ten

Goedemorgen hierbij het logje van Combofix. ComboFix 12-11-09.02 - Gebruiker 09-11-2012 13:27:15.1.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1015.347 [GMT 1:00] Gestart vanuit: c:\documents and settings\Gebruiker\Mijn documenten\Downloads\ComboFix.exe AV: AVG Anti-Virus 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\Gebruiker\Application Data\ACD Systems\ACDSee\ImageDB.ddf c:\windows\system32\dllcache\wmpvis.dll c:\windows\system32\msssc.dll c:\windows\system32\roboot.exe . . (((((((((((((((((((( Bestanden Gemaakt van 2012-10-09 to 2012-11-09 )))))))))))))))))))))))))))))) . . 2012-11-09 06:31 . 2012-11-09 06:31 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\AVG2013 2012-11-09 06:29 . 2012-11-09 06:29 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\TuneUp Software 2012-11-09 06:29 . 2012-11-09 06:29 -------- d-----w- c:\documents and settings\Gebruiker\Local Settings\Application Data\AVG Secure Search 2012-11-09 06:29 . 2012-11-09 06:29 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Secure Search 2012-11-09 06:29 . 2012-11-09 06:29 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\AVG Secure Search 2012-11-09 06:29 . 2012-11-09 06:28 26984 ----a-w- c:\windows\system32\drivers\avgtpx86.sys 2012-11-09 06:29 . 2012-11-09 06:29 -------- d-----w- c:\program files\Common Files\AVG Secure Search 2012-11-09 06:29 . 2012-11-09 06:29 -------- d-----w- c:\program files\AVG Secure Search 2012-11-09 06:28 . 2012-11-09 06:28 -------- d-----w- c:\windows\LastGood 2012-11-09 06:27 . 2012-11-09 06:30 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2013 2012-11-09 06:27 . 2012-11-09 06:27 -------- d-----w- C:\$AVG 2012-11-09 06:26 . 2012-11-09 06:26 -------- d-----w- c:\program files\AVG 2012-11-09 06:06 . 2012-11-09 12:12 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData 2012-11-09 06:06 . 2012-11-09 06:34 -------- d-----w- c:\documents and settings\Gebruiker\Local Settings\Application Data\Avg2013 2012-11-09 06:06 . 2012-11-09 06:06 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files 2012-11-09 06:06 . 2012-11-09 06:06 -------- d-----w- c:\documents and settings\Gebruiker\Local Settings\Application Data\MFAData 2012-11-08 07:47 . 2012-11-08 07:47 388096 ----a-r- c:\documents and settings\Gebruiker\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2012-11-08 07:47 . 2012-11-08 07:47 -------- d-----w- c:\program files\Trend Micro 2012-11-07 13:18 . 2012-11-07 14:08 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2012-11-07 13:14 . 2012-11-07 13:14 -------- d-----w- C:\ProgramData 2012-11-07 13:14 . 2012-11-07 13:14 -------- d-----w- C:\Cover DVD1 2012-11-07 10:14 . 2012-11-07 10:14 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2012-11-07 10:14 . 2012-11-07 13:36 -------- d-----w- c:\program files\SUPERAntiSpyware 2012-11-07 10:14 . 2012-11-07 10:14 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\SUPERAntiSpyware.com 2012-11-07 09:35 . 2012-11-07 10:05 -------- d-----w- c:\windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP 2012-11-07 08:06 . 2012-11-07 08:06 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\ElevatedDiagnostics 2012-11-05 12:25 . 2003-05-14 20:07 389120 ----a-w- c:\windows\system32\actskn43.ocx 2012-11-05 12:25 . 1998-12-02 08:11 143360 ----a-w- c:\windows\system32\vbuzip10.dll 2012-11-05 12:25 . 2003-01-26 14:48 147456 ----a-w- c:\windows\system32\Vbzip11.dll 2012-11-05 12:25 . 1999-04-17 22:36 10752 ----a-w- c:\windows\system32\aamd532.dll 2012-11-05 12:25 . 1998-04-23 23:00 368912 ----a-w- c:\windows\system32\vbar332.dll 2012-11-05 12:24 . 2012-11-05 12:24 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\Webroot 2012-11-05 12:24 . 2012-11-05 12:24 -------- d-----w- c:\program files\Webroot 2012-11-05 08:12 . 2012-11-05 08:12 -------- d-----w- c:\program files\Enigma Software Group 2012-11-05 08:11 . 2012-11-07 09:36 -------- d-----w- c:\windows\DDABC66756B3412282B02F5782EA2F9A.TMP 2012-11-05 08:11 . 2012-11-07 13:36 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2012-11-05 08:05 . 2012-11-07 11:12 -------- d-----w- c:\program files\Best Removal Tool 2012-10-30 08:24 . 2012-10-30 08:24 -------- d-----w- c:\program files\MSXML 4.0 2012-10-28 09:32 . 2012-10-28 09:44 -------- d-----w- c:\windows\Ulead.dat 2012-10-28 09:29 . 2012-10-28 10:09 -------- d-----w- c:\documents and settings\Gebruiker\Local Settings\Application Data\WMTools Downloaded Files 2012-10-28 09:23 . 2000-05-22 21:58 608448 ----a-w- c:\windows\system32\comctl32.ocx 2012-10-28 09:07 . 2012-10-28 09:23 -------- d-----w- c:\program files\Total Video Converter 2012-10-28 09:03 . 2012-10-28 09:03 -------- d-----w- c:\documents and settings\Gebruiker\dwhelper 2012-10-22 12:02 . 2012-10-22 12:02 179936 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys 2012-10-20 06:00 . 2012-10-20 06:01 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Product Assistant 2012-10-17 13:12 . 2012-10-17 13:12 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\HP 2012-10-17 13:05 . 2012-10-17 13:06 -------- d-----w- c:\documents and settings\All Users\Application Data\HP 2012-10-17 13:05 . 2012-10-17 13:05 -------- d-----w- c:\program files\Hewlett-Packard 2012-10-17 13:05 . 2012-10-17 13:05 -------- d-----w- c:\program files\Common Files\Hewlett-Packard 2012-10-17 13:04 . 2012-10-17 13:04 -------- d-----w- c:\program files\Common Files\HP 2012-10-17 13:03 . 2012-10-17 13:05 -------- d-----w- c:\program files\HP 2012-10-17 13:03 . 2008-04-13 22:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys 2012-10-17 13:03 . 2008-04-13 22:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys 2012-10-15 02:48 . 2012-10-15 02:48 55776 ----a-w- c:\windows\system32\drivers\avgidshx.sys 2012-10-13 11:52 . 2012-10-13 11:53 -------- d-----w- c:\program files\ACD Systems 2012-10-13 11:47 . 2012-10-13 11:47 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\ACD Systems 2012-10-13 11:13 . 1998-10-30 04:02 11264 ----a-w- c:\windows\system32\Jgid500.dll 2012-10-13 11:13 . 1998-10-30 04:02 11264 ----a-w- c:\windows\system32\Jgar500.dll 2012-10-13 11:13 . 1998-10-30 04:02 144896 ----a-w- c:\windows\system32\Jgdw500.dll 2012-10-13 11:13 . 1998-10-30 04:03 13312 ----a-w- c:\windows\system32\Jgst500.dll 2012-10-13 11:13 . 1998-10-30 04:03 15872 ----a-w- c:\windows\system32\Jgpl500.dll 2012-10-13 11:13 . 1998-10-30 04:02 7168 ----a-w- c:\windows\system32\Jgme500.dll 2012-10-13 11:13 . 1999-12-15 11:18 1056768 ----a-w- c:\windows\system32\Roboex32.dll 2012-10-12 10:09 . 2012-10-12 10:09 -------- d-----w- c:\windows\ShellNew 2012-10-12 09:40 . 2012-10-12 09:40 -------- d-----w- c:\windows\Local Settings 2012-10-12 09:40 . 2012-10-12 09:40 -------- d-----w- c:\program files\Desktop Tray Clock 2012-10-12 09:27 . 2012-10-12 09:27 -------- d-----w- c:\program files\Yz Shadow 2012-10-12 09:24 . 2012-11-07 13:33 -------- d-----w- c:\program files\DVD2SVCD 2012-10-12 09:24 . 2012-10-12 09:24 -------- d-----w- c:\program files\Custom Technology 2012-10-12 09:24 . 2012-10-12 09:24 -------- d-----w- c:\program files\DVD Decrypter 2012-10-12 09:23 . 2001-12-08 18:20 38912 ----a-w- c:\windows\system32\HUFFYUV.DLL 2012-10-12 09:23 . 2012-10-12 09:24 -------- d-----w- c:\program files\AviSynth 2.5 2012-10-12 08:01 . 2012-10-12 08:01 -------- d-----w- c:\documents and settings\Gebruiker\Local Settings\Application Data\ESET 2012-10-12 05:41 . 2012-10-12 05:41 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2 2012-10-11 13:32 . 2012-10-11 13:32 -------- d-----w- c:\program files\Gophoto.it 2012-10-11 13:28 . 2012-11-08 09:27 -------- d-----w- c:\documents and settings\Gebruiker\Bureaublad 2012-10-11 12:58 . 2012-10-11 12:58 -------- d-----w- c:\documents and settings\Gebruiker\Local Settings\Application Data\Google 2012-10-11 12:50 . 2012-10-11 12:53 -------- d-----w- c:\documents and settings\All Users\Application Data\RegUse 2012-10-11 12:49 . 2012-10-11 12:53 -------- d-----w- c:\program files\RegUse 2012-10-11 12:31 . 2012-10-11 12:32 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Software 2012-10-11 12:30 . 2012-11-01 08:06 -------- d-----w- c:\program files\NCH Software 2012-10-11 12:30 . 2012-10-11 12:54 -------- d-----w- c:\documents and settings\Gebruiker\Application Data\NCH Software 2012-10-11 09:04 . 2012-10-11 13:01 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-10-11 09:04 . 2012-10-11 13:01 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-10-11 07:56 . 2012-10-11 07:56 -------- d-----w- c:\windows\system32\C2MP 2012-10-11 07:43 . 2012-10-11 07:43 -------- d-----w- c:\program files\Yamicsoft 2012-10-11 07:43 . 2012-10-11 07:43 -------- d-----w- c:\program files\Computer-Expert Group 2012-10-11 07:11 . 2012-10-11 07:11 -------- d--h--w- c:\windows\PIF 2012-10-11 04:55 . 2012-06-04 15:35 222448 ----a-w- c:\windows\system32\muweb.dll 2012-10-11 04:55 . 2012-06-02 13:18 275696 ----a-w- c:\windows\system32\mucltui.dll . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-06 10:40 . 2012-10-06 10:40 21361 ----a-w- c:\windows\system32\drivers\AegisP.sys 2012-10-05 02:32 . 2012-10-05 02:32 93536 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2012-10-02 02:30 . 2012-10-02 02:30 159712 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2012-09-25 05:30 . 2012-09-25 05:30 3915776 ----a-w- c:\windows\system32\ffmpeg.dll 2012-09-25 05:30 . 2012-09-25 05:30 112640 ----a-w- c:\windows\system32\ff_vfw.dll 2012-09-25 05:29 . 2012-09-25 05:29 3504128 ----a-w- c:\windows\system32\ffdshow.ax 2012-09-25 05:29 . 2012-09-25 05:29 271360 ----a-w- c:\windows\system32\TomsMoComp_ff.dll 2012-09-25 05:29 . 2012-09-25 05:29 99840 ----a-w- c:\windows\system32\ff_wmv9.dll 2012-09-25 05:29 . 2012-09-25 05:29 157184 ----a-w- c:\windows\system32\ff_unrar.dll 2012-09-25 05:29 . 2012-09-25 05:29 147456 ----a-w- c:\windows\system32\ff_libmad.dll 2012-09-25 05:28 . 2012-09-25 05:28 211968 ----a-w- c:\windows\system32\ff_libdts.dll 2012-09-25 05:28 . 2012-09-25 05:28 1525760 ----a-w- c:\windows\system32\ff_samplerate.dll 2012-09-25 05:28 . 2012-09-25 05:28 114688 ----a-w- c:\windows\system32\ff_liba52.dll 2012-09-24 00:03 . 2012-09-24 00:03 1289728 ----a-w- c:\windows\system32\VSFilter.dll 2012-09-21 02:46 . 2012-09-21 02:46 164832 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2012-09-21 02:46 . 2012-09-21 02:46 177376 ----a-w- c:\windows\system32\drivers\avglogx.sys 2012-09-21 02:45 . 2012-09-21 02:45 19936 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys 2012-09-14 02:05 . 2012-09-14 02:05 35552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys 2012-08-28 15:17 . 2003-04-08 12:00 916992 ----a-w- c:\windows\system32\wininet.dll 2012-08-28 15:17 . 2003-04-08 12:00 43520 ------w- c:\windows\system32\licmgr10.dll 2012-08-28 15:17 . 2003-04-08 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl 2012-08-28 12:07 . 2012-05-14 09:29 385024 ----a-w- c:\windows\system32\html.iec 2012-08-24 13:53 . 2003-04-08 12:00 177664 ----a-w- c:\windows\system32\wintrust.dll 2012-08-23 19:01 . 2012-08-23 19:01 233472 ----a-w- c:\windows\system32\DCBassSourceMod.ax 2012-08-23 13:43 . 2012-08-23 13:43 54328 ----a-w- c:\windows\system32\bass_opus.dll 2012-08-23 06:27 . 2003-04-08 12:00 2197248 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-08-23 06:27 . 2002-09-09 13:17 2073984 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-10-24 17:50 . 2012-11-04 09:08 261600 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SkinClock"="c:\program files\Desktop Tray Clock\DTClock.exe" [2007-10-22 563519] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SetRefresh"="c:\program files\COMPAQ\SetRefresh\\SetRefresh.exe" [2003-11-20 525824] "Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-01-31 98304] "DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2002-05-28 69632] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-03-01 15872] "HDInspector.exe"="c:\program files\Hard Drive Inspector\HDInspector.exe" [2008-04-26 1006344] "SkinClock"="c:\program files\Desktop Tray Clock\DTClock.exe" [2007-10-22 563519] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896] "AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-11-06 3143800] "vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-11-09 997320] "ROC_roc_ssl_v12"="c:\program files\AVG Secure Search\ROC_roc_ssl_v12.exe" [2012-11-09 1020512] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] . c:\documents and settings\Gebruiker\Menu Start\Programma's\Opstarten\ Yz Shadow.lnk - c:\program files\Yz Shadow\YzShadow.exe [2002-9-30 151552] . c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] Sitecom 300N USB Wireless LAN Utility.lnk - c:\program files\SITECOM\300N USB Wireless LAN Utility\RtWLan.exe [2012-10-6 966656] Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-2-8 394856] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128] . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\SITECOM\\300N USB Wireless LAN Utility\\RtWLan.exe"= "c:\\Program Files\\BitTorrent\\BitTorrent.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\WINDOWS\\system32\\msiexec.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"= "c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"= "c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"= "c:\\Program Files\\AVG\\AVG2013\\avgemcx.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management "1542:TCP"= 1542:TCP:Realtek WPS TCP Prot "1542:UDP"= 1542:UDP:Realtek WPS UDP Prot "53:UDP"= 53:UDP:Realtek AP UDP Prot . R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [21-9-2012 3:46 177376] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [14-9-2012 3:05 35552] R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [22-10-2012 13:02 179936] R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [21-9-2012 3:45 19936] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2-10-2012 3:30 159712] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [21-9-2012 3:46 164832] R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [9-11-2012 7:29 26984] R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [22-10-2012 13:05 196664] R2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [9-11-2012 7:29 711112] R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8192su.sys [6-10-2012 11:38 594048] S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [15-10-2012 3:48 55776] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [6-11-2012 19:00 5814392] S3 esgiguard;esgiguard;\??\c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys --> c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [?] . --- Andere Services/Drivers In Geheugen --- . *NewlyCreated* - AVGIDSAGENT *NewlyCreated* - AVGIDSDRIVER *NewlyCreated* - AVGIDSSHIM *NewlyCreated* - AVGLDX86 *NewlyCreated* - AVGLOGX *NewlyCreated* - AVGMFX86 *NewlyCreated* - AVGRKX86 *NewlyCreated* - AVGTDIX *NewlyCreated* - AVGTP *NewlyCreated* - AVGWD *NewlyCreated* - VTOOLBARUPDATER13.2.0 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Inhoud van de 'Gedeelde Taken' map . 2012-11-09 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-11 13:01] . 2012-10-18 c:\windows\Tasks\RegUse.job - c:\program files\RegUse\RegUse.exe [2012-08-16 08:37] . 2012-11-09 c:\windows\Tasks\User_Feed_Synchronization-{C841954E-20DF-4D8C-9870-18AFD7A87585}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.com/ IE: E&xporteren naar Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.2.254 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll FF - ProfilePath - c:\documents and settings\Gebruiker\Application Data\Mozilla\Firefox\Profiles\a5sfrfw6.default\ FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid={A6B4900F-ABFC-4E18-A897-8BF73B519067}&mid=f95d026e1c4e47d086c9d145b06fe694-970a07a2be282277a370301e621d5afc54f01036〈=nl&ds=AVG&pr=pr&d=2012-11-09 07:29&v=13.2.0.4&sap=ku&q= FF - ExtSQL: 2012-10-07 08:07; {20a82645-c095-46ed-80e3-08825760534b}; c:\documents and settings\Gebruiker\Application Data\Mozilla\Firefox\Profiles\a5sfrfw6.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - ExtSQL: 2012-10-12 08:35; YoutubeVideoDownloader@gefruckelt.de; c:\documents and settings\Gebruiker\Application Data\Mozilla\Firefox\Profiles\a5sfrfw6.default\extensions\YoutubeVideoDownloader@gefruckelt.de.xpi FF - ExtSQL: 2012-10-18 14:50; onlinehdtv@onlinehd.tv; c:\documents and settings\Gebruiker\Application Data\Mozilla\Firefox\Profiles\a5sfrfw6.default\extensions\onlinehdtv@onlinehd.tv.xpi FF - ExtSQL: 2012-10-18 14:50; artur.dubovoy@gmail.com; c:\documents and settings\Gebruiker\Application Data\Mozilla\Firefox\Profiles\a5sfrfw6.default\extensions\artur.dubovoy@gmail.com.xpi FF - ExtSQL: 2012-11-01 09:15; {b9db16a4-6edc-47ec-a1f4-b86292ed211d}; c:\documents and settings\Gebruiker\Application Data\Mozilla\Firefox\Profiles\a5sfrfw6.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF - ExtSQL: 2012-11-04 09:25; stefanvandamme@stefanvd.net; c:\documents and settings\Gebruiker\Application Data\Mozilla\Firefox\Profiles\a5sfrfw6.default\extensions\stefanvandamme@stefanvd.net.xpi FF - ExtSQL: 2012-11-09 07:29; avg@toolbar; c:\documents and settings\All Users\Application Data\AVG Secure Search\FireFoxExt\13.2.0.4 FF - ExtSQL: !HIDDEN! 2012-05-14 14:58; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension . - - - - ORPHANS VERWIJDERD - - - - . HKLM-Run-RegistryMechanic - (no file) . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2012-11-09 13:46 Windows 5.1.2600 Service Pack 3 NTFS . scannen van verborgen processen ... . scannen van verborgen autostart items ... . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, GMER - Rootkit Detector and Remover Windows 5.1.2600 . CreateFile("\\.\PHYSICALDRIVE0"): Het proces heeft geen toegang tot het bestand omdat het bestand door een ander proces wordt gebruikt. device: opened successfully user: error reading MBR kernel: MBR read successfully user != kernel MBR !!! . ************************************************************************** . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . Voltooingstijd: 2012-11-09 13:54:16 ComboFix-quarantined-files.txt 2012-11-09 12:54 . Pre-Run: 29.407.600.640 bytes beschikbaar Post-Run: 29.436.334.080 bytes beschikbaar . WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn . - - End Of File - - 31898D16394EED6CFC2A222F5A923755 ComboFix-quarantined-files 2012-11-09 12:51:44 . 2012-11-09 12:51:45 103 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-RegistryMechanic.reg.dat 2012-11-09 12:40:09 . 2012-11-09 12:40:09 5,037 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2012-11-09 12:21:37 . 2012-11-09 12:21:38 51 ----a-w- C:\Qoobox\Quarantine\catchme.log 2012-10-13 11:53:17 . 2012-10-13 11:53:17 17,600 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Gebruiker\Application Data\ACD Systems\ACDSee\ImageDB.ddf.vir 2012-10-08 06:56:34 . 2012-03-14 13:47:42 17,464 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\roboot.exe.vir 2012-05-14 08:54:57 . 2012-05-14 08:54:57 44 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\msssc.dll.vir 2012-05-14 07:26:51 . 2003-04-08 12:00:00 520,192 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\dllcache\wmpvis.dll.vir Groet, Ten

Ik heb alles gedaan zoals beschreven,maar helaas Claro search is er nog steeds. Toch bedank Groet, Ten

Thanks Jion:-)

Ik heb al een logje gemaakt in HijackThis. kan niemand mij vertellen wat ik daar uit moet verwijderen? Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 8:29:14, on 9-11-2012 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\HDDSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Hard Drive Inspector\HDInspector.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Desktop Tray Clock\DTClock.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\SITECOM\300N USB Wireless LAN Utility\RtWLan.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Yz Shadow\YzShadow.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe C:\Program Files\AVG Secure Search\vprot.exe C:\Program Files\AVG\AVG2013\avgidsagent.exe C:\Program Files\AVG\AVG2013\avgwdsvc.exe C:\Program Files\AVG\AVG2013\avgnsx.exe C:\Program Files\AVG\AVG2013\avgemcx.exe C:\Program Files\AVG\AVG2013\avgrsx.exe C:\Program Files\AVG\AVG2013\avgcsrvx.exe C:\Program Files\AVG\AVG2013\avgcsrvx.exe C:\Program Files\AVG\AVG2013\avgui.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\13.2.0.4\AVG Secure Search_toolbar.dll O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\13.2.0.4\AVG Secure Search_toolbar.dll O4 - HKLM\..\Run: [setRefresh] C:\Program Files\COMPAQ\SetRefresh\\SetRefresh.exe O4 - HKLM\..\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [HDInspector.exe] C:\Program Files\Hard Drive Inspector\HDInspector.exe O4 - HKLM\..\Run: [skinClock] C:\Program Files\Desktop Tray Clock\DTClock.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" O4 - HKLM\..\Run: [ROC_roc_ssl_v12] "C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12 O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [skinClock] C:\Program Files\Desktop Tray Clock\DTClock.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Yz Shadow.lnk = C:\Program Files\Yz Shadow\YzShadow.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Sitecom 300N USB Wireless LAN Utility.lnk = C:\Program Files\SITECOM\300N USB Wireless LAN Utility\RtWLan.exe O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: HP Slim selecteren - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1350019820671 O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgidsagent.exe O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgwdsvc.exe O23 - Service: HDD Information Service (HDDSvc) - AltrixSoft (Atomic Clock) - C:\WINDOWS\system32\HDDSvc.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: vToolbarUpdater13.2.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe -- End of file - 8493 bytes Dank Ten