6f,68,6c,00,f7
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Voltooingstijd: 2011-06-19 15:21:23
ComboFix-quarantined-files.txt 2011-06-19 13:21
ComboFix2.txt 2011-06-18 20:38
.
Pre-Run: 11.141.681.152 bytes beschikbaar
Post-Run: 13.020.696.576 bytes beschikbaar
.
- - End Of File - - 2D34884ECB0EBA98E1B01B64FF5E5D39
-
ok dank je hij loopt weer.
-
gisteren vertelde ik dat combofix zelf starte en dat ik niet de gelegenheid kreeg om het op mijn bureaublad te plaatsen. Ik heb op uitvoeren gedrukt. Moet ik het op nieuw downloaden?
-
Hier is het logje
bedankt ik ben al blij ik heb mijn pictogrammen op het bureaublad weer terug.
ComboFix 11-06-17.04 - Nancy 18-06-2011 21:55:42.1.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.31.1043.18.2037.1083 [GMT 2:00]
Gestart vanuit: c:\users\Nancy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WUXYWDTS\ComboFix.exe
AV: Norton AntiVirus *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
SP: Norton AntiVirus *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\KBL.LOG
.
.
(((((((((((((((((((( Bestanden Gemaakt van 2011-05-18 to 2011-06-18 ))))))))))))))))))))))))))))))
.
.
2011-06-18 20:16 . 2011-06-18 20:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-18 18:06 . 2011-06-18 18:06 -------- d-----w- c:\users\Nancy\AppData\Roaming\Malwarebytes
2011-06-18 18:05 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\programdata\Malwarebytes
2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-06-18 18:05 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-18 16:48 . 2011-06-18 16:48 -------- d-----w- c:\users\Nancy\AppData\Roaming\Reviversoft
2011-06-18 16:29 . 2011-05-17 12:51 16704 ----a-w- c:\windows\system32\roboot.exe
2011-06-18 16:02 . 2011-06-18 16:02 388096 ----a-r- c:\users\Nancy\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-06-18 16:02 . 2011-06-18 16:02 -------- d-----w- c:\program files\Trend Micro
2011-06-18 15:06 . 2011-05-09 20:46 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83DCB7F6-5579-4AE1-A3E3-C30D5DBE326C}\mpengine.dll
2011-06-18 14:54 . 2011-06-18 14:54 126512 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-06-18 14:47 . 2011-06-18 14:47 -------- d-----w- c:\windows\system32\drivers\NAV
2011-06-18 14:46 . 2011-06-18 14:47 -------- d-----w- c:\program files\Norton AntiVirus
2011-06-18 14:44 . 2011-06-18 14:44 -------- d-----w- c:\program files\NortonInstaller
2011-06-18 14:20 . 2011-06-18 14:20 -------- d-----w- c:\program files\AVG
2011-06-18 13:51 . 2011-06-18 13:51 -------- d--h--w- c:\users\Nancy\AppData\Local\{E561CC4B-00EE-475A-A7F6-8374E7288BBD}
2011-06-18 11:26 . 2011-06-18 11:26 -------- d--h--w- c:\users\Nancy\AppData\Local\{585AAEA6-CDA6-48D1-AA7A-939BFE92542B}
2011-06-18 11:01 . 2011-06-18 11:01 -------- d--h--w- c:\users\Nancy\AppData\Local\{4BABDD26-206E-4298-998C-F077AAE04A58}
2011-06-17 07:32 . 2011-06-17 07:32 -------- d--h--w- c:\users\Nancy\AppData\Local\{2BF7FE24-A06A-420B-9649-EB418974AAD0}
2011-06-16 19:19 . 2011-06-16 19:19 -------- d--h--w- c:\users\Nancy\AppData\Local\{F15279E2-7B52-4839-869A-68902F5918B9}
2011-06-16 07:59 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-06-16 07:59 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-06-16 07:59 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-06-16 07:18 . 2011-06-16 07:19 -------- d--h--w- c:\users\Nancy\AppData\Local\{4DE5EE15-2C05-4B22-9628-8C99B70B4C0C}
2011-06-15 21:34 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2011-06-15 21:33 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys
2011-06-15 21:33 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-06-15 21:33 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-06-15 21:33 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll
2011-06-15 21:32 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll
2011-06-15 21:32 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-15 21:32 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-06-15 21:32 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-06-15 21:32 . 2011-05-02 12:02 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-06-15 15:27 . 2011-06-15 15:27 -------- d--h--w- c:\users\Nancy\AppData\Local\{2F8574D1-E0CA-4E9E-A57E-3736C21462EB}
2011-06-14 22:15 . 2011-06-14 22:15 -------- d--h--w- c:\users\Nancy\AppData\Local\{2E3D7290-AD94-4171-A7A8-D2BCEC78021A}
2011-06-14 10:15 . 2011-06-14 10:15 -------- d--h--w- c:\users\Nancy\AppData\Local\{95E50AE5-193D-45AB-882C-EF03D6472765}
2011-06-13 22:14 . 2011-06-13 22:14 -------- d--h--w- c:\users\Nancy\AppData\Local\{AED600EE-A22F-4B20-B275-15BDAB4F6C8E}
2011-06-13 10:13 . 2011-06-13 10:14 -------- d--h--w- c:\users\Nancy\AppData\Local\{10321860-2BDF-4E78-BDB3-5BCD07AD629D}
2011-06-12 22:13 . 2011-06-12 22:13 -------- d--h--w- c:\users\Nancy\AppData\Local\{96F2A133-5B19-4979-AF8B-DFABCE0B7F78}
2011-06-12 09:17 . 2011-06-12 09:17 -------- d--h--w- c:\users\Nancy\AppData\Local\{0B37F928-84AD-4098-9C93-ABB7779AA081}
2011-06-11 11:44 . 2011-06-11 11:45 -------- d--h--w- c:\users\Nancy\AppData\Local\{75BA0DB9-3BB4-4655-9649-A659B8E1EC96}
2011-06-10 23:44 . 2011-06-10 23:44 -------- d--h--w- c:\users\Nancy\AppData\Local\{D95AA3A4-F1D5-4578-8A9F-23CAEAA3B0D4}
2011-06-10 07:03 . 2011-06-10 07:03 -------- d--h--w- c:\users\Nancy\AppData\Local\{746AFE7F-06CA-4AAE-8892-3E630E900FD0}
2011-06-09 18:39 . 2011-06-09 18:39 -------- d--h--w- c:\users\Nancy\AppData\Local\{92572B97-72EF-4417-A512-13BB18D53462}
2011-06-09 06:38 . 2011-06-09 06:38 -------- d--h--w- c:\users\Nancy\AppData\Local\{CE243EB9-B936-4FA7-8E4A-BC5EE678CBF3}
2011-06-08 18:37 . 2011-06-08 18:38 -------- d--h--w- c:\users\Nancy\AppData\Local\{FA9AA1D7-87BB-4A81-B016-80FE0CDCC336}
2011-06-08 06:37 . 2011-06-08 06:37 -------- d--h--w- c:\users\Nancy\AppData\Local\{4E0A34E5-C147-4B9F-ACF5-4C604628D904}
2011-06-07 19:36 . 2011-06-07 19:36 -------- d-----w- c:\program files\Conduit
2011-06-07 19:35 . 2011-06-07 19:35 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-06-07 19:35 . 2011-06-07 19:35 -------- d--h--w- c:\users\Nancy\AppData\Local\Conduit
2011-06-07 19:35 . 2011-06-07 19:35 -------- d-----w- c:\program files\InnoGames_International
2011-06-07 10:52 . 2011-06-07 10:53 -------- d--h--w- c:\users\Nancy\AppData\Local\{C8A7EC52-DF0E-44E7-8DFE-8AF70F70C21D}
2011-06-06 18:29 . 2011-06-06 18:29 -------- d--h--w- c:\users\Nancy\AppData\Local\{2BBF3D80-17C0-4CA6-ADB0-D974AE317FDB}
2011-06-06 06:28 . 2011-06-06 06:28 -------- d--h--w- c:\users\Nancy\AppData\Local\{7BCB44D8-D4FB-402A-A6BA-9774902EAAB3}
2011-06-05 11:26 . 2011-06-05 11:26 -------- d--h--w- c:\users\Nancy\AppData\Local\{992D8976-D0B3-41A2-AC72-94C5005089C0}
2011-06-04 23:25 . 2011-06-04 23:25 -------- d--h--w- c:\users\Nancy\AppData\Local\{89040DCA-974D-4F14-A85D-3C90DC375D20}
2011-06-04 10:56 . 2011-06-04 10:56 -------- d--h--w- c:\users\Nancy\AppData\Local\{89AD610B-15F9-4286-8484-F9A94803146D}
2011-06-03 22:55 . 2011-06-03 22:55 -------- d--h--w- c:\users\Nancy\AppData\Local\{2E311ACA-3649-450A-92AC-8D0D230D7F51}
2011-06-03 10:11 . 2011-06-03 10:12 -------- d--h--w- c:\users\Nancy\AppData\Local\{6A60A271-6D8E-4C47-B521-712850B3EA75}
2011-06-02 21:38 . 2011-06-02 21:38 -------- d-----w- c:\program files\Navigram
2011-06-02 21:01 . 2011-06-02 21:02 -------- d--h--w- c:\users\Nancy\AppData\Local\{2366CA52-A42F-4C02-8B66-6E7413266579}
2011-06-02 09:01 . 2011-06-02 09:01 -------- d--h--w- c:\users\Nancy\AppData\Local\{11D7D134-D62D-4565-86C5-3C3FA205F9B7}
2011-06-01 21:00 . 2011-06-01 21:00 -------- d--h--w- c:\users\Nancy\AppData\Local\{C99141CF-1998-4D5D-98EE-3D321D8FBFAB}
2011-06-01 15:51 . 2011-06-01 15:52 -------- d--h--w- c:\users\Nancy\AppData\Local\{A332EBF1-FFFE-4E33-B5FF-615DAF4C4F6C}
2011-05-31 22:03 . 2011-05-31 22:03 -------- d--h--w- c:\users\Nancy\AppData\Local\{FC8F4A5A-3751-494D-8C04-66A3EAFFEB36}
2011-05-31 06:17 . 2011-05-31 06:17 -------- d--h--w- c:\users\Nancy\AppData\Local\{ABE64375-0416-45A0-B69F-7938DB5B6D16}
2011-05-30 16:48 . 2011-05-30 16:48 -------- d--h--w- c:\users\Nancy\AppData\Local\{24AA0B77-3005-4350-A855-BFEAFEF6F74A}
2011-05-29 21:54 . 2011-05-29 21:54 -------- d--h--w- c:\users\Nancy\AppData\Local\{97D375D6-35F7-4EE0-B6D2-3359F15F30CB}
2011-05-29 09:53 . 2011-05-29 09:53 -------- d--h--w- c:\users\Nancy\AppData\Local\{69CFC663-C1D2-4177-8AEF-03E14B316570}
2011-05-28 11:26 . 2011-05-28 11:27 -------- d--h--w- c:\users\Nancy\AppData\Local\{E610BA14-1123-47F0-9D9B-DE5D315792B6}
2011-05-27 23:26 . 2011-05-27 23:26 -------- d--h--w- c:\users\Nancy\AppData\Local\{D52379C4-6D54-49C3-99DD-BB01A472835C}
2011-05-27 06:53 . 2011-05-27 06:53 -------- d--h--w- c:\users\Nancy\AppData\Local\{0F752173-ED2D-4B7F-A37B-B8AEC2DCBCCD}
2011-05-26 20:57 . 2011-05-26 21:01 -------- d--h--w- c:\users\Nancy\AppData\Roaming\TeamViewer
2011-05-26 20:56 . 2011-05-26 20:56 -------- d-----w- c:\program files\TeamViewer
2011-05-26 18:52 . 2011-05-26 18:52 -------- d--h--w- c:\users\Nancy\AppData\Local\{B491E160-7296-45AD-BF4E-B52BEE091015}
2011-05-26 06:52 . 2011-05-26 06:52 -------- d--h--w- c:\users\Nancy\AppData\Local\{4D6A9A06-0957-4D52-92CB-8E69DDBD4CB4}
2011-05-25 15:13 . 2011-05-25 15:13 -------- d--h--w- c:\users\Nancy\AppData\Local\{66E4BAF8-6C76-442C-90D8-7248F48B4CDD}
2011-05-24 18:26 . 2011-05-24 18:26 -------- d--h--w- c:\users\Nancy\AppData\Local\{EBA9D5F0-FE17-4B12-86AE-1939BED5812A}
2011-05-24 12:57 . 2011-06-15 20:19 -------- d--h--w- c:\programdata\Skype Extras
2011-05-24 12:56 . 2011-05-24 12:56 -------- d-----w- c:\program files\Common Files\Skype
2011-05-24 06:25 . 2011-05-24 06:25 -------- d--h--w- c:\users\Nancy\AppData\Local\{AF964F8F-2B7C-4A25-BB67-DAF3C9F62AF5}
2011-05-23 16:43 . 2011-05-23 16:43 -------- d--h--w- c:\users\Nancy\AppData\Local\{B8993139-1FF1-4AD2-A902-35D445465D45}
2011-05-22 22:51 . 2011-05-22 22:51 -------- d--h--w- c:\users\Nancy\AppData\Local\{527569DB-3B2F-4FE7-8EE5-9CA8502B136B}
2011-05-22 09:54 . 2011-05-22 09:54 -------- d--h--w- c:\users\Nancy\AppData\Local\{F101C60C-0A91-4FDE-9771-38838673E9BA}
2011-05-21 12:08 . 2011-05-21 12:08 -------- d--h--w- c:\users\Nancy\AppData\Local\{8AF9163F-B6CC-4B75-8002-65E658370B13}
2011-05-20 21:35 . 2011-05-20 21:35 -------- d--h--w- c:\users\Nancy\AppData\Local\{45692F7C-B55D-4749-B797-45233B117F34}
2011-05-20 09:34 . 2011-05-20 09:34 -------- d--h--w- c:\users\Nancy\AppData\Local\{0F03B390-2011-47B2-9336-2FDA2B4A4360}
.
.
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2011-03-09 247728]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-28 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-28 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-28 137752]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-06-30 159744]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-09-30 181544]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-27 202032]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]
.
c:\users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Schermopname en Snel starten.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1ca05a05a2d3ab0;Google Updateservice (gupdate1ca05a05a2d3ab0);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
R3 DCamUSBNW800;CIF USB Camera (2110);c:\windows\system32\DRIVERS\pcam800.sys [2002-07-27 210792]
R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1201000.025\SYMDS.SYS [2010-06-13 339504]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1201000.025\SYMEFA.SYS [2010-07-29 666672]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx86.sys [2010-08-09 692272]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVix86.sys [2010-06-27 344112]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1201000.025\Ironx86.SYS [2010-06-27 134704]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\NAV\1201000.025\SYMTDIV.SYS [2010-07-13 331312]
S2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe [2010-07-23 126904]
S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-04-15 2280312]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-03-09 92592]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-06-18 105592]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Inhoud van de 'Gedeelde Taken' map
.
2011-06-18 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-15 23:01]
.
2011-06-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02]
.
2011-06-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.nl/
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: navigram.com\www
TCP: DhcpNameServer = 194.134.5.5 194.134.0.97
.
- - - - ORPHANS VERWIJDERD - - - -
.
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{942CD1D4-9CC1-4D31-876A-EA8F489F7A59} - (no file)
HKCU-Run-MsnMsgr - ~c:\program files\Windows Live\Messenger\msnmsgr.exe
HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
AddRemove-conduitEngine - c:\program files\ConduitEngine\ConduitEngineUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-06-18 22:17
Windows 6.0.6002 Service Pack 2 NTFS
.
scannen van verborgen processen ...
.
scannen van verborgen autostart items ...
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MsnMsgr = ~"c:\program files\Windows Live\Messenger\msnmsgr.exe" /background?
.
scannen van verborgen bestanden ...
.
Scan succesvol afgerond
verborgen bestanden: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\18.1.0.37\diMaster.dll\" /prefetch:1"
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
.
[HKEY_USERS\S-1-5-21-1799926568-97698467-2023138869-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2594D239-90E4-6F0A-46B8-4DB5907FD91E}*]
"oaigdonmkdndpahonfnedjgjaabbbm"=hex:6a,61,64,68,62,69,66,61,63,63,68,6f,69,66,
6a,66,6b,6e,65,6b,00,f7
"pacifjomjapaepmhaimimddiahmfacmn"=hex:6a,61,67,66,68,68,62,70,67,63,66,70,6c,
61,64,6a,6a,6f,68,6c,00,f7
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Voltooingstijd: 2011-06-18 22:38:13
ComboFix-quarantined-files.txt 2011-06-18 20:38
.
Pre-Run: 12.380.205.056 bytes beschikbaar
Post-Run: 13.522.911.232 bytes beschikbaar
.
- - End Of File - - 02DAFD3B262DFCA873C929D7E30C2AD7
-
ik kon niet wachten dus ben het toch gaan downloaden ik heb op uitvoeren geklikt en daarna ging hij gelijk scannen ik kon het niet op het buroblad plaatsen en nu doorloopt hij de autoscan.
-
Ok ik ga weer aan de slag echt top dat je me wilt helpen
---------- Post toegevoegd om 21:38 ---------- Vorige post was om 21:29 ----------
Mijn computer geeft aan dat het niet vaak gedownload wordt en mogelijk schadelijk is voor de computer
-
nee die heb ik niet meer alleen rechts onderin kreeg ik met opnieuw opstarten een pictogrammetje met de melding geblokkeerde opstart programma's
-
Gevonden.......
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:53:35, on 18-6-2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10p_ActiveX.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Compaq | MSN
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} (Navigram Control) - http://www.navigram.com/engine/v911/Navigram.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Updateservice (gupdate1ca05a05a2d3ab0) (gupdate1ca05a05a2d3ab0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 10013 bytes
-
Als ik een nieuwe scan maak met Hijackthis opent hij geen kladblok meer zodat ik het kan kopiëren. Ik weet niet hoe ik het nu op het forum moet plaatsen
groetjes Nancy
---------- Post toegevoegd om 20:49 ---------- Vorige post was om 20:48 ----------
Ja zeker ik zag het staan ik ben heel blij dat ze verwijderd zijn. Ik dacht echt dat mijn laptop overleden was.
Hij blaast namelijk de laaste tijd erg hard.
-
Deze werkt ook niet
Maar volgens mij heb ik de juiste kunnen vinden.
---------- Post toegevoegd om 20:26 ---------- Vorige post was om 20:24 ----------
sorry hij doet het wel alles is een beetje anders op mijn laptop.
---------- Post toegevoegd om 20:39 ---------- Vorige post was om 20:26 ----------
Malwarebytes' Anti-Malware 1.51.0.1200
Databaseversie: 6888
Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421
18-6-2011 20:28:16
mbam-log-2011-06-18 (20-28-16).txt
Scantype: Snelle scan
Objecten gescand: 161463
Verstreken tijd: 14 minuut/minuten, 13 seconde(n)
Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 0
Registerwaarden geïnfecteerd: 0
Registerdata geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 3
Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)
Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)
Registersleutels geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)
Registerwaarden geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)
Registerdata geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)
Mappen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)
Bestanden geïnfecteerd:
c:\Users\Nancy\AppData\Local\Temp\install_flash_player.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
c:\users\nancy\appdata\local\temp\tmp78a4.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Nancy\AppData\Local\Temp\adobe_flash_player.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
-
Ok dank je wel dit is de log.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:13:34, on 18-6-2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\sdclt.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10p_ActiveX.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Compaq | MSN
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = cooxer.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
R3 - URLSearchHook: InnoGames International Toolbar - {942cd1d4-9cc1-4d31-876a-ea8f489f7a59} - C:\Program Files\InnoGames_International\prxtbInno.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: InnoGames International - {942cd1d4-9cc1-4d31-876a-ea8f489f7a59} - C:\Program Files\InnoGames_International\prxtbInno.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: InnoGames International Toolbar - {942cd1d4-9cc1-4d31-876a-ea8f489f7a59} - C:\Program Files\InnoGames_International\prxtbInno.dll
O3 - Toolbar: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [sweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} (Navigram Control) - http://www.navigram.com/engine/v911/Navigram.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Updateservice (gupdate1ca05a05a2d3ab0) (gupdate1ca05a05a2d3ab0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 11309 bytes
groetjes Nancy
-
Ik heb net als Marlon het Critical harddisk virus. Ik heb inmiddels Hijackthis geinstalleerd. Ik heb een log gemaakt maar weet niet wat ik verder kan doen.
Ik lees ook in haar bericht dat er naar de logjes gekeken moet worden.
Kan iemand mij verder helpen.
Groeten Nancy
Graag Hulp per ongeluk mijn emailaccount verwijderd in outlook 2007
in Archief Microsoft Office
Geplaatst:
Ik heb mijn emails terug.
Gelukkig xD