issilyrin

Ik heb de servicepack 2 maal proberen downloaden maar hij download hem helemaal en daarna staat er mislukt, dus hij slaagt er niet in van hem helemaal te downloaden, waarom weet ik niet. Hier alvast het logje van Zoek.exe zoek-results.txt

Ahum, dit zou beter zichtbaar moeten zijn log.txt

Hier is het logbestandje! Ik heb al heel veel firefow proberen herinitialiseren. Groetjes Elke

Hoihoi! Wanneer ik op firefox bezig ben dan krijg ik heel vaak een zwart scherm. Alles blokkeerd en ik kan niet meer verder werken. Wanneer ik op Tor inlog is het probleem er vaak niet. Maar dat is nu eenmaal niet zo'n intressant programma om mee te werken. Het kan zijn dat mijn geheugen onvoldoende is maar ik vermoed dat er toch iets anders aan de hand is ook. Kunnen jullie mij helpen?

ja dat heb ik gedaan, maar als ik het open doe zegt photoviewer dat het bestand onleesbaar is of te groot. Avast herkent het ook direct weer als gevaar en zet het in de kluis

Nee, gewoon pc

Ja dat heb ik geprobeert maar als ik ze open om mijn foto's te zien wordt er een wordt bestand geopend met heel veel jibberisch

Het ziet er naar uit dat de problemen opgelosd zijn in de computer. Een dikke dankuwel daarvoor! Mijn fototoestel heeft echter nog hetzelfde probleem gezien die niet meegekuisd was en daar was het probleem begonnen. Diezelfde worm is gedetecteerd op in het DCIM en DBfiles bestand in als ik deze aansluit op de pc. Mijn Avast programma heeft ze proberen isoleren in de viruschest maar nu geraak ik niet meer bij mijn foto's op mijn camera gezien mijn DCIM file weg is. Ik heb proberen die files er terug op te zetten, maar ze worden herkent als Autocad files. Ze hebben een scr extentie. Zou het mogelijk zijn mij hier mee te helpen? Er zitten massas belangrijke foto's op de camera en het zou erg zijn dat ik ze er niet meer van kan halen. Als ik in mijn fototoestel zelf kijk dan kan ik de foto's nog steeds bezichtigen, ik kan ze echter niet meer op mijn pc zetten.

neen, bedankt you're great

hoi had de s0 bestand en een s1 bestand die recenter was. heb ze bijde doorgestuurd. AdwCleaner[S0].txt AdwCleaner[S1].txt

Zo da's deze: [ATTACH]36477[/ATTACH] Alstublieft!! zoek-results.txt

Ok, dat is gelukt: [ATTACH]36215[/ATTACH] log.txt

Hoi, Wanneer ik mijn usb stick open deed waren al de mapjes niet te openen en het type was beschreven als een autocad file. Wanneer ik dit bestand open opent het in notepad. Daarna gebeurde hetzelfde wanneer ik foto's probeerde te halen uit mijn fototoestel. Alle mappen waren ook niet te bezichtigen terwijl ze vol met foto's zitten. Volgens Avast! is het een worm en avast kan het enkel verwijderen, maar dan zijn de foto' s weg en ik hoopte dat ik ze kon redden. En mijn usb en fototoestel terug gebruiken. Kunnen jullie mij helpen? Groeten Elke

Alles werkt weer perfect!!! Heel erg bedankt PC Helpforum!!!

# AdwCleaner v2.005 - Logfile created 10/23/2012 at 09:33:41 # Updated 14/10/2012 by Xplode # Operating system : Windows 7 Ultimate (32 bits) # User : Elke & Koen - OUDEPC # Boot Mode : Normal # Running from : C:\Users\Elke & Koen\Desktop\adwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml File Deleted : C:\Program Files\Mozilla FireFox\searchplugins\Search_Results.xml File Deleted : C:\user.js File Deleted : C:\Users\Elke & Koen\AppData\Roaming\Mozilla\Firefox\Profiles\qvn0otmk.default\searchplugins\browsemngr.xml File Deleted : C:\Users\Elke & Koen\AppData\Roaming\Mozilla\Firefox\Profiles\qvn0otmk.default\searchplugins\Search_Results.xml Folder Deleted : C:\ProgramData\Babylon Folder Deleted : C:\ProgramData\boost_interprocess Folder Deleted : C:\ProgramData\Trymedia Folder Deleted : C:\Users\Elke & Koen\AppData\LocalLow\BabylonToolbar Folder Deleted : C:\Users\Elke & Koen\AppData\LocalLow\Search Settings Folder Deleted : C:\Users\Elke & Koen\AppData\Roaming\Babylon Folder Deleted : C:\Users\Elke & Koen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Manager Folder Deleted : C:\Users\Elke & Koen\AppData\Roaming\Mozilla\Firefox\Profiles\qvn0otmk.default\extensions\bbrs_002@blabbers.com Folder Deleted : C:\Users\Elke & Koen\AppData\Roaming\OpenCandy ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings Key Deleted : HKCU\Software\BrowserCompanion Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\DataMngr_Toolbar Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BE7A24F5-69CB-4708-B77B-B1EDA6043B95} Key Deleted : HKCU\Software\Search Settings Key Deleted : HKCU\Software\Softonic Key Deleted : HKLM\Software\Application Updater Key Deleted : HKLM\Software\Babylon Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\clbfjfbnelcflpgpklppgplejolacbej Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohd****efph Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21} Key Deleted : HKLM\Software\Search Settings Key Deleted : HKU\S-1-5-21-3934736986-2846337856-766035173-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Key Deleted : HKU\S-1-5-21-3934736986-2846337856-766035173-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Deleted : HKU\S-1-5-21-3934736986-2846337856-766035173-1003\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E} Key Deleted : HKU\S-1-5-21-3934736986-2846337856-766035173-1003\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21} Value Deleted : HKCU\Software\Mozilla\Firefox\Extensions [{b64982b1-d112-42b5-b1e4-d3867c4533f8}] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}] ***** [internet Browsers] ***** -\\ Internet Explorer v8.0.7600.16385 Deleted : [HKCU\Software\Microsoft\Internet Explorer\Main - bProtector Start Page] -\\ Mozilla Firefox v16.0.1 (nl) Profile name : default File : C:\Users\Elke & Koen\AppData\Roaming\Mozilla\Firefox\Profiles\qvn0otmk.default\prefs.js Zo dit is het logbestandje: C:\Users\Elke & Koen\AppData\Roaming\Mozilla\Firefox\Profiles\qvn0otmk.default\user.js ... Deleted ! Deleted : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com"); Deleted : user_pref("browser.search.defaultenginename", "Search Results"); Deleted : user_pref("browser.search.order.1", "Search Results"); Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true); Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=110819&babsrc=N[...] ************************* AdwCleaner[s1].txt - [5381 octets] - [23/10/2012 09:33:41] ########## EOF - C:\AdwCleaner[s1].txt - [5441 octets] ##########

De popups komen nog en slaag er niet in om de service pack te installeren. Er komt: The cabinet file 'symbols.cab' required for this installation is corrupt and cannot be used. This could indicate a network error, an error reading from the cd-rom or a problem in this package.

Nee, we hebben dat er niet geplaatst...

De imesh startpagina is er niet meer. Dankjewel! dat is super!!! De pop-ups verschijnen wel nog echter en ik heb geen idee waar ze vandaan komen.

Hmmm... I see... Ik had het gesleept en het was niet automatisch aangegaan dus had ik hem opgestart, waarschijnlijk was er iets misgegaan met het slepen. Tweede poging ComboFix 12-10-12.01 - Elke & Koen 14/10/2012 13:24:24.4.1 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.32.1033.18.1023.480 [GMT 2:00] Gestart vanuit: c:\users\Elke & Koen\Desktop\ComboFix.exe gebruikte Opdracht switches :: D:\CFScript.txt AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} FW: AVG Internet Security 2012 *Disabled* {621CC794-9486-F902-D092-0484E8EA828B} SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Nieuw herstelpunt werd aangemaakt . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\Application Updater c:\program files\Application Updater\ApplicationUpdater.exe c:\program files\Application Updater\config.ini c:\program files\Common Files\Spigot c:\program files\Common Files\Spigot\Search Settings\baidu_ff.xml c:\program files\Common Files\Spigot\Search Settings\baidu_ie.xml c:\program files\Common Files\Spigot\Search Settings\config.ini c:\program files\Common Files\Spigot\Search Settings\Lang\res1031.ini c:\program files\Common Files\Spigot\Search Settings\Lang\res1033.ini c:\program files\Common Files\Spigot\Search Settings\Lang\res1034.ini c:\program files\Common Files\Spigot\Search Settings\Lang\res1036.ini c:\program files\Common Files\Spigot\Search Settings\Lang\res1040.ini c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe c:\program files\Common Files\Spigot\Search Settings\SearchSettings64.exe c:\program files\Common Files\Spigot\Search Settings\wth153.dll c:\program files\Common Files\Spigot\Search Settings\wthx153.dll c:\program files\Common Files\Spigot\Search Settings\yahoo_ff.xml c:\program files\Common Files\Spigot\Search Settings\yahoo_ie.xml c:\program files\Common Files\Spigot\Search Settings\yandex_ff.xml c:\program files\Common Files\Spigot\Search Settings\yandex_ie.xml c:\program files\Common Files\Spigot\wtxpcom\chrome.manifest c:\program files\Common Files\Spigot\wtxpcom\chrome\content\listener.js c:\program files\Common Files\Spigot\wtxpcom\chrome\content\listener.xul c:\program files\Common Files\Spigot\wtxpcom\chrome\content\shared.jsm c:\program files\Common Files\Spigot\wtxpcom\components\chrome.manifest c:\program files\Common Files\Spigot\wtxpcom\components\IFBHOHelperWidgiToolbar.xpt c:\program files\Common Files\Spigot\wtxpcom\components\IFBHOWidgiToolbar.xpt c:\program files\Common Files\Spigot\wtxpcom\components\install.rdf c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.10 c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.11 c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.12 c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.13 c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.14 c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.15 c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.16 c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.17 c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.5 c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.6 c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.7 c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.8 c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.9 c:\program files\Common Files\Spigot\wtxpcom\install.rdf c:\program files\YTD Toolbar c:\program files\YTD Toolbar\FF\chrome.manifest c:\program files\YTD Toolbar\FF\chrome\chrome.jar c:\program files\YTD Toolbar\FF\install.rdf c:\program files\YTD Toolbar\IE\6.3\config.ini c:\program files\YTD Toolbar\IE\6.3\ytdToolbarIE.dll c:\program files\YTD Toolbar\Res\amazon.gif c:\program files\YTD Toolbar\Res\dailymotion.gif c:\program files\YTD Toolbar\Res\ebay.gif c:\program files\YTD Toolbar\Res\facebook.gif c:\program files\YTD Toolbar\Res\googleplus.gif c:\program files\YTD Toolbar\Res\hulu.gif c:\program files\YTD Toolbar\Res\icon_settings.gif c:\program files\YTD Toolbar\Res\Lang\res1031.ini c:\program files\YTD Toolbar\Res\Lang\res1033.ini c:\program files\YTD Toolbar\Res\Lang\res1034.ini c:\program files\YTD Toolbar\Res\Lang\res1036.ini c:\program files\YTD Toolbar\Res\Lang\res1040.ini c:\program files\YTD Toolbar\Res\metacafe.gif c:\program files\YTD Toolbar\Res\radio-close.gif c:\program files\YTD Toolbar\Res\radio-minimize.gif c:\program files\YTD Toolbar\Res\radiobeta.gif c:\program files\YTD Toolbar\Res\search-button-hover.gif c:\program files\YTD Toolbar\Res\search-button.gif c:\program files\YTD Toolbar\Res\search-chevron-hover.gif c:\program files\YTD Toolbar\Res\search-chevron.gif c:\program files\YTD Toolbar\Res\search_amazon.gif c:\program files\YTD Toolbar\Res\search_baidu.gif c:\program files\YTD Toolbar\Res\search_ebay.gif c:\program files\YTD Toolbar\Res\search_yahoo.gif c:\program files\YTD Toolbar\Res\search_yandex.gif c:\program files\YTD Toolbar\Res\search_youtube.gif c:\program files\YTD Toolbar\Res\twitter.gif c:\program files\YTD Toolbar\Res\veoh.gif c:\program files\YTD Toolbar\Res\widgets.xml c:\program files\YTD Toolbar\Res\youtube.gif c:\program files\YTD Toolbar\Res\ytd.gif c:\program files\YTD Toolbar\Res\ytd_logo.gif c:\program files\YTD Toolbar\Res\ytd_logo_hover.gif c:\program files\YTD Toolbar\WidgiHelper.exe c:\programdata\Browser Manager c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.crx c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.settings c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension\chrome.manifest c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension\components\browsemngr-15.0.dll c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension\components\browsemngr-16.0.dll c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension\components\browsemngr-3.6.xpt c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension\content\browsemngr.js c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension\content\overlay.xul c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension\install.rdf c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\00 c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\01 c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\02 c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\10 c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\11 c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\12 c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\20 c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\21 c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\traking_settings\22 c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\uninstall.exe c:\windows\system32\roboot.exe . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_Application Updater -------\Service_Browser Manager . . (((((((((((((((((((( Bestanden Gemaakt van 2012-09-14 to 2012-10-14 )))))))))))))))))))))))))))))) . . 2012-10-14 11:32 . 2012-10-14 11:35 -------- d-----w- c:\users\Elke & Koen\AppData\Local\temp 2012-10-14 11:32 . 2012-10-14 11:32 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp 2012-10-14 11:32 . 2012-10-14 11:32 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-10-13 06:10 . 2012-10-13 06:10 96224 ----a-w- c:\program files\Mozilla Firefox\webapprt-stub.exe 2012-10-13 06:10 . 2012-10-13 06:10 157272 ----a-w- c:\program files\Mozilla Firefox\webapp-uninstaller.exe 2012-10-06 11:35 . 2012-10-06 11:35 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\GameCenter 2012-10-06 11:35 . 2012-10-06 11:36 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\GoforFiles 2012-10-06 11:35 . 2012-10-06 11:35 -------- d-----w- c:\program files\GoforFiles 2012-10-03 14:51 . 2012-10-10 16:30 -------- d-----w- c:\program files\ePlaybus.com 2012-10-03 11:33 . 2012-10-03 11:33 -------- d-----w- c:\program files\Kai-Lan's Great Trip to China 2012-10-03 11:14 . 2012-10-03 11:14 -------- d-----w- c:\program files\Lion King 2012-10-03 11:07 . 2012-10-03 12:21 -------- d-----w- c:\program files\hpmonitor 2012-10-03 11:07 . 2012-10-03 12:39 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\systweak 2012-09-21 23:23 . 2012-09-21 23:23 -------- d-----w- c:\programdata\Sony Corporation 2012-09-21 23:23 . 2012-09-21 23:23 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\Sony Corporation 2012-09-21 23:22 . 2012-09-21 23:22 -------- d-----w- c:\users\Elke & Koen\AppData\Local\kinoma 2012-09-21 23:17 . 2012-09-21 23:17 -------- d-----w- c:\users\Elke & Koen\AppData\Local\Sony Corporation 2012-09-21 23:17 . 2012-09-21 23:17 -------- d-----w- c:\program files\Sony 2012-09-21 23:17 . 2012-09-21 23:17 -------- d-----w- c:\program files\Common Files\Sony Shared 2012-09-14 16:04 . 2012-09-14 16:04 -------- d-----w- C:\games . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-09 16:21 . 2012-05-01 16:48 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-10-09 16:21 . 2011-10-26 20:58 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-09-07 15:04 . 2011-11-18 13:30 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-08-24 13:43 . 2012-08-24 13:43 301920 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2012-07-26 01:21 . 2012-07-26 01:21 237408 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2012-10-13 06:10 . 2012-08-06 16:37 261600 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-02-29 17148552] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816] "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312] "VirtualCloneDrive"="c:\program files\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456] "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2011-06-15 307200] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240] "CTxfiHlp"="CTXFIHLP.EXE" [2010-05-05 25600] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-06 421736] "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984] "Reader Application Helper"="c:\program files\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe" [2012-07-12 892928] . c:\users\Elke & Koen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-3-29 227712] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-11-16 113664] McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.189\SSScheduler.exe [2010-9-2 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart . R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x] R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS [x] R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS [x] R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS [x] R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x] S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x] S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x] S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [x] S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [x] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x] S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS [x] S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS [x] S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS [x] . . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2009-06-17 10:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Inhoud van de 'Gedeelde Taken' map . 2012-10-14 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-01 16:21] . 2012-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-11-16 12:27] . 2012-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-11-16 12:27] . . ------- Bijkomende Scan ------- . IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 195.130.130.133 195.130.131.133 TCP: Interfaces\{3E12EB68-457A-4CB6-BDA9-DC1348139DDB}: NameServer = 8.8.8.8,8.8.8.4 DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab FF - ProfilePath - c:\users\Elke & Koen\AppData\Roaming\Mozilla\Firefox\Profiles\qvn0otmk.default\ . - - - - ORPHANS VERWIJDERD - - - - . AddRemove-{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693} - c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\uninstall.exe . . . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Andere Aktieve Processen ------------------------ . c:\progra~1\AVG\AVG2012\avgrsx.exe c:\program files\AVG\AVG2012\avgcsrvx.exe c:\windows\system32\nvvsvc.exe c:\program files\Creative\Shared Files\CTAudSvc.exe c:\program files\NVIDIA Corporation\Display\nvxdsync.exe c:\windows\system32\nvvsvc.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\windows\system32\taskhost.exe c:\program files\AVG\AVG2012\avgnsx.exe c:\program files\AVG\AVG2012\avgemcx.exe c:\program files\GoforFiles\GFFUpdater.exe c:\windows\system32\sppsvc.exe c:\windows\system32\WUDFHost.exe c:\windows\system32\conhost.exe c:\program files\NVIDIA Corporation\Display\nvtray.exe c:\program files\Windows Media Player\wmpnetwk.exe . ************************************************************************** . Voltooingstijd: 2012-10-14 13:38:21 - machine werd herstart ComboFix-quarantined-files.txt 2012-10-14 11:38 ComboFix2.txt 2012-10-13 12:49 ComboFix3.txt 2012-10-12 10:05 . Pre-Run: 15.706.599.424 bytes free Post-Run: 15.522.926.592 bytes free . - - End Of File - - BE6A58BC699FB6F4E3022E7C28B3A606

ComboFix 12-10-12.01 - Elke & Koen 13/10/2012 14:39:44.3.1 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.32.1033.18.1023.454 [GMT 2:00] Gestart vanuit: c:\users\Elke & Koen\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} FW: AVG Internet Security 2012 *Disabled* {621CC794-9486-F902-D092-0484E8EA828B} SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((( Bestanden Gemaakt van 2012-09-13 to 2012-10-13 )))))))))))))))))))))))))))))) . . 2012-10-13 12:47 . 2012-10-13 12:47 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp 2012-10-13 12:47 . 2012-10-13 12:47 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-10-13 06:10 . 2012-10-13 06:10 96224 ----a-w- c:\program files\Mozilla Firefox\webapprt-stub.exe 2012-10-13 06:10 . 2012-10-13 06:10 157272 ----a-w- c:\program files\Mozilla Firefox\webapp-uninstaller.exe 2012-10-12 10:05 . 2012-10-13 12:47 -------- d-----w- c:\users\Elke & Koen\AppData\Local\temp 2012-10-06 11:35 . 2012-10-06 11:35 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\GameCenter 2012-10-06 11:35 . 2012-10-06 11:36 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\GoforFiles 2012-10-06 11:35 . 2012-10-06 11:35 -------- d-----w- c:\program files\GoforFiles 2012-10-03 14:51 . 2012-10-10 16:30 -------- d-----w- c:\program files\ePlaybus.com 2012-10-03 11:33 . 2012-10-03 11:33 -------- d-----w- c:\program files\Kai-Lan's Great Trip to China 2012-10-03 11:14 . 2012-10-03 11:14 -------- d-----w- c:\program files\Lion King 2012-10-03 11:07 . 2012-10-03 12:21 -------- d-----w- c:\program files\hpmonitor 2012-10-03 11:07 . 2012-01-20 12:14 17280 ----a-w- c:\windows\system32\roboot.exe 2012-10-03 11:07 . 2012-10-03 12:39 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\systweak 2012-10-03 11:05 . 2012-10-03 11:05 -------- d-----w- c:\programdata\Browser Manager 2012-09-27 07:53 . 2012-09-27 07:53 -------- d-----w- c:\program files\Application Updater 2012-09-27 07:53 . 2012-09-27 07:53 -------- d-----w- c:\program files\YTD Toolbar 2012-09-27 07:53 . 2012-09-27 07:53 -------- d-----w- c:\program files\Common Files\Spigot 2012-09-21 23:23 . 2012-09-21 23:23 -------- d-----w- c:\programdata\Sony Corporation 2012-09-21 23:23 . 2012-09-21 23:23 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\Sony Corporation 2012-09-21 23:22 . 2012-09-21 23:22 -------- d-----w- c:\users\Elke & Koen\AppData\Local\kinoma 2012-09-21 23:17 . 2012-09-21 23:17 -------- d-----w- c:\users\Elke & Koen\AppData\Local\Sony Corporation 2012-09-21 23:17 . 2012-09-21 23:17 -------- d-----w- c:\program files\Sony 2012-09-21 23:17 . 2012-09-21 23:17 -------- d-----w- c:\program files\Common Files\Sony Shared 2012-09-14 16:04 . 2012-09-14 16:04 -------- d-----w- C:\games . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-09 16:21 . 2012-05-01 16:48 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-10-09 16:21 . 2011-10-26 20:58 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-09-07 15:04 . 2011-11-18 13:30 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-08-24 13:43 . 2012-08-24 13:43 301920 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2012-07-26 01:21 . 2012-07-26 01:21 237408 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2012-07-16 00:41 . 2012-07-22 09:30 6891424 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{394898E9-C4A9-431F-AFDF-E70A266C3EDE}\mpengine.dll 2012-10-13 06:10 . 2012-08-06 16:37 261600 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-02-29 17148552] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816] "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312] "VirtualCloneDrive"="c:\program files\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456] "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2011-06-15 307200] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240] "CTxfiHlp"="CTXFIHLP.EXE" [2010-05-05 25600] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-06 421736] "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984] "Reader Application Helper"="c:\program files\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe" [2012-07-12 892928] "SearchSettings"="c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe" [2012-09-19 1100680] . c:\users\Elke & Koen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-3-29 227712] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-11-16 113664] McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.189\SSScheduler.exe [2010-9-2 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~2\BROWSE~1\23762~1.17\{16CDF~1\browsemngr.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart . R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [x] R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x] R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS [x] R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS [x] R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS [x] R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x] S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x] S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x] S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x] S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [x] S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x] S2 Browser Manager;Browser Manager;c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe [x] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [x] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x] S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS [x] S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS [x] S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS [x] . . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2009-06-17 10:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Inhoud van de 'Gedeelde Taken' map . 2012-10-13 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-01 16:21] . 2012-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-11-16 12:27] . 2012-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-11-16 12:27] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://search.babylon.com/?affID=111304&tt=021012_ccp_4012_4&babsrc=HP_ss&mntrId=8cc6e5f90000000000000013d38a9e3a IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 195.130.130.133 195.130.131.133 TCP: Interfaces\{3E12EB68-457A-4CB6-BDA9-DC1348139DDB}: NameServer = 8.8.8.8,8.8.8.4 DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab FF - ProfilePath - c:\users\Elke & Koen\AppData\Roaming\Mozilla\Firefox\Profiles\qvn0otmk.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://search.imesh.net/?sver=3&appid=72 FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=72&systemid=1&sver=3&sr=0&q= FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110819 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.id - 8cc6e5f90000000000000013d38a9e3a FF - user.js: extensions.BabylonToolbar_i.hardId - 8cc6e5f90000000000000013d38a9e3a FF - user.js: extensions.BabylonToolbar_i.instlDay - 15456 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar_i.instlRef - sst FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=8cc6e5f90000000000000013d38a9e3a&q= FF - user.js: extensions.BabylonToolbar.id - 8cc6e5f90000000000000013d38a9e3a FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB} FF - user.js: extensions.BabylonToolbar.instlDay - 15616 FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.0.7 FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.0.7 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.0.713:05 FF - user.js: extensions.BabylonToolbar.prtnrId - babylon FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar.tlbrId - base FF - user.js: extensions.BabylonToolbar.instlRef - sst FF - user.js: extensions.BabylonToolbar.dfltLng - en FF - user.js: extensions.BabylonToolbar.excTlbr - false FF - user.js: extensions.BabylonToolbar.admin - false . . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Voltooingstijd: 2012-10-13 14:49:26 ComboFix-quarantined-files.txt 2012-10-13 12:49 ComboFix2.txt 2012-10-12 10:05 . Pre-Run: 14.580.834.304 bytes free Post-Run: 14.545.997.824 bytes free . - - End Of File - - 813A967A9CCDD1ED9BEC6A52818D5BBE

Ziezo ComboFix 12-10-12.01 - Elke & Koen 13/10/2012 14:39:44.3.1 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.32.1033.18.1023.454 [GMT 2:00] Gestart vanuit: c:\users\Elke & Koen\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} FW: AVG Internet Security 2012 *Disabled* {621CC794-9486-F902-D092-0484E8EA828B} SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((( Bestanden Gemaakt van 2012-09-13 to 2012-10-13 )))))))))))))))))))))))))))))) . . 2012-10-13 12:47 . 2012-10-13 12:47 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp 2012-10-13 12:47 . 2012-10-13 12:47 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-10-13 06:10 . 2012-10-13 06:10 96224 ----a-w- c:\program files\Mozilla Firefox\webapprt-stub.exe 2012-10-13 06:10 . 2012-10-13 06:10 157272 ----a-w- c:\program files\Mozilla Firefox\webapp-uninstaller.exe 2012-10-12 10:05 . 2012-10-13 12:47 -------- d-----w- c:\users\Elke & Koen\AppData\Local\temp 2012-10-06 11:35 . 2012-10-06 11:35 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\GameCenter 2012-10-06 11:35 . 2012-10-06 11:36 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\GoforFiles 2012-10-06 11:35 . 2012-10-06 11:35 -------- d-----w- c:\program files\GoforFiles 2012-10-03 14:51 . 2012-10-10 16:30 -------- d-----w- c:\program files\ePlaybus.com 2012-10-03 11:33 . 2012-10-03 11:33 -------- d-----w- c:\program files\Kai-Lan's Great Trip to China 2012-10-03 11:14 . 2012-10-03 11:14 -------- d-----w- c:\program files\Lion King 2012-10-03 11:07 . 2012-10-03 12:21 -------- d-----w- c:\program files\hpmonitor 2012-10-03 11:07 . 2012-01-20 12:14 17280 ----a-w- c:\windows\system32\roboot.exe 2012-10-03 11:07 . 2012-10-03 12:39 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\systweak 2012-10-03 11:05 . 2012-10-03 11:05 -------- d-----w- c:\programdata\Browser Manager 2012-09-27 07:53 . 2012-09-27 07:53 -------- d-----w- c:\program files\Application Updater 2012-09-27 07:53 . 2012-09-27 07:53 -------- d-----w- c:\program files\YTD Toolbar 2012-09-27 07:53 . 2012-09-27 07:53 -------- d-----w- c:\program files\Common Files\Spigot 2012-09-21 23:23 . 2012-09-21 23:23 -------- d-----w- c:\programdata\Sony Corporation 2012-09-21 23:23 . 2012-09-21 23:23 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\Sony Corporation 2012-09-21 23:22 . 2012-09-21 23:22 -------- d-----w- c:\users\Elke & Koen\AppData\Local\kinoma 2012-09-21 23:17 . 2012-09-21 23:17 -------- d-----w- c:\users\Elke & Koen\AppData\Local\Sony Corporation 2012-09-21 23:17 . 2012-09-21 23:17 -------- d-----w- c:\program files\Sony 2012-09-21 23:17 . 2012-09-21 23:17 -------- d-----w- c:\program files\Common Files\Sony Shared 2012-09-14 16:04 . 2012-09-14 16:04 -------- d-----w- C:\games . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-09 16:21 . 2012-05-01 16:48 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-10-09 16:21 . 2011-10-26 20:58 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-09-07 15:04 . 2011-11-18 13:30 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-08-24 13:43 . 2012-08-24 13:43 301920 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2012-07-26 01:21 . 2012-07-26 01:21 237408 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2012-07-16 00:41 . 2012-07-22 09:30 6891424 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{394898E9-C4A9-431F-AFDF-E70A266C3EDE}\mpengine.dll 2012-10-13 06:10 . 2012-08-06 16:37 261600 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-02-29 17148552] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816] "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312] "VirtualCloneDrive"="c:\program files\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456] "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2011-06-15 307200] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240] "CTxfiHlp"="CTXFIHLP.EXE" [2010-05-05 25600] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-06 421736] "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984] "Reader Application Helper"="c:\program files\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe" [2012-07-12 892928] "SearchSettings"="c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe" [2012-09-19 1100680] . c:\users\Elke & Koen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-3-29 227712] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-11-16 113664] McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.189\SSScheduler.exe [2010-9-2 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~2\BROWSE~1\23762~1.17\{16CDF~1\browsemngr.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart . R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [x] R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x] R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS [x] R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS [x] R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS [x] R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x] S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x] S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x] S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x] S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [x] S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x] S2 Browser Manager;Browser Manager;c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe [x] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [x] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x] S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS [x] S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS [x] S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS [x] . . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2009-06-17 10:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Inhoud van de 'Gedeelde Taken' map . 2012-10-13 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-01 16:21] . 2012-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-11-16 12:27] . 2012-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-11-16 12:27] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://search.babylon.com/?affID=111304&tt=021012_ccp_4012_4&babsrc=HP_ss&mntrId=8cc6e5f90000000000000013d38a9e3a IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 195.130.130.133 195.130.131.133 TCP: Interfaces\{3E12EB68-457A-4CB6-BDA9-DC1348139DDB}: NameServer = 8.8.8.8,8.8.8.4 DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab FF - ProfilePath - c:\users\Elke & Koen\AppData\Roaming\Mozilla\Firefox\Profiles\qvn0otmk.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://search.imesh.net/?sver=3&appid=72 FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=72&systemid=1&sver=3&sr=0&q= FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110819 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.id - 8cc6e5f90000000000000013d38a9e3a FF - user.js: extensions.BabylonToolbar_i.hardId - 8cc6e5f90000000000000013d38a9e3a FF - user.js: extensions.BabylonToolbar_i.instlDay - 15456 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar_i.instlRef - sst FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=8cc6e5f90000000000000013d38a9e3a&q= FF - user.js: extensions.BabylonToolbar.id - 8cc6e5f90000000000000013d38a9e3a FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB} FF - user.js: extensions.BabylonToolbar.instlDay - 15616 FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.0.7 FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.0.7 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.0.713:05 FF - user.js: extensions.BabylonToolbar.prtnrId - babylon FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar.tlbrId - base FF - user.js: extensions.BabylonToolbar.instlRef - sst FF - user.js: extensions.BabylonToolbar.dfltLng - en FF - user.js: extensions.BabylonToolbar.excTlbr - false FF - user.js: extensions.BabylonToolbar.admin - false . . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Voltooingstijd: 2012-10-13 14:49:26 ComboFix-quarantined-files.txt 2012-10-13 12:49 ComboFix2.txt 2012-10-12 10:05 . Pre-Run: 14.580.834.304 bytes free Post-Run: 14.545.997.824 bytes free . - - End Of File - - 813A967A9CCDD1ED9BEC6A52818D5BBE

Ok, het heeft eventjes geduurt, maar hier is het dan mijn logbestandje van combofix... ComboFix 12-10-12.01 - Elke & Koen 12/10/2012 11:54:02.2.1 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.32.1033.18.1023.433 [GMT 2:00] Gestart vanuit: c:\users\Elke & Koen\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} FW: AVG Internet Security 2012 *Disabled* {621CC794-9486-F902-D092-0484E8EA828B} SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Nieuw herstelpunt werd aangemaakt . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . I:\autorun.inf . ---- Voorgaande Run ------- . c:\users\Elke & Koen\AppData\Local\Microsoft\Windows\Temporary Internet Files\{0FDB7EFD-C02C-4233-8097-B440CC86C3AF}.xps c:\users\Elke & Koen\AppData\Local\Microsoft\Windows\Temporary Internet Files\{24BDACD8-5E3A-42FA-BEC6-4705B7348341}.xps c:\users\Elke & Koen\AppData\Local\Microsoft\Windows\Temporary Internet Files\{36653BDF-9AD8-46A4-9CE3-72B0CAD1F991}.xps c:\users\Elke & Koen\AppData\Local\Microsoft\Windows\Temporary Internet Files\{37672EDD-3CA5-4810-A3FD-03621B1CDFE9}.xps c:\users\Elke & Koen\AppData\Local\Microsoft\Windows\Temporary Internet Files\{3E3EB1EE-5EBD-426C-8775-16C238615FC0}.xps c:\users\Elke & Koen\AppData\Local\Microsoft\Windows\Temporary Internet Files\{9E72CD77-3B50-46C4-A8FC-EA373F69DF34}.xps c:\users\Elke & Koen\AppData\Local\Microsoft\Windows\Temporary Internet Files\{D15D477E-AB9E-48F8-8DDC-DDB80D02710F}.xps c:\users\Elke & Koen\Documents\~ytAC6B.tmp . . (((((((((((((((((((( Bestanden Gemaakt van 2012-09-12 to 2012-10-12 )))))))))))))))))))))))))))))) . . 2012-10-12 10:02 . 2012-10-12 10:02 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp 2012-10-12 10:02 . 2012-10-12 10:02 -------- d-----w- c:\users\Elke & Koen\AppData\Local\temp 2012-10-12 10:02 . 2012-10-12 10:02 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-10-06 11:35 . 2012-10-06 11:35 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\GameCenter 2012-10-06 11:35 . 2012-10-06 11:36 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\GoforFiles 2012-10-06 11:35 . 2012-10-06 11:35 -------- d-----w- c:\program files\GoforFiles 2012-10-03 14:51 . 2012-10-10 16:30 -------- d-----w- c:\program files\ePlaybus.com 2012-10-03 11:33 . 2012-10-03 11:33 -------- d-----w- c:\program files\Kai-Lan's Great Trip to China 2012-10-03 11:14 . 2012-10-03 11:14 -------- d-----w- c:\program files\Lion King 2012-10-03 11:07 . 2012-10-03 12:21 -------- d-----w- c:\program files\hpmonitor 2012-10-03 11:07 . 2012-01-20 12:14 17280 ----a-w- c:\windows\system32\roboot.exe 2012-10-03 11:07 . 2012-10-03 12:39 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\systweak 2012-10-03 11:05 . 2012-10-03 11:05 -------- d-----w- c:\programdata\Browser Manager 2012-09-27 07:53 . 2012-09-27 07:53 -------- d-----w- c:\program files\Application Updater 2012-09-27 07:53 . 2012-09-27 07:53 -------- d-----w- c:\program files\YTD Toolbar 2012-09-27 07:53 . 2012-09-27 07:53 -------- d-----w- c:\program files\Common Files\Spigot 2012-09-21 23:23 . 2012-09-21 23:23 -------- d-----w- c:\programdata\Sony Corporation 2012-09-21 23:23 . 2012-09-21 23:23 -------- d-----w- c:\users\Elke & Koen\AppData\Roaming\Sony Corporation 2012-09-21 23:22 . 2012-09-21 23:22 -------- d-----w- c:\users\Elke & Koen\AppData\Local\kinoma 2012-09-21 23:17 . 2012-09-21 23:17 -------- d-----w- c:\users\Elke & Koen\AppData\Local\Sony Corporation 2012-09-21 23:17 . 2012-09-21 23:17 -------- d-----w- c:\program files\Sony 2012-09-21 23:17 . 2012-09-21 23:17 -------- d-----w- c:\program files\Common Files\Sony Shared 2012-09-14 16:04 . 2012-09-14 16:04 -------- d-----w- C:\games . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-09 16:21 . 2012-05-01 16:48 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-10-09 16:21 . 2011-10-26 20:58 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-09-07 15:04 . 2011-11-18 13:30 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-08-24 13:43 . 2012-08-24 13:43 301920 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2012-07-26 01:21 . 2012-07-26 01:21 237408 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2012-07-16 00:41 . 2012-07-22 09:30 6891424 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{394898E9-C4A9-431F-AFDF-E70A266C3EDE}\mpengine.dll 2012-09-09 19:33 . 2012-08-06 16:37 266720 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-02-29 17148552] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816] "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312] "VirtualCloneDrive"="c:\program files\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456] "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2011-06-15 307200] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240] "CTxfiHlp"="CTXFIHLP.EXE" [2010-05-05 25600] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-06 421736] "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984] "Reader Application Helper"="c:\program files\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe" [2012-07-12 892928] "SearchSettings"="c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe" [2012-09-19 1100680] . c:\users\Elke & Koen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2010-3-29 227712] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-11-16 113664] McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.189\SSScheduler.exe [2010-9-2 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~2\BROWSE~1\23762~1.17\{16CDF~1\browsemngr.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart . R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x] R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS [x] R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS [x] R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS [x] R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x] S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x] S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x] S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x] S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [x] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [x] S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x] S2 Browser Manager;Browser Manager;c:\programdata\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe [x] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [x] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x] S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS [x] S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS [x] S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS [x] . . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2009-06-17 10:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Inhoud van de 'Gedeelde Taken' map . 2012-10-12 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-01 16:21] . 2012-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-11-16 12:27] . 2012-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-11-16 12:27] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://search.babylon.com/?affID=111304&tt=021012_ccp_4012_4&babsrc=HP_ss&mntrId=8cc6e5f90000000000000013d38a9e3a IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 195.130.130.133 195.130.131.133 TCP: Interfaces\{3E12EB68-457A-4CB6-BDA9-DC1348139DDB}: NameServer = 8.8.8.8,8.8.8.4 DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab FF - ProfilePath - c:\users\Elke & Koen\AppData\Roaming\Mozilla\Firefox\Profiles\qvn0otmk.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://search.imesh.net/?sver=3&appid=72 FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=72&systemid=1&sver=3&sr=0&q= FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110819 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.id - 8cc6e5f90000000000000013d38a9e3a FF - user.js: extensions.BabylonToolbar_i.hardId - 8cc6e5f90000000000000013d38a9e3a FF - user.js: extensions.BabylonToolbar_i.instlDay - 15456 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar_i.instlRef - sst FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=8cc6e5f90000000000000013d38a9e3a&q= FF - user.js: extensions.BabylonToolbar.id - 8cc6e5f90000000000000013d38a9e3a FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB} FF - user.js: extensions.BabylonToolbar.instlDay - 15616 FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.0.7 FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.0.7 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.0.713:05 FF - user.js: extensions.BabylonToolbar.prtnrId - babylon FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar.tlbrId - base FF - user.js: extensions.BabylonToolbar.instlRef - sst FF - user.js: extensions.BabylonToolbar.dfltLng - en FF - user.js: extensions.BabylonToolbar.excTlbr - false FF - user.js: extensions.BabylonToolbar.admin - false . - - - - ORPHANS VERWIJDERD - - - - . Toolbar-10 - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) HKCU-Run-NokiaSuite.exe - c:\program files\Nokia\Nokia Suite\NokiaSuite.exe HKCU-Run-Easy Driver Pro - c:\program files\Probit Software\Easy Driver Pro\DPLauncher.exe . . . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Voltooingstijd: 2012-10-12 12:05:47 ComboFix-quarantined-files.txt 2012-10-12 10:05 . Pre-Run: 15.922.257.920 bytes free Post-Run: 15.953.850.368 bytes free . - - End Of File - - 744EE9FE552CCFDE2E262EE72A8AAD61

Hoihoi, De installatie van het combipack was not succefull. Ik heb al meerder keren geprobeerd het te installeren maar het lukt niet bepaald. Dus nu zit ik een beetje vast. Het Java programma probeert alleszinds al geen nieuwe dingen meer te downloaden in mijn pc zonder toestemming, maar er komen nog steeds ongevraagde pop ups en de imesh browser staat nog steeds als startpagina.

Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 20:41:54, on 7/09/2012 Platform: Windows 7 (WinNT 6.00.3504) MSIE: Internet Explorer v8.00 (8.00.7600.16385) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskhost.exe C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE C:\Program Files\VirtualCloneDrive\VCDDaemon.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\Windows\System32\Ctxfihlp.exe C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\AVG\AVG2012\avgtray.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\McAfee Security Scan\2.0.189\SSScheduler.exe C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE C:\Program Files\NVIDIA Corporation\Display\nvtray.exe C:\Windows\SYSTEM32\CTXFISPI.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Elke & Koen\Downloads\HijackThis.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: AVG Do Not Track - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll O3 - Toolbar: (no name) - !{F3FEE66E-E034-436a-86E4-9690573BEE8A} - (no file) O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\VirtualCloneDrive\VCDDaemon.exe" /s O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE -startup O4 - HKLM\..\Run: [bCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [NokiaSuite.exe] C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe -tray O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun O4 - HKCU\..\Run: [Easy Driver Pro] C:\Program Files\Probit Software\Easy Driver Pro\DPLauncher.exe O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-21-3934736986-2846337856-766035173-1003\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser') O4 - HKUS\S-1-5-21-3934736986-2846337856-766035173-1003\..\Run: [Easy Driver Pro] C:\Program Files\Probit Software\Easy Driver Pro\DPLauncher.exe (User 'UpdatusUser') O4 - HKUS\S-1-5-21-3934736986-2846337856-766035173-1003\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser') O4 - Startup: OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.189\SSScheduler.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} (Creative Software AutoUpdate 2) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{3E12EB68-457A-4CB6-BDA9-DC1348139DDB}: NameServer = 8.8.8.8,8.8.8.4 O17 - HKLM\System\CS1\Services\Tcpip\..\{3E12EB68-457A-4CB6-BDA9-DC1348139DDB}: NameServer = 8.8.8.8,8.8.8.4 O17 - HKLM\System\CS2\Services\Tcpip\..\{3E12EB68-457A-4CB6-BDA9-DC1348139DDB}: NameServer = 8.8.8.8,8.8.8.4 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgidsagent.exe O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe -- End of file - 10677 bytes Hie het Hijackthis logje... Helaas staat imesh nog steeds als startpagina op mijn browser Er is nu ook een soort van Java application die zichzelf steeds probeert te downloaden. AVG detecteerd het wel steeds, maar ik heb het zelf niet in mijn pc gedaan.

Dit is het documentje dat kwam na de malware scan: Malwarebytes Anti-Malware 1.62.0.1300 Malwarebytes : Free anti-malware download Database version: v2012.09.07.07 Windows 7 x86 NTFS Internet Explorer 8.0.7600.16385 Elke & Koen :: OUDEPC [administrator] 7/09/2012 20:05:03 mbam-log-2012-09-07 (20-05-03).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 214118 Time elapsed: 13 minute(s), 45 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) en nu nog de andere scan (over 5 minutjes)