Ga naar inhoud

doedelzak123

Lid
 Bekijk profiel  Bekijk hun activiteit

  • Items

    263

  • Registratiedatum

  • Laatst bezocht

 Inhoudstype 

Berichten die geplaatst zijn door doedelzak123

    Pc gehackt?

    in Archief Bestrijding malware & virussen

    Geplaatst:

    Beste Kape,

    Bedankt voor het zoals altijd zeer snelle antwoord. Hieronder volgt het nieuwe HijackThis logje en het combofix logje. Mijn zus denkt dat ons netwerk gehackt is, kan dit een oorzaak zijn van het trage internet op haar computer en soms ook bij mij? Ik moet eerlijk toegeven dat ik nogal vaak dingen download, misschien dat het daar mee te maken heeft?

    Logfile of Trend Micro HijackThis v2.0.4

    Scan saved at 16:07:24, on 19/10/2011

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v7.00 (7.00.6000.17103)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\TPSrv.exe

    C:\WINDOWS\system32\svchost.exe

    C:\PROGRAM FILES\PANDA SECURITY\PANDA ANTIVIRUS PRO 2012\WebProxy.exe

    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

    C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\eHome\ehRecvr.exe

    C:\WINDOWS\eHome\ehSched.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Common Files\LightScribe\LSSrvc.exe

    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PsCtrls.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PavFnSvr.exe

    C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe

    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PsImSvc.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PskSvc.exe

    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\pavsrvx86.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\AVENGINE.EXE

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\ehome\ehtray.exe

    C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

    C:\WINDOWS\AGRSMMSG.exe

    C:\Program Files\Realtek\InstallShield\AzMixerSel.exe

    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    C:\WINDOWS\system32\dllhost.exe

    C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

    C:\Acer\Empowering Technology\ePresentation\ePresentation.exe

    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

    C:\Acer\Empowering Technology\ePower\ePower_DMC.exe

    C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE

    C:\WINDOWS\system32\wbem\wmiapsrv.exe

    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

    C:\WINDOWS\system32\rundll32.exe

    C:\WINDOWS\eHome\ehmsas.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\APVXDWIN.EXE

    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

    C:\Documents and Settings\Stéphanie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\WINDOWS\system32\wbem\unsecapp.exe

    C:\Program Files\Skype\Phone\Skype.exe

    C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe

    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe

    C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

    C:\WINDOWS\system32\msiexec.exe

    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

    C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe

    C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe

    C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe

    C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = De Standaard Online

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

    O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll

    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

    O4 - HKLM\..\Run: [LaunchApp] Alaunch

    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

    O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe

    O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

    O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe

    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0

    O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe

    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

    O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe

    O4 - HKLM\..\Run: [boot] C:\Acer\Empowering Technology\ePower\Boot.exe

    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE

    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

    O4 - HKLM\..\Run: [imageItEncrypt] C:\WINDOWS\system32\ImageItEncrypt.exe

    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

    O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

    O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

    O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Antivirus Pro 2012\APVXDWIN.EXE" /s

    O4 - HKLM\..\Run: [sCANINICIO] "C:\Program Files\Panda Security\Panda Antivirus Pro 2012\Inicio.exe"

    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Stéphanie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')

    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')

    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

    O4 - Startup: Microsoft Office Outlook.lnk = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE

    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

    O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

    O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

    O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

    O23 - Service: Adobe Active File Monitor V9 (AdobeActiveFileMonitor9.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

    O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

    O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PsCtrls.exe

    O23 - Service: Panda Function Service (PAVFNSVR) - Unknown owner - C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PavFnSvr.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe

    O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2012\pavsrvx86.exe

    O23 - Service: Planner voor Automatische LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PsImSvc.exe

    O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PskSvc.exe

    O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

    O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2012\TPSrv.exe

    --

    End of file - 13750 bytes

    ComboFix 11-10-19.03 - Stéphanie 19/10/2011 16:23:55.1.2 - FAT32x86 MINIMAL

    Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.3070.2782 [GMT 2:00]

    Gestart vanuit: C:\Documents and Settings\StÚphanie\Bureaublad\ComboFix.exe

    AV: Panda Antivirus Pro 2012 *Disabled/Updated* {EEE2D94A-D4C1-421A-AB2C-2CE8FE51747A}

    WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!

    (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

    C:\Program Files\WinPCap

    C:\Program Files\WinPCap\daemon_mgm.exe

    C:\Program Files\WinPCap\npf_mgm.exe

    C:\Program Files\WinPCap\rpcapd.exe

    C:\WINDOWS\kb913800.exe

    C:\WINDOWS\system32\AutoRun.inf

    C:\WINDOWS\system32\d3d9caps.dat

    C:\WINDOWS\system32\drivers\npf.sys

    C:\WINDOWS\system32\Packet.dll

    C:\WINDOWS\system32\pthreadVC.dll

    C:\WINDOWS\system32\WanPacket.dll

    C:\WINDOWS\system32\wpcap.dll

    C:\WINDOWS\WindowsUpdate.log

    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    -------\Service_NPF

    (((((((((((((((((((( Bestanden Gemaakt van 2011-09-19 to 2011-10-19 ))))))))))))))))))))))))))))))

    2011-10-19 14:02:53 . 2011-10-19 14:02:58 388096 ----a-r- C:\Documents and Settings\Stéphanie\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

    2011-10-18 14:41:34 . 2011-10-18 14:41:36 -------- d-----w- C:\Documents and Settings\Stéphanie\Application Data\Malwarebytes

    2011-10-18 14:40:21 . 2011-10-18 14:40:22 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Malwarebytes

    2011-10-18 14:38:33 . 2011-10-18 14:38:34 -------- d-----w- C:\Program Files\Trend Micro

    2011-10-16 19:24:39 . 2009-04-16 10:42:24 315904 ----a-w- C:\WINDOWS\system32\Spool\prtprocs\w32x86\hpfpp70w.dll

    2011-10-16 19:24:38 . 2009-04-16 10:42:26 123904 ----a-w- C:\WINDOWS\system32\hpf3l70w.dll

    2011-10-15 12:41:09 . 2011-10-15 12:41:10 -------- d-----w- C:\Documents and Settings\Stéphanie\Application Data\HpUpdate

    2011-10-15 12:34:19 . 2011-10-15 12:34:20 -------- d-----w- C:\Documents and Settings\All Users\Application Data\HP Product Assistant

    2011-10-15 11:48:27 . 2009-04-01 06:21:18 713728 ----a-w- C:\WINDOWS\system32\hposwia_d02d.dll

    2011-10-15 11:48:27 . 2009-04-01 06:21:18 589824 ----a-w- C:\WINDOWS\system32\hpost_d02d.dll

    2011-10-15 11:48:27 . 2009-04-01 06:21:18 315392 ----a-w- C:\WINDOWS\system32\hposc_d02a.dll

    2011-10-03 13:02:49 . 2004-03-08 23:00:00 662288 ----a-w- C:\WINDOWS\system32\MSCOMCT2.OCX

    2011-10-03 13:02:49 . 2001-10-28 15:42:30 116224 ----a-w- C:\WINDOWS\system32\pdfcmnnt.dll

    2011-10-03 13:02:49 . 1998-06-23 23:00:00 137000 ----a-w- C:\WINDOWS\system32\MSMAPI32.OCX

    2011-10-03 13:02:42 . 1998-07-05 23:00:00 23552 ----a-w- C:\WINDOWS\system32\MSMPIDE.DLL

    2011-09-24 20:04:56 . 2011-09-24 20:04:58 -------- d-----w- C:\Documents and Settings\Stéphanie\Local Settings\Application Data\Panda Security

    2011-09-24 16:44:56 . 2011-02-21 12:38:32 37448 ----a-w- C:\WINDOWS\system32\drivers\ShlDrv51.sys

    2011-09-24 16:44:55 . 2010-05-06 15:11:58 163848 ----a-w- C:\WINDOWS\system32\drivers\PavProc.sys

    2011-09-24 16:44:52 . 2011-09-24 16:44:54 -------- d-----w- C:\Program Files\Common Files\Panda Security

    2011-09-24 16:32:56 . 2011-09-24 16:32:58 -------- d-----w- C:\Documents and Settings\Stéphanie\Application Data\Nokia Ovi Suite

    2011-09-24 16:30:42 . 2011-09-24 16:30:44 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Nokia

    2011-09-24 16:21:52 . 2011-09-24 16:21:54 -------- d-----w- C:\Documents and Settings\Stéphanie\Local Settings\Application Data\Nokia

    2011-09-24 16:13:18 . 2011-09-24 16:13:20 -------- d-----w- C:\WINDOWS\system32\LogFiles

    2011-09-24 16:13:18 . 2011-09-24 16:13:20 -------- d-----w- C:\WINDOWS\system32\drivers\UMDF

    .

    ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2011-09-26 09:41:44 . 2008-07-29 17:59:58 614912 ----a-w- C:\WINDOWS\system32\uiautomationcore.dll

    2011-09-26 09:41:44 . 2004-09-02 11:00:00 23040 ----a-w- C:\WINDOWS\system32\oleaccrc.dll

    2011-09-26 09:41:20 . 2004-09-02 11:00:00 220160 ----a-w- C:\WINDOWS\system32\oleacc.dll

    2011-09-25 09:52:38 . 2011-06-29 17:01:35 404640 ----a-w- C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

    2011-09-09 09:12:06 . 2004-09-02 11:00:00 602624 ----a-w- C:\WINDOWS\system32\crypt32.dll

    2011-09-06 14:09:58 . 2004-09-02 11:00:00 1859072 ----a-w- C:\WINDOWS\system32\win32k.sys

    2011-08-17 21:25:12 . 2006-01-09 18:04:18 832512 ----a-w- C:\WINDOWS\system32\wininet.dll

    2011-08-17 21:25:10 . 2004-09-02 11:00:00 78336 ------w- C:\WINDOWS\system32\ieencode.dll

    2011-08-17 21:25:10 . 2004-09-02 11:00:00 1830912 ------w- C:\WINDOWS\system32\inetcpl.cpl

    2011-08-17 21:25:08 . 2004-09-02 11:00:00 17408 ------w- C:\WINDOWS\system32\corpol.dll

    2011-08-17 13:49:54 . 2004-09-02 11:00:00 138496 ----a-w- C:\WINDOWS\system32\drivers\afd.sys

    2011-08-17 12:22:24 . 2004-09-02 11:00:00 389120 ------w- C:\WINDOWS\system32\html.iec

    ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

    *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2011-07-29 10:31:22 17361032]

    "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2011-06-16 13:21:06 1500160]

    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 16:02:54 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "LaunchApp"="Alaunch" [X]

    "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-17 20:40:06 64512]

    "AGRSMMSG"="AGRSMMSG.exe" [2006-03-16 15:24:00 88204]

    "RTHDCPL"="RTHDCPL.EXE" [2006-02-27 15:28:16 16005120]

    "AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-08-25 12:21:22 53248]

    "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-01-08 05:17:16 102491]

    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-01-08 05:16:04 692315]

    "ntiMUI"="C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 15:15:08 45056]

    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-09-02 11:00:00 208952]

    "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-09-02 11:00:00 59392]

    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-09-02 11:00:00 455168]

    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-09-02 11:00:00 455168]

    "eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 13:00:50 345088]

    "Acer ePresentation HPD"="C:\Acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-03-31 14:39:28 204800]

    "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-28 11:52:00 77824]

    "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-28 11:55:58 118784]

    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 15:41:22 45056]

    "ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-04-04 16:08:44 421888]

    "Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 20:12:24 579584]

    "LManager"="C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE" [2006-03-30 11:56:56 471040]

    "eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-04-28 14:43:34 401408]

    "ImageItEncrypt"="C:\WINDOWS\system32\ImageItEncrypt.exe" [2005-12-30 12:02:40 40960]

    "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 09:44:34 31072]

    "AdobeAAMUpdater-1.0"="C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-28 23:25:06 497648]

    "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 15:38:32 583048]

    "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 16:03:20 110592]

    "Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 10:55:28 937920]

    "APVXDWIN"="C:\Program Files\Panda Security\Panda Antivirus Pro 2012\APVXDWIN.EXE" [2011-04-13 15:06:58 1000768]

    "SCANINICIO"="C:\Program Files\Panda Security\Panda Antivirus Pro 2012\Inicio.exe" [2011-02-02 09:59:44 70464]

    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 14:13:18 54576]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 16:02:54 15360]

    C:\Documents and Settings\Stéphanie\Menu Start\Programma's\Opstarten\

    Microsoft Office Outlook.lnk - C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE [2011-7-27 13002608]

    OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

    C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\

    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]

    2010-03-24 10:55:52 55552 ----a-w- C:\WINDOWS\system32\avldr.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]

    @="Service"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

    @="Service"

    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update

    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray

    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck

    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

    "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

    "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

    "C:\\Program Files\\Messenger\\MSMSGS.EXE"=

    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    "C:\\Program Files\\Panda Security\\Panda Antivirus Pro 2012\\ApVxdWin.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

    "1032:TCP"= 1032:TCP:Akamai NetSession Interface

    "5000:UDP"= 5000:UDP:Akamai NetSession Interface

    R0 pavboot;Panda boot driver;C:\WINDOWS\system32\drivers\pavboot.sys [24/09/2011 22:03:53 26696]

    R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\drivers\ShlDrv51.sys [24/09/2011 18:44:56 37448]

    R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [30/09/2010 3:06:46 169408]

    R2 Akamai;Akamai NetSession Interface;C:\WINDOWS\System32\svchost.exe -k Akamai [2/09/2004 13:00:00 14336]

    R2 AmFSM;AmFSM;C:\WINDOWS\system32\drivers\amm8651.sys [24/09/2011 22:03:09 59080]

    R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\drivers\PavProc.sys [24/09/2011 18:44:55 163848]

    R2 PskSvcRetail;Panda PSK service;C:\Program Files\Panda Security\Panda Antivirus Pro 2012\psksvc.exe [24/09/2011 22:03:53 28992]

    R3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys --> C:\WINDOWS\system32\drivers\av5flt.sys [?]

    R3 PavSRK.sys;PavSRK.sys;\??\C:\WINDOWS\system32\PavSRK.sys --> C:\WINDOWS\system32\PavSRK.sys [?]

    R3 PavTPK.sys;PavTPK.sys;\??\C:\WINDOWS\system32\PavTPK.sys --> C:\WINDOWS\system32\PavTPK.sys [?]

    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13:16:28 130384]

    S3 lv321av;Logitech USB PC Camera (VC0321);C:\WINDOWS\system32\drivers\lv321av.sys [6/04/2006 18:46:42 1097472]

    S3 MBAMSwissArmy;MBAMSwissArmy;\??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys --> C:\WINDOWS\system32\drivers\mbamswissarmy.sys [?]

    S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 14:49:20 227232]

    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 13:16:28 753504]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

    Akamai REG_MULTI_SZ Akamai

    HPService REG_MULTI_SZ HPSLPSVC

    Inhoud van de 'Gedeelde Taken' map

    ------- Bijkomende Scan -------

    uStart Page = hxxp://www.standaard.be/

    IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

    TCP: DhcpNameServer = 195.130.130.132 195.130.131.132

    ------- Bestandsassociaties -------

    JSEFile=C:\PROGRA~1\PANDAS~1\PANDAA~1\PavScrip.exe "%1" %*

    VBEFile=C:\PROGRA~1\PANDAS~1\PANDAA~1\PAVSCRIP.EXE "%1" %*

    VBSFile=C:\PROGRA~1\PANDAS~1\PANDAA~1\PAVSCRIP.EXE "%1" %*

    - - - - ORPHANS VERWIJDERD - - - -

    SafeBoot-WudfPf

    SafeBoot-WudfRd

    MSConfigStartUp-CTFMON - (no file)

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

    Rootkit scan 2011-10-19 16:38:12

    Windows 5.1.2600 Service Pack 3 FAT NTAPI

    scannen van verborgen processen ...

    scannen van verborgen autostart items ...

    scannen van verborgen bestanden ...

    Scan succesvol afgerond

    verborgen bestanden: 0

    **************************************************************************

    Pc gehackt?

    in Archief Bestrijding malware & virussen

    Geplaatst:

    Beste experts,

    enkele weken geleden las ik een artikel over Russische organisaties die computers van over de hele wereld hacken en online verhuren. Je kan dus een computer online huren (en ook "besturen") en via het IP-adres van die computer illegale praktijken verrichten zonder dat je opgespoord kan worden.

    De computer van mijn zus is de laatste tijd echt overdreven traag geworden. Ze vroeg me gisteren of het kan dat ze slachtoffer is geworden van die praktijken. Ik moet er wel bij vermelden dat de laptop reeds vroeger traag was, maar nu is het echt irritant. Ook moet de computer om de x-aantal tijd geformatteerd worden omdat hij zo traag is. Dit moet tegenwoordig hoe langer hoe vaker. Ze denkt er dus al een tijdje aan een nieuwe computer te kopen, maar omdat ze veel moet werken op haar computer zou ze toch graag terug een computer hebben die wat deftig werkt.

    Ook hebben wij buren die ons niet al te graag mogen. We zeggen elkaar geen goeiedag enz. Ze wil dus ook uitsluiten dat zij hierachter zitten. Daarom moest ik ook vragen of het mogelijk is dat de buren haar pc hebben gehackt, of dat dit redelijk uitsluitbaar is.

    Hieronder volgend nog enkele logjes. Alvast bedankt!

    De scan met HouseCall leverde niets op.

    Logfile of Trend Micro HijackThis v2.0.4

    Scan saved at 16:39:39, on 18/10/2011

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v7.00 (7.00.6000.17103)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\TPSrv.exe

    C:\WINDOWS\system32\svchost.exe

    C:\PROGRAM FILES\PANDA SECURITY\PANDA ANTIVIRUS PRO 2012\WebProxy.exe

    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

    C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\eHome\ehRecvr.exe

    C:\WINDOWS\eHome\ehSched.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Common Files\LightScribe\LSSrvc.exe

    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PsCtrls.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PavFnSvr.exe

    C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe

    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PsImSvc.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PskSvc.exe

    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\pavsrvx86.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\AVENGINE.EXE

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\dllhost.exe

    C:\WINDOWS\system32\wbem\wmiapsrv.exe

    C:\Program Files\Panda Security\Panda Antivirus Pro 2012\ApVxdWin.exe

    C:\WINDOWS\ehome\ehtray.exe

    C:\WINDOWS\AGRSMMSG.exe

    C:\WINDOWS\eHome\ehmsas.exe

    C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

    C:\WINDOWS\RTHDCPL.EXE

    C:\Program Files\Realtek\InstallShield\AzMixerSel.exe

    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

    C:\Acer\Empowering Technology\ePresentation\ePresentation.exe

    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

    C:\Acer\Empowering Technology\ePower\ePower_DMC.exe

    C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE

    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

    C:\WINDOWS\system32\rundll32.exe

    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

    C:\Documents and Settings\Stéphanie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\WINDOWS\system32\wbem\unsecapp.exe

    C:\Program Files\Skype\Phone\Skype.exe

    C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe

    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe

    C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe

    C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe

    C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe

    C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

    C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

    C:\WINDOWS\system32\msiexec.exe

    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

    C:\Documents and Settings\Stéphanie\Bureaublad\mbam-setup-1.51.1.1800.exe

    C:\DOCUME~1\STÉPHA~1\LOCALS~1\Temp\is-IU8BV.tmp\mbam-setup-1.51.1.1800.tmp

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = De Standaard Online

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

    O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll

    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

    O4 - HKLM\..\Run: [LaunchApp] Alaunch

    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

    O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe

    O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

    O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe

    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0

    O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe

    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

    O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe

    O4 - HKLM\..\Run: [boot] C:\Acer\Empowering Technology\ePower\Boot.exe

    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE

    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

    O4 - HKLM\..\Run: [imageItEncrypt] C:\WINDOWS\system32\ImageItEncrypt.exe

    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

    O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

    O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

    O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

    O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Antivirus Pro 2012\APVXDWIN.EXE" /s

    O4 - HKLM\..\Run: [sCANINICIO] "C:\Program Files\Panda Security\Panda Antivirus Pro 2012\Inicio.exe"

    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Stéphanie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')

    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')

    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

    O4 - Startup: Microsoft Office Outlook.lnk = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE

    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

    O4 - Global Startup: Acer Empowering Technology.lnk = ?

    O4 - Global Startup: McAfee Security Scan Plus.lnk = ?

    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

    O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

    O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

    O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

    O23 - Service: Adobe Active File Monitor V9 (AdobeActiveFileMonitor9.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

    O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

    O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PsCtrls.exe

    O23 - Service: Panda Function Service (PAVFNSVR) - Unknown owner - C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PavFnSvr.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe

    O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2012\pavsrvx86.exe

    O23 - Service: Planner voor Automatische LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PsImSvc.exe

    O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2012\PskSvc.exe

    O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

    O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2012\TPSrv.exe

    --

    End of file - 14150 bytes

    Malwarebytes' Anti-Malware 1.51.2.1300

    Malwarebytes : Free anti-malware, anti-virus and spyware removal download

    Databaseversie: 7973

    Windows 5.1.2600 Service Pack 3

    Internet Explorer 7.0.5730.13

    18/10/2011 17:00:15

    mbam-log-2011-10-18 (17-00-15).txt

    Scantype: Snelle scan

    Objecten gescand: 199732

    Verstreken tijd: 15 minuut/minuten, 8 seconde(n)

    Geheugenprocessen geïnfecteerd: 0

    Geheugenmodulen geïnfecteerd: 0

    Registersleutels geïnfecteerd: 0

    Registerwaarden geïnfecteerd: 0

    Registerdata geïnfecteerd: 2

    Mappen geïnfecteerd: 0

    Bestanden geïnfecteerd: 0

    Geheugenprocessen geïnfecteerd:

    (Geen kwaadaardige objecten gedetecteerd)

    Geheugenmodulen geïnfecteerd:

    (Geen kwaadaardige objecten gedetecteerd)

    Registersleutels geïnfecteerd:

    (Geen kwaadaardige objecten gedetecteerd)

    Registerwaarden geïnfecteerd:

    (Geen kwaadaardige objecten gedetecteerd)

    Registerdata geïnfecteerd:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Mappen geïnfecteerd:

    (Geen kwaadaardige objecten gedetecteerd)

    Bestanden geïnfecteerd:

    (Geen kwaadaardige objecten gedetecteerd)

    controle, want ik denk dat er iets fout op zit

    in Archief Bestrijding malware & virussen

    Geplaatst:

    Ziezo, uiteindelijk is het dan toch gelukt.

    ComboFix 11-09-29.06 - Vincent 30/09/2011 18:59:39.3.2 - x64 MINIMAL

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.32.1043.18.4061.2938 [GMT 2:00]

    Gestart vanuit: c:\users\Vincent\Desktop\ComboFix.exe

    AV: Panda Global Protection 2012 *Enabled/Updated* {86971480-9989-6750-B122-681A86518D59}

    FW: Panda Personal Firewall 2012 *Enabled* {BEAC95A5-D3E6-6608-9A7D-C12F7882CA22}

    SP: Panda Global Protection 2012 *Enabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4}

    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    * Nieuw herstelpunt werd aangemaakt

    .

    .

    (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    ---- Voorgaande Run -------

    .

    c:\users\Vincent\AppData\Roaming\Roaming\Quest3D\ShipSimExtreme\channels.lst

    c:\windows\SysWow64\systeminfo3.dll

    .

    .

    (((((((((((((((((((( Bestanden Gemaakt van 2011-08-28 to 2011-09-30 ))))))))))))))))))))))))))))))

    .

    .

    2011-09-30 17:04 . 2011-09-30 17:04 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

    2011-09-30 17:04 . 2011-09-30 17:04 -------- d-----w- c:\users\Default\AppData\Local\temp

    2011-09-30 14:41 . 2011-09-21 07:00 9049936 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9B70E3B5-BB7C-4005-AAEF-287CDE8D61A3}\mpengine.dll

    2011-09-28 18:17 . 2011-09-28 18:17 -------- d-----w- c:\users\Vincent\AppData\Roaming\Anthropics

    2011-09-28 18:16 . 2011-09-28 18:17 -------- d-----w- c:\program files (x86)\Portrait Professional 10 Trial

    2011-09-27 16:42 . 2011-09-27 16:42 -------- d-----w- c:\users\Vincent\AppData\Roaming\JCreator

    2011-09-27 16:42 . 2011-09-27 16:42 -------- d-----w- c:\programdata\JCreator

    2011-09-27 16:41 . 2011-09-27 16:41 -------- d-----w- c:\program files (x86)\Xinox Software

    2011-09-27 15:42 . 2011-09-27 15:48 -------- d-----w- c:\program files (x86)\Google

    2011-09-25 18:52 . 2011-09-25 18:52 -------- d-----w- c:\windows\FltMgr

    2011-09-25 18:52 . 2011-09-25 18:52 -------- d-----w- c:\users\Vincent\AppData\Local\BeAnywhere_Drive

    2011-09-25 18:50 . 2011-09-25 18:50 -------- d-----w- c:\users\Vincent\AppData\Local\Panda Security

    2011-09-25 18:45 . 2011-09-25 18:45 15928 ----a-w- c:\windows\system32\drivers\COMFiltr.sys

    2011-09-25 18:45 . 2010-09-09 14:23 78920 ----a-w- c:\windows\system32\drivers\idsflt64.sys

    2011-09-25 18:45 . 2009-09-25 12:54 74760 ----a-w- c:\windows\system32\drivers\wnmflt64.sys

    2011-09-25 18:45 . 2009-09-25 12:54 82952 ----a-w- c:\windows\system32\drivers\dsaflt64.sys

    2011-09-25 18:43 . 2005-04-03 21:02 753664 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll

    2011-09-25 18:43 . 2005-04-03 21:02 69714 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll

    2011-09-25 18:43 . 2005-04-03 21:01 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll

    2011-09-25 18:43 . 2005-04-03 21:00 184320 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll

    2011-09-25 18:43 . 2005-04-03 21:00 63488 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe

    2011-09-25 18:43 . 2005-04-03 20:59 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe

    2011-09-25 18:43 . 2005-04-03 20:57 32768 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\Objectps.dll

    2011-09-25 18:41 . 2011-09-25 18:41 200836 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll

    2011-09-25 18:41 . 2011-09-25 18:41 331908 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll

    2011-09-25 18:41 . 2011-09-25 18:41 -------- d-----w- c:\program files (x86)\Common Files\Panda Security

    2011-09-25 18:41 . 2009-10-27 10:07 48136 ----a-w- c:\windows\system32\drivers\ShldFlt.sys

    2011-09-25 13:56 . 2011-09-25 13:56 -------- d-----w- c:\program files (x86)\Apple Software Update

    2011-09-23 16:28 . 2011-09-26 17:42 -------- d-----w- c:\users\Vincent\AppData\Local\VMware

    2011-09-23 16:28 . 2011-09-28 15:11 -------- d-----w- c:\users\Vincent\AppData\Roaming\VMware

    2011-09-23 16:23 . 2011-09-28 15:15 -------- d-----w- c:\programdata\VMware

    2011-09-22 19:25 . 2011-09-22 19:26 -------- d-----w- c:\program files (x86)\Windows Live Safety Center

    2011-09-18 10:22 . 2011-09-18 10:22 -------- d-----w- c:\program files\COMODO

    2011-09-17 17:16 . 2011-09-17 17:16 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

    2011-09-17 17:14 . 2011-09-17 17:16 -------- d-----w- c:\programdata\Comodo

    2011-09-17 17:13 . 2011-09-17 17:14 -------- d-----w- c:\programdata\Comodo Downloader

    2011-09-17 17:13 . 2011-09-18 08:53 -------- d-----w- c:\programdata\Lavasoft

    2011-09-14 15:25 . 2011-09-14 15:25 -------- d-----w- c:\program files (x86)\Common Files\Java

    2011-09-14 13:28 . 2011-09-14 13:28 -------- d-----w- c:\program files (x86)\Microsoft

    2011-09-14 13:28 . 2011-09-14 13:28 -------- d-----w- c:\program files (x86)\Windows Live SkyDrive

    2011-09-14 13:28 . 2011-09-14 13:28 -------- d-----w- c:\program files (x86)\Windows Live

    2011-09-14 13:27 . 2011-09-14 13:27 -------- d-----w- c:\windows\PCHEALTH

    2011-09-13 18:18 . 2011-09-28 15:37 -------- d-----w- c:\users\Vincent\AppData\Local\Eclipse

    2011-09-13 18:18 . 2011-09-13 18:46 -------- d-----w- c:\users\Vincent\workspace

    2011-09-13 18:15 . 2011-09-13 18:15 627600 ----a-w- c:\windows\system32\deployJava1.dll

    2011-09-13 18:14 . 2011-09-14 15:15 -------- d-----w- c:\program files\Java

    2011-09-04 11:46 . 2010-04-27 02:25 18944 ----a-w- c:\windows\system32\drivers\ss_bmdfl.sys

    2011-09-04 11:46 . 2010-04-27 02:25 161280 ----a-w- c:\windows\system32\drivers\ss_bmdm.sys

    2011-09-04 11:41 . 2011-09-04 11:41 -------- d-----w- c:\users\Vincent\AppData\Local\Downloaded Installations

    .

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2011-09-26 18:42 . 2011-07-29 22:43 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2011-09-14 15:20 . 2011-05-11 16:15 544656 ----a-w- c:\windows\SysWow64\deployJava1.dll

    2011-08-31 15:00 . 2011-06-01 22:11 25416 ----a-w- c:\windows\system32\drivers\mbam.sys

    2011-08-16 22:27 . 2011-08-16 13:43 93696 ----a-w- c:\users\Vincent\AppData\Roaming\ezpinst.exe

    2011-08-16 22:27 . 2011-07-11 15:55 82048 ----a-w- c:\users\Vincent\AppData\Roaming\pcouffin.sys

    2011-08-03 11:50 . 2011-08-09 21:19 980072 ----a-w- c:\windows\system32\nvvsvc.exe

    2011-08-03 11:50 . 2011-08-09 21:19 61544 ----a-w- c:\windows\system32\nvshext.dll

    2011-08-03 11:50 . 2011-08-09 21:19 335976 ----a-w- c:\windows\system32\nvhotkey.dll

    2011-08-03 11:50 . 2011-08-09 21:19 3021416 ----a-w- c:\windows\system32\nvsvc64.dll

    2011-08-03 11:50 . 2011-08-09 21:19 2560616 ----a-w- c:\windows\system32\nvsvcr.dll

    2011-08-03 11:50 . 2011-08-09 21:19 836200 ----a-w- c:\windows\system32\easyupdatusapiu64.dll

    2011-08-03 11:50 . 2011-08-09 21:19 6136936 ----a-w- c:\windows\system32\nvcpl.dll

    2011-08-03 11:50 . 2011-08-09 21:19 117864 ----a-w- c:\windows\system32\nvmctray.dll

    2011-08-03 11:50 . 2011-08-09 21:14 8355944 ----a-w- c:\windows\system32\nvwgf2umx.dll

    2011-08-03 11:50 . 2011-08-09 21:14 7254632 ----a-w- c:\windows\system32\nvcuda.dll

    2011-08-03 11:50 . 2011-08-09 21:14 67176 ----a-w- c:\windows\system32\OpenCL.dll

    2011-08-03 11:50 . 2011-08-09 21:14 6613096 ----a-w- c:\windows\SysWow64\nvwgf2um.dll

    2011-08-03 11:50 . 2011-08-09 21:14 57960 ----a-w- c:\windows\SysWow64\OpenCL.dll

    2011-08-03 11:50 . 2011-08-09 21:14 5404776 ----a-w- c:\windows\SysWow64\nvcuda.dll

    2011-08-03 11:50 . 2011-08-09 21:14 2758760 ----a-w- c:\windows\system32\nvapi64.dll

    2011-08-03 11:50 . 2011-08-09 21:14 2532456 ----a-w- c:\windows\system32\nvcuvid.dll

    2011-08-03 11:50 . 2011-08-09 21:14 24692840 ----a-w- c:\windows\system32\nvcompiler.dll

    2011-08-03 11:50 . 2011-08-09 21:14 2412136 ----a-w- c:\windows\SysWow64\nvapi.dll

    2011-08-03 11:50 . 2011-08-09 21:14 2391656 ----a-w- c:\windows\SysWow64\nvcuvid.dll

    2011-08-03 11:50 . 2011-08-09 21:14 22470248 ----a-w- c:\windows\system32\nvoglv64.dll

    2011-08-03 11:50 . 2011-08-09 21:14 2222184 ----a-w- c:\windows\system32\nvcuvenc.dll

    2011-08-03 11:50 . 2011-08-09 21:14 2090088 ----a-w- c:\windows\SysWow64\nvcuvenc.dll

    2011-08-03 11:50 . 2011-08-09 21:14 17193576 ----a-w- c:\windows\SysWow64\nvcompiler.dll

    2011-08-03 11:50 . 2011-08-09 21:14 16595560 ----a-w- c:\windows\SysWow64\nvoglv32.dll

    2011-08-03 11:50 . 2011-08-09 21:14 1519720 ----a-w- c:\windows\system32\nvdispco64.dll

    2011-08-03 11:50 . 2011-08-09 21:14 15064168 ----a-w- c:\windows\system32\nvd3dumx.dll

    2011-08-03 11:50 . 2011-08-09 21:14 1453160 ----a-w- c:\windows\system32\nvgenco64.dll

    2011-08-03 11:50 . 2011-08-09 21:14 12909672 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys

    2011-08-03 11:50 . 2011-08-09 21:14 12636776 ----a-w- c:\windows\SysWow64\nvd3dum.dll

    2011-07-22 05:22 . 2011-08-16 11:08 1638912 ----a-w- c:\windows\system32\mshtml.tlb

    2011-07-22 04:54 . 2011-08-16 11:08 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb

    2011-07-21 10:19 . 2011-07-21 10:19 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll

    2011-07-21 10:19 . 2011-07-21 10:19 704320 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

    2011-07-16 05:41 . 2011-08-11 10:06 362496 ----a-w- c:\windows\system32\wow64win.dll

    2011-07-16 05:41 . 2011-08-11 10:06 243200 ----a-w- c:\windows\system32\wow64.dll

    2011-07-16 05:41 . 2011-08-11 10:06 13312 ----a-w- c:\windows\system32\wow64cpu.dll

    2011-07-16 05:39 . 2011-08-11 10:06 16384 ----a-w- c:\windows\system32\ntvdm64.dll

    2011-07-16 05:37 . 2011-08-11 10:06 421888 ----a-w- c:\windows\system32\KernelBase.dll

    2011-07-16 05:21 . 2011-08-11 10:06 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll

    2011-07-16 05:21 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll

    2011-07-16 04:29 . 2011-08-11 10:06 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll

    2011-07-16 04:26 . 2011-08-11 10:06 44032 ----a-w- c:\windows\apppatch\acwow64.dll

    2011-07-16 04:25 . 2011-08-11 10:06 25600 ----a-w- c:\windows\SysWow64\setup16.exe

    2011-07-16 04:24 . 2011-08-11 10:06 5120 ----a-w- c:\windows\SysWow64\wow32.dll

    2011-07-16 04:24 . 2011-08-11 10:06 272384 ----a-w- c:\windows\SysWow64\KernelBase.dll

    2011-07-16 04:15 . 2011-08-11 10:06 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 5120 ---ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll

    2011-07-16 04:15 . 2011-08-11 10:06 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll

    .

    .

    ((((((((((((((((((((((((((((( SnapShot@2011-09-30_16.49.37 )))))))))))))))))))))))))))))))))))))))))

    .

    - 2009-07-14 04:54 . 2011-09-30 15:48 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

    + 2009-07-14 04:54 . 2011-09-30 16:54 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

    + 2009-07-14 04:54 . 2011-09-30 16:54 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

    - 2009-07-14 04:54 . 2011-09-30 15:48 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

    - 2009-07-14 04:54 . 2011-09-30 15:48 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

    + 2009-07-14 04:54 . 2011-09-30 16:54 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

    + 2011-05-10 19:43 . 2011-09-30 16:56 53400 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin

    - 2009-07-14 05:10 . 2011-09-30 14:39 44892 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

    + 2009-07-14 05:10 . 2011-09-30 16:56 44892 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

    - 2011-05-10 16:57 . 2011-09-30 14:36 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

    + 2011-05-10 16:57 . 2011-09-30 16:54 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

    + 2011-05-10 16:57 . 2011-09-30 16:54 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

    - 2011-05-10 16:57 . 2011-09-30 14:36 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

    - 2009-07-14 04:54 . 2011-09-30 14:36 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

    + 2009-07-14 04:54 . 2011-09-30 16:54 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

    + 2011-09-30 17:05 . 2011-09-30 17:05 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

    - 2011-09-30 16:49 . 2011-09-30 16:49 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

    + 2011-09-30 17:05 . 2011-09-30 17:05 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

    - 2011-09-30 16:49 . 2011-09-30 16:49 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

    + 2011-09-25 18:45 . 2011-09-30 16:56 299508 c:\windows\system32\drivers\APPFCONT.DAT

    .

    ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "NPSStartup"="" [bU]

    "APVXDWIN"="c:\program files (x86)\Panda Security\Panda Global Protection 2012\APVXDWIN.EXE" [2011-04-13 1000768]

    "SCANINICIO"="c:\program files (x86)\Panda Security\Panda Global Protection 2012\Inicio.exe" [2011-02-02 70464]

    "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorAdmin"= 5 (0x5)

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

    "aux6"=wdmaud.drv

    .

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]

    @="Service"

    .

    R0 pavboot;Panda boot driver;c:\windows\system32\Drivers\pavboot64.sys [x]

    R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]

    R1 ShldFlt;Panda File Shield Driver;c:\windows\system32\DRIVERS\ShldFlt.sys [x]

    R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

    R2 AmFSM;AmFSM;c:\windows\system32\DRIVERS\amm6460.sys [x]

    R2 APPFLT;App Filter Plugin;c:\windows\system32\Drivers\APPFLT64.SYS [x]

    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R2 ComFiltr;Panda Anti-Dialer;c:\windows\system32\DRIVERS\COMFiltr.sys [x]

    R2 DSAFLT;DSA Filter Plugin;c:\windows\system32\Drivers\DSAFLT64.SYS [x]

    R2 FNETMON;NetMon Filter Plugin;c:\windows\system32\Drivers\fnetm64.SYS [x]

    R2 gupdate;Google Update-service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-27 136176]

    R2 IDSFLT;Ids Filter Plugin;c:\windows\system32\Drivers\IDSFLT64.SYS [x]

    R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]

    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe [2011-08-10 102608]

    R2 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\Drivers\NETTDI64.SYS [x]

    R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]

    R2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-30 2358656]

    R2 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\Drivers\WNMFLT64.SYS [x]

    R3 cpuz134;cpuz134;c:\program files (x86)\CPUID\PC Wizard 2010\pcwiz_x64.sys [2010-07-09 21480]

    R3 cpuz135;cpuz135;c:\users\Vincent\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [x]

    R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2011-03-01 130976]

    R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-27 136176]

    R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [x]

    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

    R3 NETIMFLT01060044;PANDA NDIS IM Filter Miniport v1.6.0.44;c:\windows\system32\DRIVERS\n64i1644.sys [x]

    R3 NETw5s64;Intel® Wireless WiFi Link adapter stuurprogramma onder Windows 7 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]

    R3 PavTPK.sys;PavTPK.sys;c:\windows\system32\PavTPK.sys [x]

    R3 Prot6Flt;Prot6Flt;c:\windows\system32\DRIVERS\Prot6Flt.sys [x]

    R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [x]

    R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [x]

    R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [x]

    R3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [x]

    R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448]

    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

    R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

    R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]

    S2 PskSvcRetail;Panda PSK service;c:\program files (x86)\Panda Security\Panda Global Protection 2012\PskSvc.exe [2010-08-16 28992]

    .

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]

    2010-11-20 12:17 302592 ----a-w- c:\windows\System32\cmd.exe

    .

    Inhoud van de 'Gedeelde Taken' map

    .

    2011-09-26 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3298084785-2284596892-1478273361-1000Core.job

    - c:\users\Vincent\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-07-09 11:44]

    .

    2011-09-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3298084785-2284596892-1478273361-1000UA.job

    - c:\users\Vincent\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-07-09 11:44]

    .

    2011-09-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-27 15:42]

    .

    2011-09-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-27 15:42]

    .

    2011-09-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3298084785-2284596892-1478273361-1000Core.job

    - c:\users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-11 16:10]

    .

    2011-09-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3298084785-2284596892-1478273361-1000UA.job

    - c:\users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-11 16:10]

    .

    .

    --------- x86-64 -----------

    .

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

    "LoadAppInit_DLLs"=0x1

    .

    ------- Bijkomende Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    uStart Page = hxxp://www.google.be/

    mLocal Page = c:\windows\SysWOW64\blank.htm

    TCP: DhcpNameServer = 192.168.1.1

    .

    .

    ------- Bestandsassociaties -------

    .

    JSEFile=c:\progra~2\PANDAS~1\PANDAG~1\PAVSCRIP.EXE "%1" %*

    .

    - - - - ORPHANS VERWIJDERD - - - -

    .

    WebBrowser-{942CD1D4-9CC1-4D31-876A-EA8F489F7A59} - (no file)

    .

    .

    .

    --------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.10"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker4"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    Voltooingstijd: 2011-09-30 19:09:07 - machine werd herstart

    ComboFix-quarantined-files.txt 2011-09-30 17:09

    .

    Pre-Run: 351.335.784.448 bytes beschikbaar

    Post-Run: 351.015.395.328 bytes beschikbaar

    .

    - - End Of File - - D4CFB70023440262B7974B9B5A3F0F87

    controle, want ik denk dat er iets fout op zit

    in Archief Bestrijding malware & virussen

    Geplaatst:

    toch een klein vraagje: waarom fix je die 1e twee items?

    ---------- Post toegevoegd om 16:17 ---------- Vorige post was om 16:15 ----------

    Logfile of Trend Micro HijackThis v2.0.4

    Scan saved at 16:16:46, on 28/09/2011

    Platform: Windows 7 SP1 (WinNT 6.00.3505)

    MSIE: Internet Explorer v8.00 (8.00.7601.17514)

    Boot mode: Normal

    Running processes:

    C:\PROGRAM FILES (X86)\PANDA SECURITY\PANDA GLOBAL PROTECTION 2012\WebProxy.exe

    C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\ApVxdWin.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\PavBckPT.exe

    C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

    C:\Windows\SysWOW64\DllHost.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

    O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

    O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\APVXDWIN.EXE" /s

    O4 - HKLM\..\Run: [sCANINICIO] "C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\Inicio.exe"

    O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

    O4 - HKUS\S-1-5-21-3298084785-2284596892-1478273361-1004\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')

    O4 - HKUS\S-1-5-21-3298084785-2284596892-1478273361-1004\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')

    O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

    O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL

    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

    O10 - Unknown file in Winsock LSP: c:\program files (x86)\vmware\vmware player\vsocklib.dll

    O10 - Unknown file in Winsock LSP: c:\program files (x86)\vmware\vmware player\vsocklib.dll

    O15 - ESC Trusted Zone: http://*.update.microsoft.com

    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

    O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

    O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

    O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe

    O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

    O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe

    O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

    O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe

    O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

    O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

    O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

    O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\PsCtrls.exe

    O23 - Service: Panda Function Service (PAVFNSVR) - Unknown owner - C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\PavFnSvr.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files (x86)\Common Files\Panda Security\PavShld\pavprsrv.exe

    O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\pavsrvx86.exe

    O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: Panda Host Service (PSHost) - Unknown owner - c:\program files (x86)\panda security\panda global protection 2012\firewall\PSHOST.EXE

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\PsImSvc.exe

    O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\PskSvc.exe

    O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

    O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

    O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

    O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

    O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe

    O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\TPSrvWow.exe

    O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Player\vmware-ufad.exe

    O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe

    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe

    O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe

    O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

    O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

    O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

    O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

    O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

    --

    End of file - 10337 bytes

    nieuwe log :)

    controle, want ik denk dat er iets fout op zit

    in Archief Bestrijding malware & virussen

    Geplaatst:

    Beste specialisten,

    Ik zou graag m'n systeem eens helemaal schoonmaken want volgens mij zit er iets verdachts op. Ik heb sinds een week namelijk erg veel last dat alles gewoon blokkeert. Ook het opstarten verloopt erg moeizaam, en het duurt lang voor ik wat kan doen als ik opstart. Mijn zus zou ook Panda Antivirus willen aanschaffen. Ook graag daar zou ik jullie mening over willen. het gaat over de betalende versie. Aangezien ik zelf de HJT opleiding volg zou ik ook graag weten welke stappen jullie ondernemen en waarom. Bijvoorbeeld waarom jullie een hjt regel fixen. (opzoeklink van bvb systemlookup.com is genoeg hoor.)

    Hier enkele logjes:

    Logfile of Trend Micro HijackThis v2.0.4

    Scan saved at 17:53:27, on 27/09/2011

    Platform: Windows 7 SP1 (WinNT 6.00.3505)

    MSIE: Internet Explorer v8.00 (8.00.7601.17514)

    Boot mode: Normal

    Running processes:

    C:\PROGRAM FILES (X86)\PANDA SECURITY\PANDA GLOBAL PROTECTION 2012\WebProxy.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    C:\Program Files (x86)\VMware\VMware Player\hqtray.exe

    C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\ApVxdWin.exe

    C:\Users\Vincent\AppData\Local\Google\Chrome\Application\chrome.exe

    C:\Users\Vincent\AppData\Local\Google\Chrome\Application\chrome.exe

    C:\Users\Vincent\AppData\Local\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\PavBckPT.exe

    C:\Users\Vincent\AppData\Local\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

    O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

    O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

    O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files (x86)\VMware\VMware Player\hqtray.exe"

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

    O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\APVXDWIN.EXE" /s

    O4 - HKLM\..\Run: [sCANINICIO] "C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\Inicio.exe"

    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

    O4 - HKCU\..\Run: [Google Update] "C:\Users\Vincent\AppData\Local\Google\Update\GoogleUpdate.exe" /c

    O4 - HKUS\S-1-5-21-3298084785-2284596892-1478273361-1004\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')

    O4 - HKUS\S-1-5-21-3298084785-2284596892-1478273361-1004\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')

    O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

    O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (file missing)

    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

    O10 - Unknown file in Winsock LSP: c:\program files (x86)\vmware\vmware player\vsocklib.dll

    O10 - Unknown file in Winsock LSP: c:\program files (x86)\vmware\vmware player\vsocklib.dll

    O15 - ESC Trusted Zone: http://*.update.microsoft.com

    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

    O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll

    O20 - AppInit_DLLs:

    O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

    O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe

    O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

    O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe

    O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

    O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe

    O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

    O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

    O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

    O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\PsCtrls.exe

    O23 - Service: Panda Function Service (PAVFNSVR) - Unknown owner - C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\PavFnSvr.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files (x86)\Common Files\Panda Security\PavShld\pavprsrv.exe

    O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\pavsrvx86.exe

    O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: Panda Host Service (PSHost) - Unknown owner - c:\program files (x86)\panda security\panda global protection 2012\firewall\PSHOST.EXE

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\PsImSvc.exe

    O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\PskSvc.exe

    O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

    O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

    O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

    O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

    O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe

    O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files (x86)\Panda Security\Panda Global Protection 2012\TPSrvWow.exe

    O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Player\vmware-ufad.exe

    O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe

    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe

    O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe

    O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

    O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

    O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

    O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

    O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

    --

    End of file - 11287 bytes

    Malwarebytes' Anti-Malware 1.51.2.1300

    Malwarebytes : Free anti-malware, anti-virus and spyware removal download

    Databaseversie: 7809

    Windows 6.1.7601 Service Pack 1

    Internet Explorer 8.0.7601.17514

    27/09/2011 18:06:29

    mbam-log-2011-09-27 (18-06-29).txt

    Scantype: Snelle scan

    Objecten gescand: 285218

    Verstreken tijd: 11 minuut/minuten, 13 seconde(n)

    Geheugenprocessen geïnfecteerd: 0

    Geheugenmodulen geïnfecteerd: 0

    Registersleutels geïnfecteerd: 0

    Registerwaarden geïnfecteerd: 0

    Registerdata geïnfecteerd: 0

    Mappen geïnfecteerd: 0

    Bestanden geïnfecteerd: 0

    Geheugenprocessen geïnfecteerd:

    (Geen kwaadaardige objecten gedetecteerd)

    Geheugenmodulen geïnfecteerd:

    (Geen kwaadaardige objecten gedetecteerd)

    Registersleutels geïnfecteerd:

    (Geen kwaadaardige objecten gedetecteerd)

    Registerwaarden geïnfecteerd:

    (Geen kwaadaardige objecten gedetecteerd)

    Registerdata geïnfecteerd:

    (Geen kwaadaardige objecten gedetecteerd)

    Mappen geïnfecteerd:

    (Geen kwaadaardige objecten gedetecteerd)

    Bestanden geïnfecteerd:

    (Geen kwaadaardige objecten gedetecteerd)

    Alvast bedankt,

    Vincent

    Computer geeft foutmeldingen, kan HJT niet openen, ...

    in Archief Bestrijding malware & virussen

    Geplaatst:

    Hoi,

    de pc van een vriend van mij heeft kuren. Hij vertelde me wat er aan de had was en ik zei dat ik er eens naar ging kijken. Binnen 2 weken gaat hij zijn pc een weekendje aan mij geven zodat ik hem eens grondig kan bekijken.

    Maar nu gistere wilde ik een HJT log maken van zijn pc via teamviewer, maar hij kreeg een foutmelding bij het openen van HJT , en ik krijg het programma dus ook niet meer open. Herinstalleren lukte ook al niet, want dan kwam hij zelfs niet door de installatie heen, want daarin kreeg ik ook al een foutmelding (weet niet meer van buite welke). Is er een manier hoe ik alsnog HJT kan openen en een log maken? Ook in veilige modus krijg ik de HJT foutmelding, maar nu staat er dus geen HJT meer op.

    Grtz,

    Vincent

    Ask.com

    in Archief Windows Algemeen

    Geplaatst:

    Ja die is er:

    Ga naar start, en klik op uitvoeren. Daar typt u "msconfig" in. Dan gaat u naar het tablad "computer opstarten" en dan vinkt u "veilige modus" en "minimaal" aan. Nu herstart u de pc. Wanneer u in veilige modus gedaan hebt wat de experts gevraagd hebben, gaat u terug naar msconfig en vinkt u veilige modus weer uit en herstart u weer :)

    PC opkuisen

    in Archief Bestrijding malware & virussen

    Geplaatst:

    De HJT specialisten zijn verwittigd, zij zullen je logje nakijken.

    Je zou voor de MMAB nog eens moeten scannen en deze keer op 2 dingen letten:

    - Doe een volledige scan (mss vindt het programma nog meer malware)

    - Ga naar het quarantaine tablad in MMAB zelf en verwijder de gevonden malware, want nu staat er No action taken wat betekent dat je pc nog steeds geinfecteerd is.

    Let op:

    indien MMAB vraagt de pc te herstarten, sta dit dan toe. Sommige infecties kunnen echter maar verwijdert worden bij een heropstart

    trage flaptop, geen combofix mogelijk..

    in Archief Windows Algemeen

    Geplaatst: · aangepast door doedelzak123

    1. Download HijackThis. (klik erop)

    Klik bij "HijackThis Downloads" op "Installer".

    Bestand HijackThis.msi opslaan. Daarna kiezen voor "uitvoeren".

    Hijackthis wordt nu op je PC geïnstalleerd, een snelkoppeling wordt op je bureaublad geplaatst.

    Als je geen netwerkverbinding meer hebt, kan je de download doen met een andere pc en het bestand met een usb stick overbrengen

    Als je enkel nog in veilige modus kan werken, moet je de executable downloaden.

    Sla deze op in een nieuwe map op de C schijf (bvb C:\hijackthis) en start hijackthis dan vanaf deze map.

    De logjes kan je dan ook in die map terugvinden.

    2. Klik op de snelkoppeling om HijackThis te starten

    Klik ofwel op "Do a systemscan and save a logfile", ofwel eerst op "Scan" en dan op "Savelog".

    Er opent een kladblokvenster, hou gelijktijdig de CTRL en A-toets ingedrukt, nu is alles geselecteerd. Hou gelijktijdig de CTRL en C-toets ingedrukt, nu is alles gekopieerd. Plak nu het HJT logje in je bericht door CTRL en V-toets.

    Krijg je een melding ""For some reason your system denied writing to the Host file ....", klik dan gewoon door op de OK-toets.

    Let op : Windows Vista & 7 gebruikers dienen HijackThis als “administrator” uit te voeren via rechtermuisknop “als administrator uitvoeren". Indien dit via de snelkoppeling niet lukt voer je HijackThis als administrator uit in de volgende map : C:\Program Files\Trend Micro\HiJackThis of C:\Program Files (x86)\Trend Micro\HiJackThis. (Bekijk hier de afbeelding ---> Bijlage 12634)

    3. Na het plaatsen van je logje wordt dit door een expert (Kape of Kweezie Wabbit) nagekeken en begeleidt hij jou verder door het ganse proces.

    Daarna kan u dit eens doen:

    Download MBAM (Malwarebytes Anti-Malware)

    Dubbelklik op mbam-setup.exe om het programma te installeren.

    Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Start Malwarebytes' Anti-Malware, Klik daarna op "Voltooien".

    Indien een update gevonden werd, zal die gedownload en geïnstalleerd worden.

    Wanneer het programma volledig up to date is, selecteer dan in het tabblad Scanner : "Snelle Scan", daarna klik op Scan.

    Het scannen kan een tijdje duren, dus wees geduldig.

    Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.

    Zorg ervoor dat daar alles aangevinkt is, daarna klik op: Verwijder geselecteerde.

    Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie verder).

    Indien er de rootkit (TDSS) aanwezig is, zal MBAM vragen te herstarten. Doe dit dan ook.

    MBAM zal na de herstart opnieuw scannen en de rootkit verwijderen.

    Het log wordt automatisch bewaard door MBAM en kan je terugvinden door op de "Logs" tab te klikken in het programma.

    Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken. Daarna zal het vragen om de computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.

    Plak de inhoud van het logje in je volgende bericht.

    De tekstjes komen van Kape.

    Over die combofix: Het combofix bestandje is beschadigd. Verwijder combofix van je bureaublad en download hem opnieuw van de andere link.

Logo

OVER ONS

PC Helpforum helpt GRATIS computergebruikers sinds juli 2006. Ons team geeft via het forum professioneel antwoord op uw vragen en probeert uw pc problemen zo snel mogelijk op te lossen. Word lid vandaag, plaats je vraag online en het PC Helpforum-team helpt u graag verder!

SITEMAP

×
×
  • Nieuwe aanmaken...

Belangrijke informatie

We hebben cookies geplaatst op je toestel om deze website voor jou beter te kunnen maken. Je kunt de cookie instellingen aanpassen, anders gaan we er van uit dat het goed is om verder te gaan.