boekenwurmpje

23 juni 2012

Als ik google chrome opstart nog steeds die rotzooi van mystart en incredibar. In explorer en mozilla firefox blijkbaar niet meer. Wat nu??

23 juni 2012

Ik hoop dat het deze keer juist is. Bedankt voor je geduld.

ComboFix 12-06-23.05 - the incredibles 23/06/2012 19:56:49.5.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.3066.1993 [GMT 2:00]

Gestart vanuit: c:\users\the incredibles\Downloads\ComboFix.exe

gebruikte Opdracht switches :: c:\users\the incredibles\Desktop\CFScript.txt

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"C:\user.js"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Voorgaande Run -------

.

c:\program files\Web Assistant

c:\program files\Web Assistant\ExtensionUpdaterService.exe

c:\program files\Web Assistant\Firefox\chrome.manifest

c:\program files\Web Assistant\Firefox\chrome\content\libraries\DataExchangeScript.js

c:\program files\Web Assistant\Firefox\chrome\content\main.js

c:\program files\Web Assistant\Firefox\chrome\content\main.xul

c:\program files\Web Assistant\Firefox\chrome\content\resources\localscript.js

c:\program files\Web Assistant\Firefox\chrome\locale\en-US\overlay.dtd

c:\program files\Web Assistant\Firefox\chrome\skin\overlay.css

c:\program files\Web Assistant\Firefox\defaults\preferences\defaults.js

c:\program files\Web Assistant\Firefox\install.rdf

c:\program files\Web Assistant\InstallerHelper.dll

c:\program files\Web Assistant\libraries\DataExchangeScript.js

c:\program files\Web Assistant\resources\localscript.js

c:\program files\Web Assistant\source.crx

c:\program files\Web Assistant\unins000.dat

c:\program files\Web Assistant\unins000.exe

c:\users\the incredibles\AppData\Local\assembly\tmp

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_Web Assistant Updater

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-05-23 to 2012-06-23 ))))))))))))))))))))))))))))))

.

2012-06-23 18:05 . 2012-06-23 18:05 -------- d-----w- c:\users\the incredibles\AppData\Local\temp

2012-06-23 18:05 . 2012-06-23 18:05 -------- d-----w- c:\users\Saar\AppData\Local\temp

2012-06-23 18:05 . 2012-06-23 18:05 -------- d-----w- c:\users\Het bibliofieltje\AppData\Local\temp

2012-06-23 18:05 . 2012-06-23 18:05 -------- d-----w- c:\users\Gast\AppData\Local\temp

2012-06-23 18:05 . 2012-06-23 18:05 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-06-22 15:46 . 2012-06-22 15:46 388096 ----a-r- c:\users\the incredibles\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-06-22 15:46 . 2012-06-22 15:46 -------- d-----w- c:\program files\Trend Micro

2012-06-21 17:52 . 2012-06-21 17:52 -------- d-----w- c:\program files\Perion

2012-06-21 17:51 . 2012-06-21 17:51 455 ----a-w- C:\user.js

2012-06-21 08:21 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-21 08:21 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll

2012-06-21 08:21 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-06-21 08:21 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-21 08:20 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll

2012-06-21 08:20 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll

2012-06-21 08:20 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll

2012-06-21 08:20 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-21 08:20 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe

2012-06-20 18:33 . 2012-06-20 18:33 -------- d-----w- c:\users\the incredibles\AppData\Local\7D542E3C-0060-428B-A68A-FE80FDFA24DA.aplzod

2012-06-19 17:37 . 2012-06-19 17:37 -------- d-----w- c:\users\the incredibles\.config

2012-06-16 08:20 . 2012-06-16 08:20 -------- d-----w- c:\program files\iPod

2012-06-16 08:20 . 2012-06-16 08:21 -------- d-----w- c:\program files\iTunes

2012-06-13 12:36 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll

2012-06-13 12:36 . 2012-04-23 16:00 133120 ----a-w- c:\windows\system32\cryptsvc.dll

2012-06-13 12:36 . 2012-04-23 16:00 98304 ----a-w- c:\windows\system32\cryptnet.dll

2012-06-13 12:36 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-06-13 12:36 . 2012-05-15 19:51 2045440 ----a-w- c:\windows\system32\win32k.sys

2012-06-09 08:59 . 2012-06-09 08:59 -------- d-----w- c:\users\Saar\AppData\Local\AVG Secure Search

2012-06-08 17:24 . 2012-06-08 17:24 -------- d-----w- c:\program files\Dropbox

2012-06-08 13:02 . 2012-06-08 13:02 -------- d-----w- c:\program files\Mozilla Maintenance Service

2012-06-08 13:02 . 2012-06-01 15:37 157600 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe

2012-06-08 13:02 . 2012-06-01 15:37 113120 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe

2012-06-08 13:02 . 2012-06-01 15:36 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll

2012-06-08 13:02 . 2012-06-01 15:36 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll

2012-06-07 15:53 . 2012-06-07 15:53 -------- d-----w- c:\users\the incredibles\AppData\Local\AVG Secure Search

2012-06-07 15:53 . 2012-06-07 15:53 -------- d-----w- c:\program files\AVG Secure Search

2012-06-03 09:00 . 2012-06-03 09:00 -------- d-----w- c:\programdata\Downloaded Installations

2012-06-03 08:50 . 2012-06-03 08:50 -------- d-----w- c:\users\the incredibles\AppData\Local\Microsoft_Corporation

2012-06-03 08:48 . 2012-06-23 17:05 -------- d-----w- c:\users\the incredibles\AppData\Local\assembly

2012-05-31 15:32 . 2012-05-31 15:32 -------- d-----w- c:\users\the incredibles\AppData\Roaming\SingularLabs

2012-05-31 15:32 . 2012-05-31 15:32 -------- d-----w- c:\programdata\SingularLabs

2012-05-31 15:23 . 2012-06-22 15:32 -------- d-----w- c:\program files\System Ninja

2012-05-28 17:07 . 2012-05-28 17:07 -------- d-----w- c:\programdata\NCH Software

2012-05-28 17:07 . 2012-05-28 17:07 -------- d-----w- c:\program files\NCH Software

2012-05-28 17:07 . 2012-05-28 17:09 -------- d-----w- c:\users\the incredibles\AppData\Roaming\NCH Software

2012-05-25 15:37 . 2012-05-25 15:37 -------- d-----w- c:\users\the incredibles\AppData\Roaming\U3

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-23 13:55 . 2012-04-07 17:25 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-06-23 13:55 . 2011-05-17 15:47 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-04-19 05:43 . 2012-04-19 05:43 658512 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2012-04-19 02:50 . 2012-04-19 02:50 24896 ----a-w- c:\windows\system32\drivers\avgidshx.sys

2012-04-18 18:56 . 2012-04-18 18:56 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2012-04-18 18:56 . 2012-04-18 18:56 69632 ----a-w- c:\windows\system32\QuickTime.qts

2012-04-04 13:56 . 2011-02-16 14:16 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-04-03 08:16 . 2012-05-11 05:10 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe

2012-04-03 08:16 . 2012-05-11 05:10 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-03-30 12:39 . 2012-05-11 05:10 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys

2008-07-03 10:45 . 2012-02-29 14:38 826451 ----a-w- c:\program files\Rainbow Folders.exe

2003-03-21 12:45 . 2012-03-07 19:54 250544 ----a-w- c:\program files\Common Files\keyhelp.ocx

2012-06-01 15:38 . 2012-03-26 17:44 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2012-06-07 15:53 2068536 ----a-w- c:\program files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll" [2012-06-07 2068536]

.

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\users\the incredibles\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\users\the incredibles\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58 94208 ----a-w- c:\users\the incredibles\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2008-03-04 22:38 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Fun Desktop Wallpaper Changer"="c:\program files\Fun Desktop Wallpaper Changer\FunDesktopWallpaperChanger.exe" [2005-12-22 57344]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

"ApplePhotoStreams"="c:\program files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2012-02-24 59240]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-01-04 39408]

"beid"="c:\program files\Belgium Identity Card\beid35gui.exe" [2011-05-23 2068480]

"MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]

"iCloudServices"="c:\program files\Common Files\Apple\Internet Services\iCloudServices.exe" [2012-02-23 59240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2008-04-28 6111232]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2011-02-12 30192]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-28 13601312]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-28 92704]

"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-07-02 821768]

"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]

"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"Skytel"="Skytel.exe" [2007-11-20 1826816]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]

"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-06-07 1104440]

"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2011-12-20 296056]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]

.

c:\users\the incredibles\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\the incredibles\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]

2011-02-12 15:26 2972160 ----a-w- c:\program files\Acer\Acer Bio Protection\WinNotify.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart

.

[HKLM\~\startupfolder\C:^Users^the incredibles^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Mediacontrole Picture Motion Browser.lnk]

path=c:\users\the incredibles\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mediacontrole Picture Motion Browser.lnk

backup=c:\windows\pss\Mediacontrole Picture Motion Browser.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BkupTray]

2008-04-06 21:42 34040 ----a-w- c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eAudio]

2008-03-07 02:36 544768 ----a-w- c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]

2008-03-04 22:38 526896 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]

2008-04-23 14:58 397312 ----a-w- c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2012-06-07 17:33 421776 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2012-04-18 18:56 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reader Library Launcher]

2010-07-12 23:34 906648 ----a-w- c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]

2012-01-23 04:43 247728 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZPdtWzdVitaKey MC3000]

2011-02-12 15:26 3607040 ----a-w- c:\program files\Acer\Acer Bio Protection\PdtWzd.exe

.

R3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\DRIVERS\a38usb.sys [2011-06-04 35712]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056]

S0 Achernar;Achernar - SCSI Command Filter Drivers;c:\windows\System32\Drivers\Achernar.sys [2007-02-05 18432]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

bthsvcs REG_MULTI_SZ BthServ

.

Inhoud van de 'Gedeelde Taken' map

.

2012-06-23 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-07 13:55]

.

2012-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-13 11:19]

.

2012-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-13 11:19]

.

------- Bijkomende Scan -------

.

uDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://www.bigseekpro.com/pivotstickfigure/{48B68C7E-955E-4420-A793-48207D959DC4}

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Free YouTube Download - c:\users\the incredibles\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\the incredibles\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

TCP: DhcpNameServer = 195.130.131.4 195.130.130.132

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll

DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://foto.hema.be/ips-opdata/layout/hema/objects/jordan.cab

DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab

FF - ProfilePath - c:\users\the incredibles\AppData\Roaming\Mozilla\Firefox\Profiles\w5uk47l5.default\

FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B67cd24f5-7e37-4971-8fdf-350d1be35b9b%7D&mid=9e17da8a68da47d6bb09d16acdd3b184-3942aef76122b7e3ddf78a20352126407d07e2d5&ds=AVG&v=11.1.0.7〈=nl&pr=fr&d=2012-06-07%2017%3A53%3A08&sap=ku&q=

FF - prefs.js: network.proxy.type - 0

FF - user.js: extentions.y2layers.installId - e0989316-236f-4c0a-8010-7f289bf577a1

FF - user.js: extentions.y2layers.defaultEnableAppsList - bestvideodownloader,ezLooker,pagerage,buzzdock,toprelatedtopics,twittube

FF - user.js: extensions.autoDisableScopes - 14

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-06-23 20:05

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'Explorer.exe'(3160)

c:\users\the incredibles\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll

.

Voltooingstijd: 2012-06-23 20:07:21

ComboFix-quarantined-files.txt 2012-06-23 18:07

ComboFix2.txt 2012-06-23 16:18

ComboFix3.txt 2012-06-23 14:17

.

Pre-Run: 140.042.600.448 bytes beschikbaar

Post-Run: 140.008.361.984 bytes beschikbaar

.

- - End Of File - - DC003C1D365FC40363FF0B569DFDB291

23 juni 2012

Oké ik heb dat gedaan. Alweer bedankt voor de snelle reactie.

ComboFix 12-06-23.05 - the incredibles 23/06/2012 18:06:51.3.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.3066.1655 [GMT 2:00]

Gestart vanuit: c:\users\the incredibles\Downloads\ComboFix.exe

gebruikte Opdracht switches :: c:\users\the incredibles\Desktop\CFScript - Snelkoppeling.lnk

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\the incredibles\AppData\Local\assembly\tmp

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-05-23 to 2012-06-23 ))))))))))))))))))))))))))))))

.

2012-06-23 16:15 . 2012-06-23 16:15 -------- d-----w- c:\users\Saar\AppData\Local\temp

2012-06-23 16:15 . 2012-06-23 16:15 -------- d-----w- c:\users\Het bibliofieltje\AppData\Local\temp

2012-06-23 16:15 . 2012-06-23 16:15 -------- d-----w- c:\users\Gast\AppData\Local\temp

2012-06-23 16:15 . 2012-06-23 16:15 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-06-23 14:17 . 2012-06-23 16:15 -------- d-----w- c:\users\the incredibles\AppData\Local\temp

2012-06-22 15:46 . 2012-06-22 15:46 388096 ----a-r- c:\users\the incredibles\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-06-22 15:46 . 2012-06-22 15:46 -------- d-----w- c:\program files\Trend Micro

2012-06-21 17:52 . 2012-06-21 17:52 -------- d-----w- c:\program files\Perion

2012-06-21 17:51 . 2012-06-21 17:51 455 ----a-w- C:\user.js

2012-06-21 17:51 . 2012-06-23 08:46 -------- d-----w- c:\program files\Web Assistant