annouskam

Ja ik ga mn broertje om de recovery cd vragen, want die kan ik niet vinden. Maar bedankt, ik ga hem laten herstellen en dan hoor je meer..

Ik kon hem niet vinden, dus ik heb de scan overnieuw gedaan, wat mij verbaasde dat hij dezelfde fouten er weer uit haalde en zou verwijderen. Nog steeds heb ik last van het welbekende 'Blauwe Scherm' waar wel een melding Bad_Pool_header aangegeven wordt. Hierbij alsnog een Combofix.txt log: ComboFix 09-07-14.08 - queen butterfly 15-07-2009 17:49.3.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.31.1043.18.3068.2441 [GMT 2:00] Gestart vanuit: c:\users\queen butterfly\Desktop\ComboFix.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-655245257-2663727785-2577194690-500 c:\$recycle.bin\S-1-5-21-710693854-943534524-2915416392-500 c:\windows\Installer\411af.msi c:\windows\system32\drivers\hjgruixpqenimi.sys c:\windows\system32\drivers\str.sys c:\windows\system32\drivers\zxraduwbthkejw.sys c:\windows\system32\hjgruibpnotuvw.dat c:\windows\system32\hjgruicvqkxtde.dll c:\windows\system32\hjgruiiowdryns.dll c:\windows\system32\hjgruilog.dat c:\windows\system32\hjgruitoercqxs.dat . ---- Voorgaande Run ------- . c:\programdata\Microsoft\Network\Downloader\qmgr0.dat c:\programdata\Microsoft\Network\Downloader\qmgr1.dat c:\windows\Installer\411af.msi c:\windows\system32\drivers\hjgruixpqenimi.sys c:\windows\system32\drivers\str.sys c:\windows\system32\drivers\zxraduwbthkejw.sys c:\windows\system32\hjgruibpnotuvw.dat c:\windows\system32\hjgruicvqkxtde.dll c:\windows\system32\hjgruiiowdryns.dll c:\windows\system32\hjgruilog.dat c:\windows\system32\hjgruitoercqxs.dat . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_hjgruivupkisti -------\Legacy_PAECS -------\Legacy_PAECS -------\Service_hjgruivupkisti (((((((((((((((((((( Bestanden Gemaakt van 2009-06-15 to 2009-07-15 )))))))))))))))))))))))))))))) . 2009-07-15 16:04 . 2009-07-15 16:08 -------- d-----w- c:\users\queen butterfly\AppData\Local\temp 2009-07-15 14:29 . 2009-07-15 14:29 3774 ----a-r- c:\users\queen butterfly\AppData\Roaming\Microsoft\Installer\{5E7C721D-B008-4269-A1C4-2CE7E9757983}\controlPanelIcon.exe 2009-07-13 21:33 . 2009-07-13 21:35 -------- d-----w- c:\users\queen butterfly\AppData\Roaming\LimeWire 2009-07-13 21:32 . 2009-07-13 21:32 -------- d-----w- c:\program files\LimeWire 2009-07-12 21:03 . 2009-07-13 21:35 -------- d-----w- c:\users\queen butterfly\AppData\Local\Temp(24) 2009-07-12 16:29 . 2009-06-25 21:16 533880 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090709.001\Scxpx86.dll 2009-07-12 16:29 . 2009-06-25 21:16 447864 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090709.001\IDSxpx86.dll 2009-07-12 16:29 . 2009-06-25 21:16 396848 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090709.001\IDSviA64.sys 2009-07-12 16:29 . 2009-06-25 21:16 292912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090709.001\IDSvix86.sys 2009-07-12 16:29 . 2009-06-25 21:16 276344 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090709.001\IDSXpx86.sys 2009-07-12 16:28 . 2009-06-25 21:16 533880 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll 2009-07-12 16:28 . 2009-06-25 21:16 447864 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.dll 2009-07-12 16:28 . 2009-06-25 21:16 276344 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSXpx86.sys 2009-07-12 16:28 . 2009-06-25 21:16 396848 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSviA64.sys 2009-07-12 16:28 . 2009-06-25 21:16 292912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys 2009-07-12 16:00 . 2009-07-12 16:00 -------- d-----w- c:\program files\Trend Micro 2009-07-12 14:11 . 2009-07-12 14:11 -------- d-----w- c:\program files\CCleaner 2009-07-12 12:22 . 2009-07-14 14:03 -------- d-----w- c:\program files\Glary Utilities 2009-07-12 12:09 . 2009-07-12 12:08 25136 ----a-r- c:\windows\system32\drivers\SymIMV.sys 2009-07-12 12:08 . 2009-07-14 14:03 -------- d-----w- c:\program files\Symantec 2009-07-12 12:08 . 2009-07-12 12:08 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2009-07-12 12:08 . 2009-07-12 12:08 1290584 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll 2009-07-12 12:08 . 2009-07-12 12:08 136840 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll 2009-07-12 12:08 . 2009-07-12 12:08 165240 ----a-r- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll 2009-07-12 12:07 . 2009-07-12 12:07 800112 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll 2009-07-12 12:06 . 2009-07-13 18:36 -------- d-----w- c:\windows\system32\drivers\NAV 2009-07-12 12:06 . 2009-07-12 12:07 -------- d-----w- c:\program files\Norton AntiVirus 2009-07-12 12:06 . 2009-07-12 12:10 -------- d-----w- c:\programdata\Norton 2009-07-12 12:06 . 2009-07-12 12:06 -------- d-----w- c:\program files\NortonInstaller 2009-07-12 12:06 . 2009-07-12 12:06 -------- d-----w- c:\programdata\NortonInstaller 2009-07-12 11:55 . 2009-07-12 12:14 -------- d-----w- c:\windows\BDOSCAN8 2009-07-10 20:36 . 2009-07-11 15:54 -------- d-----w- c:\programdata\Kaspersky Lab 2009-07-07 16:27 . 2009-07-06 20:39 103424 ----a-w- c:\users\queen butterfly\AppData\Roaming\Mozilla\Firefox\Profiles\2nadie4l.default\extensions\piclens@cooliris.com\libs\pixomatic.dll 2009-07-07 16:27 . 2009-07-06 20:39 937984 ----a-w- c:\users\queen butterfly\AppData\Roaming\Mozilla\Firefox\Profiles\2nadie4l.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe 2009-07-07 16:27 . 2009-07-06 20:39 106496 ----a-w- c:\users\queen butterfly\AppData\Roaming\Mozilla\Firefox\Profiles\2nadie4l.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll 2009-07-07 16:27 . 2009-07-06 20:39 65536 ----a-w- c:\users\queen butterfly\AppData\Roaming\Mozilla\Firefox\Profiles\2nadie4l.default\extensions\piclens@cooliris.com\components\coolirisstub.dll 2009-07-07 16:26 . 2009-07-06 20:39 344064 ----a-w- c:\users\queen butterfly\AppData\Roaming\Mozilla\Firefox\Profiles\2nadie4l.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe 2009-07-07 16:26 . 2009-07-06 20:39 4722688 ----a-w- c:\users\queen butterfly\AppData\Roaming\Mozilla\Firefox\Profiles\2nadie4l.default\extensions\piclens@cooliris.com\libs\cooliris19.dll 2009-07-05 19:18 . 2009-07-11 17:01 -------- d-----w- c:\users\Public\Games 2009-06-30 19:27 . 2009-06-30 19:27 -------- d-----w- c:\programdata\hps 2009-06-30 19:08 . 2009-06-30 19:11 -------- d-----w- c:\users\queen butterfly\.jordan 2009-06-24 20:29 . 2009-06-24 20:37 -------- d-----w- c:\users\queen butterfly\AppData\Roaming\BSplayer 2009-06-24 20:29 . 2009-06-24 20:29 -------- d-----w- c:\users\queen butterfly\AppData\Roaming\BSplayer Pro 2009-06-24 20:29 . 2009-06-24 20:29 -------- d-----w- c:\program files\Webteh 2009-06-23 15:47 . 2009-06-23 15:47 -------- d-----w- c:\program files\iPod 2009-06-23 15:44 . 2009-06-23 15:45 -------- d-----w- c:\program files\QuickTime 2009-06-23 15:40 . 2009-06-23 15:40 75048 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe 2009-06-19 21:08 . 2009-06-19 21:08 -------- d-----w- c:\program files\DAEMON Tools Lite 2009-06-16 17:11 . 2008-06-04 06:34 25768 ----a-w- c:\windows\system32\drivers\s1018nd5.sys 2009-06-16 17:10 . 2008-06-04 06:34 10792 ----a-w- c:\windows\system32\drivers\s1018cr.sys 2009-06-16 17:10 . 2008-06-04 06:34 117544 ----a-w- c:\windows\system32\drivers\s1018unic.sys 2009-06-16 11:31 . 2008-06-04 06:34 115368 ----a-w- c:\windows\system32\drivers\s1018mgmt.sys 2009-06-16 11:25 . 2008-06-04 06:34 111784 ----a-w- c:\windows\system32\drivers\s1018obex.sys 2009-06-16 11:20 . 2008-06-04 06:34 12200 ----a-w- c:\windows\system32\drivers\s1018cmnt.sys 2009-06-16 11:20 . 2008-06-04 06:34 12200 ----a-w- c:\windows\system32\drivers\s1018cm.sys 2009-06-16 11:20 . 2008-06-04 06:34 122024 ----a-w- c:\windows\system32\drivers\s1018mdm.sys 2009-06-16 11:20 . 2008-06-04 06:34 15016 ----a-w- c:\windows\system32\drivers\s1018mdfl.sys 2009-06-16 11:19 . 2008-06-04 06:34 90408 ----a-w- c:\windows\system32\drivers\s1018bus.sys 2009-06-16 11:19 . 2008-06-04 06:34 12200 ----a-w- c:\windows\system32\drivers\s1018whnt.sys 2009-06-16 11:19 . 2008-06-04 06:34 12200 ----a-w- c:\windows\system32\drivers\s1018wh.sys . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-15 16:07 . 2008-10-12 06:06 28789 ----a-w- c:\programdata\nvModes.dat 2009-07-15 16:05 . 2008-08-24 21:38 1401 ----a-w- c:\windows\bthservsdp.dat 2009-07-15 15:48 . 2009-06-09 17:42 11904 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys 2009-07-15 14:29 . 2009-07-15 14:29 3774 ----a-r- c:\users\queen butterfly\AppData\Roaming\Microsoft\Installer\{5E7C721D-B008-4269-A1C4-2CE7E9757983}\BoneTown.exe 2009-07-15 14:29 . 2009-07-15 14:29 10134 ----a-r- c:\users\queen butterfly\AppData\Roaming\Microsoft\Installer\{5E7C721D-B008-4269-A1C4-2CE7E9757983}\SystemFolder_msiexec.exe 2009-07-15 14:29 . 2009-07-15 14:28 -------- d-----w- c:\program files\BoneTown 2009-07-14 21:55 . 2008-11-24 11:12 -------- d-----w- c:\users\queen butterfly\AppData\Roaming\FileZilla 2009-07-14 14:49 . 2008-08-25 07:25 670314 ----a-w- c:\windows\system32\perfh013.dat 2009-07-14 14:49 . 2008-08-25 07:25 127900 ----a-w- c:\windows\system32\perfc013.dat 2009-07-14 14:03 . 2008-11-24 22:41 -------- d-----w- c:\users\queen butterfly\AppData\Roaming\Winamp 2009-07-14 14:03 . 2008-08-24 22:00 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-07-12 12:10 . 2008-08-24 22:00 -------- d-----w- c:\programdata\Symantec 2009-07-12 12:08 . 2009-07-12 12:08 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF 2009-07-12 12:08 . 2009-07-12 12:08 10635 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT 2009-07-12 08:56 . 2009-01-25 20:23 -------- d-----w- c:\users\queen butterfly\AppData\Roaming\uTorrent 2009-07-11 17:05 . 2008-08-24 21:48 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-11 15:57 . 2008-11-20 21:04 -------- d-----w- c:\users\queen butterfly\AppData\Roaming\Skype 2009-07-11 08:41 . 2008-11-29 10:48 -------- d-----w- c:\users\queen butterfly\AppData\Roaming\skypePM 2009-07-10 20:39 . 2008-12-05 18:05 -------- d-----w- c:\program files\Mozilla Thunderbird 2009-07-01 08:46 . 2008-11-25 11:26 -------- d-----w- c:\programdata\FLEXnet 2009-06-23 15:47 . 2008-12-02 10:08 -------- d-----w- c:\program files\iTunes 2009-06-23 15:47 . 2008-11-30 11:57 -------- d-----w- c:\program files\Common Files\Apple 2009-06-22 20:50 . 2008-12-01 20:39 -------- d-----w- c:\users\queen butterfly\AppData\Roaming\LimeWirePlus 2009-06-20 19:35 . 2008-11-14 16:10 107368 ----a-w- c:\users\queen butterfly\AppData\Local\GDIPFONTCACHEV1.DAT 2009-06-20 18:19 . 2009-02-02 11:46 -------- d-----w- c:\program files\Belastingdienst 2009-06-20 18:15 . 2009-03-29 16:10 -------- d-----w- c:\programdata\Albumprinter Pro Editor 2009-06-19 18:17 . 2009-05-14 11:35 2828 --sha-w- c:\windows\system32\KGyGaAvL.sys 2009-06-19 18:17 . 2009-05-14 11:43 88 --sh--r- c:\windows\system32\38B57615AB.sys 2009-06-14 09:05 . 2009-06-14 09:05 -------- d-----w- c:\programdata\BVRP Software 2009-06-14 08:55 . 2009-06-14 08:55 -------- d-----w- c:\programdata\WindowsSearch 2009-06-13 08:38 . 2009-06-13 08:38 -------- d-----w- c:\program files\twhirl 2009-06-12 08:57 . 2009-06-12 08:57 -------- d-----w- c:\users\queen butterfly\AppData\Roaming\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1 2009-06-12 08:48 . 2009-06-12 08:48 -------- d-----w- c:\users\queen butterfly\AppData\Roaming\Snitter.88C687E32FFE9452F058A6F4E67005F998FC3136.1 2009-06-11 21:58 . 2008-11-14 16:00 -------- d-----w- c:\program files\Microsoft Works 2009-06-11 21:56 . 2008-11-14 16:03 -------- d-----w- c:\programdata\Microsoft Help 2009-06-09 17:45 . 2009-06-09 17:45 12800 ----a-w- c:\windows\system32\bootdelete.exe 2009-06-09 17:45 . 2009-06-09 17:42 -------- d-----w- c:\programdata\Hitman Pro 2009-06-09 17:42 . 2009-06-09 17:42 -------- d-----w- c:\program files\Hitman Pro 3.5 2009-06-08 10:19 . 2009-03-08 18:22 -------- d-----w- c:\program files\Google 2009-06-05 18:53 . 2009-06-05 18:53 -------- d-----w- c:\programdata\Electronic Arts 2009-06-05 18:43 . 2009-06-05 18:43 10134 ----a-r- c:\users\queen butterfly\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe 2009-06-05 18:43 . 2009-06-05 18:43 -------- d-----w- c:\program files\Microsoft WSE 2009-06-05 09:42 . 2009-06-05 09:42 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-06-05 09:42 . 2009-06-05 09:42 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-06-02 06:00 . 2008-11-24 21:07 -------- d-----w- c:\program files\Messenger Plus! Live 2009-05-23 19:25 . 2006-11-02 12:37 -------- d-----w- c:\program files\MSBuild 2009-05-23 19:24 . 2009-05-23 19:24 -------- d-----w- c:\program files\Microsoft.NET 2009-05-23 19:20 . 2009-05-23 19:20 -------- d-----w- c:\program files\Microsoft Visual Studio 8 2009-05-18 11:28 . 2008-08-24 22:37 -------- d-----w- c:\programdata\WildTangent 2009-05-18 11:20 . 2008-11-20 20:34 -------- d-----w- c:\program files\Windows Live 2009-05-15 08:02 . 2008-11-26 09:33 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-04-24 16:05 . 2009-06-11 08:08 827904 ----a-w- c:\windows\system32\wininet.dll 2009-04-24 16:02 . 2009-06-11 08:08 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-24 13:44 . 2009-06-11 08:08 26624 ----a-w- c:\windows\system32\ieUnatt.exe 2009-04-23 12:43 . 2009-06-11 08:08 784896 ----a-w- c:\windows\system32\rpcrt4.dll 2009-04-23 12:42 . 2009-06-11 08:08 636928 ----a-w- c:\windows\system32\localspl.dll 2009-04-21 11:55 . 2009-06-11 08:08 2033152 ----a-w- c:\windows\system32\win32k.sys 2009-04-16 21:29 . 2009-04-16 21:29 1107296 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll 2009-04-16 21:29 . 2009-04-16 21:29 24616 ----a-w- c:\windows\system32\drivers\ggsemc.sys 2009-04-16 21:29 . 2009-04-16 21:29 13224 ----a-w- c:\windows\system32\drivers\ggflt.sys 2009-06-13 08:20 . 2008-11-29 11:52 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll 2008-08-25 07:29 . 2008-08-25 07:27 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "AdobeBridge"="" [bU] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-14 13535776] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-14 92704] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752] "Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552] "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-09-11 446556] "DXM6Patch_981116"="c:\windows\p_981116.exe" [1998-11-30 497376] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-09-21 55824] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-1-29 784912] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer1"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\cdfbfa0516e5cd0.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{D64D8E87-3F0E-49C9-99A7-675D5A2584EF}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play "{A9D799CD-F4C3-4F8F-A8A6-DB8A46C2A9AA}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program "{C362F409-F66E-4E95-8A30-F3DFBE983C68}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{DA964C26-3D3A-4ED4-943A-E088161FF079}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{D21B4151-4F70-472E-A378-9409AC0BF6F5}"= UDP:c:\program files\Winamp Remote\bin\Orb.exe:Orb "{8AD12E68-E5DE-4330-A80E-1C2C1EAF16AF}"= TCP:c:\program files\Winamp Remote\bin\Orb.exe:Orb "{9C57792E-4E09-478D-A9F4-8A4F1C538EEB}"= UDP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray "{1CC82997-82C5-461E-9330-E4516BD5A24D}"= TCP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray "{5C8DCA8C-01CF-4244-923E-6ADE4C910EB1}"= UDP:c:\program files\Winamp Remote\bin\OrbIR.exe:OrbIR "{E8724BA8-6C32-4A1E-AAB1-8EA0CA41E2B9}"= TCP:c:\program files\Winamp Remote\bin\OrbIR.exe:OrbIR "{655FCC97-7FC7-4959-BD29-3BD75F3B6919}"= UDP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{88E23DE8-F035-4FB0-8C37-D9B0D91E648E}"= TCP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{0BF91D44-41A9-4200-A84B-45E825DE8CE9}"= UDP:990:LocalSubnet:LocalSubnet|IF={3E59049A-7113-4BA7-92CE-59CF25EEB6B8}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001 "{8CB05912-115B-403F-8FA1-906A6F1039B0}"= UDP:c:\program files\LimeWire Plus\LimeWire.exe:LimeWire "{C53242B7-1E81-413D-80DD-12BECF5E8DD9}"= TCP:c:\program files\LimeWire Plus\LimeWire.exe:LimeWire "{3C44B8A2-5743-4F6D-8825-2256BD4B79D7}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{2F173EDD-36DD-4CBA-A434-CD944097713B}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{4CBE64B7-581B-4011-9519-D867A36D8149}"= UDP:5353:Adobe CSI CS4 "{F2A8F02A-124A-4CDE-9E5F-24454977E120}"= UDP:3703:Adobe Version Cue CS4 Server "{7F08888F-7AA7-4AE6-9CFB-F2DB4B456FAB}"= UDP:3704:Adobe Version Cue CS4 Server "{8EC46E6A-6151-463B-A921-134228B40CE9}"= UDP:51000:Adobe Version Cue CS4 Server "{D3CCF19C-98B1-4BC2-909B-BB025E6CBE74}"= UDP:51001:Adobe Version Cue CS4 Server "{708A6284-48A6-49FA-8CE4-C7455D590204}"= UDP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server "{A4F0FDF8-C78E-4C5B-A11B-30844C6DC928}"= TCP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server "{C01D97CD-A554-4270-80F8-9373C6705C68}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4 "{6AC8F263-7883-4BF3-A780-FFE524BA6A19}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4 "{0856E018-F333-4C8A-9178-2C473AF2D21C}"= Disabled:UDP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server "{7128EEDD-3180-40A1-9359-1B13ADCF57DD}"= Disabled:TCP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server "{CB9B0E00-A20E-4F92-8BEC-0CF51CC61AF0}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{C9AB368D-586C-4C62-B10E-0A0872C2594B}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{1B813A4F-53F8-434C-AEF7-B249C3DCCC20}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{33BD1384-6337-48A3-8935-CB78DEB5EDE1}"= UDP:990:LocalSubnet:LocalSubnet|IF={509927BF-2C97-4277-A8B8-A869CD69AEEE}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001 "{98C99A10-AC61-4062-AFCE-7B8042E802D9}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{81EE942E-63F1-4336-AA80-720F6AE5E419}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{250301A8-088F-4A26-B50D-5C4C2B9A882E}"= Disabled:UDP:c:\program files\Skype\Phone\Skype.exe:Skype "{443459B8-4E86-4E00-9A42-944FCD44C9C3}"= Disabled:TCP:c:\program files\Skype\Phone\Skype.exe:Skype R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\NAV\1002000.007\SymEFA.sys [12-7-2009 14:08 309296] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\drivers\NAV\1002000.007\BHDrvx86.sys [12-7-2009 14:08 255536] R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\NAV\1002000.007\cchpx86.sys [12-7-2009 14:08 362544] R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090709.001\IDSvix86.sys [12-7-2009 18:29 292912] R2 {22D78859-9CE9-4B77-BF18-AC83E81A9263};{22D78859-9CE9-4B77-BF18-AC83E81A9263};c:\program files\HP\QuickPlay\000.fcl [25-8-2008 0:17 59376] R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [11-9-2007 1:45 124832] R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\AEstSrv.exe [10-12-2008 17:51 77824] R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [21-1-2008 4:23 21504] R2 hpsrv;HP Service;c:\windows\System32\hpservice.exe [18-3-2008 16:24 19456] R2 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe [12-7-2009 14:08 115560] R2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [25-8-2008 1:15 361808] R3 enecir;ENE CIR Receiver;c:\windows\System32\drivers\enecir.sys [24-1-2008 15:23 52736] R3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [8-7-2008 12:16 96856] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [14-5-2008 4:09 43552] R3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\NAV\1002000.007\symndisv.sys [12-7-2009 14:08 40496] S1 cdfbfa0516e5cd0;cdfbfa0516e5cd0;c:\windows\System32\drivers\cdfbfa0516e5cd0.sys [21-1-2008 4:25 68608] S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15-8-2008 6:46 284016] S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [25-8-2008 0:24 193840] S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\System32\drivers\ggflt.sys [16-4-2009 23:29 13224] S3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\System32\drivers\hitmanpro35.sys [9-6-2009 19:42 11904] S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\System32\drivers\s1018bus.sys [16-6-2009 13:19 90408] S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\System32\drivers\s1018mdfl.sys [16-6-2009 13:20 15016] S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\System32\drivers\s1018mdm.sys [16-6-2009 13:20 122024] S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s1018mgmt.sys [16-6-2009 13:31 115368] S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\System32\drivers\s1018nd5.sys [16-6-2009 19:11 25768] S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\System32\drivers\s1018obex.sys [16-6-2009 13:25 111784] S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\System32\drivers\s1018unic.sys [16-6-2009 19:10 117544] S3 s3017bus;Sony Ericsson Device 3017 driver (WDM);c:\windows\System32\drivers\s3017bus.sys [20-11-2008 21:53 83880] S3 s3017mdfl;Sony Ericsson Device 3017 USB WMC Modem Filter;c:\windows\System32\drivers\s3017mdfl.sys [20-11-2008 22:10 15016] S3 s3017mdm;Sony Ericsson Device 3017 USB WMC Modem Driver;c:\windows\System32\drivers\s3017mdm.sys [20-11-2008 22:10 110632] S3 s3017mgmt;Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s3017mgmt.sys [20-11-2008 21:59 104616] S3 s3017nd5;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (NDIS);c:\windows\System32\drivers\s3017nd5.sys [20-11-2008 21:47 25512] S3 s3017obex;Sony Ericsson Device 3017 USB WMC OBEX Interface;c:\windows\System32\drivers\s3017obex.sys [20-11-2008 22:14 100648] S3 s3017unic;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM);c:\windows\System32\drivers\s3017unic.sys [20-11-2008 22:04 110120] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs ezSharedSvc . Inhoud van de 'Gedeelde Taken' map 2009-07-15 c:\windows\Tasks\GlaryInitialize.job - c:\program files\Glary Utilities\initialize.exe [2009-07-12 14:55] . . ------- Bijkomende Scan ------- . uInternet Settings,ProxyOverride = *.local IE: Afbeelding verzenden naar &Bluetooth-apparaat... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Annoteren met Bamboo Link - c:\program files\Wacom\Bamboo Link\AnnotateWithErgo.html IE: Converteren naar Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: Doel van koppeling converteren naar Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Doel van koppeling toevoegen aan bestaande PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Pagina verzenden naar &Bluetooth-apparaat... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: Toevoegen aan bestaande PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html FF - ProfilePath - c:\users\queen butterfly\AppData\Roaming\Mozilla\Firefox\Profiles\2nadie4l.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q= FF - prefs.js: browser.search.selectedEngine - Live Search FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?referrer=ign FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q= FF - component: c:\users\queen butterfly\AppData\Roaming\Mozilla\Firefox\Profiles\2nadie4l.default\extensions\piclens@cooliris.com\components\coolirisstub.dll FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll FF - plugin: c:\users\queen butterfly\AppData\Roaming\Mozilla\Firefox\Profiles\2nadie4l.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2009-07-15 18:08 Windows 6.0.6001 Service Pack 1 NTFS scannen van verborgen processen ... scannen van verborgen autostart items ... scannen van verborgen bestanden ... Scan succesvol afgerond verborgen bestanden: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Norton AntiVirus] "ImagePath"="\"c:\program files\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Engine\16.2.0.7\diMaster.dll\" /prefetch:1" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{22D78859-9CE9-4B77-BF18-AC83E81A9263}] "ImagePath"="\??\c:\program files\HP\QuickPlay\000.fcl" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- [HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info] @Denied: (2) (LocalSystem) "PackageTag"=dword:d8638897 "AppDataDir"="c:\\ProgramData\\ESET\\ESET Smart Security\\" "DataDir"="ESET\\ESET Smart Security\\" "EditionName"=" " "InstallDir"="c:\\Program Files\\ESET\\ESET Smart Security\\" "LanguageId"=dword:00000413 "ProductBase"=dword:00000001 "ProductCode"="{B05C29C5-C9A4-45C4-A8E9-F8385E3D5B45}" "ProductName"="ESET Smart Security" "ProductType"="ess" "ProductVersion"="4.0.437.0" "UniqueId"="0013ACB34A577CCA" "ScannerBuild"=dword:00001329 "ScannerVersionId"=dword:00000feb "ScannerVersion"="4075 (20090514)" "FixId"=dword:00000002 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Geladen Onder Lopende Processen --------------------- - - - - - - - > 'Explorer.exe'(2316) c:\program files\Logitech\SetPoint\GameHook.dll c:\program files\Logitech\SetPoint\lgscroll.dll c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll . ------------------------ Andere Aktieve Processen ------------------------ . c:\windows\System32\nvvsvc.exe c:\windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\stacsv.exe c:\windows\System32\audiodg.exe c:\windows\System32\rundll32.exe c:\program files\Common Files\LogiShrd\Bluetooth\LBTServ.exe c:\windows\System32\wlanext.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\System32\PSIService.exe c:\program files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe c:\program files\HP\QuickPlay\Kernel\TV\QPSched.exe c:\program files\Logitech\SetPoint\LBTWiz.exe c:\windows\System32\conime.exe c:\windows\System32\rundll32.exe c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe c:\windows\ehome\ehmsas.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\program files\Hitman Pro 3.5\HitmanPro35.exe c:\program files\Hewlett-Packard\Shared\HpqToaster.exe c:\program files\Common Files\microsoft shared\ink\InputPersonalization.exe c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe . ************************************************************************** . Voltooingstijd: 2009-07-15 18:19 - machine werd herstart ComboFix-quarantined-files.txt 2009-07-15 16:19 Pre-Run: 219.104.899.072 bytes beschikbaar Post-Run: 218.870.693.888 bytes beschikbaar 408 --- E O F --- 2009-07-10 05:09

Na de scan heeft hij geen combofix.txt opgeslagen wat wel moest , Echter krijg ik met afsluiten nu standaard een blauw scherm en mijn geluid speelt wel af maar ik hoor niets op mijn laptop (hp dv7 1160ed) Hieronder wel een hijack logje: ---------------------------------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:51:53, on 13-7-2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18248) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Logitech\SetPoint\LBTWiz.exe C:\Windows\System32\rundll32.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Windows\WindowsMobile\wmdSync.exe C:\Program Files\IDT\WDM\sttray.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE C:\Program Files\Last.fm\LastFM.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = mijnAOL | HP R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe O4 - HKLM\..\Run: [sysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~2\Server\bin\VERSIO~2.EXE O4 - HKLM\..\Run: [DXM6Patch_981116] C:\Windows\p_981116.exe /Q:A O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: Afbeelding verzenden naar &Bluetooth-apparaat... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Annoteren met Bamboo Link - C:\Program Files\Wacom\Bamboo Link\AnnotateWithErgo.html O8 - Extra context menu item: Converteren naar Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Doel van koppeling converteren naar Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Doel van koppeling toevoegen aan bestaande PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Pagina verzenden naar &Bluetooth-apparaat... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O8 - Extra context menu item: Toevoegen aan bestaande PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O13 - Gopher Prefix: O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\aestsrv.exe O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\Windows\system32\Hpservice.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing) O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\STacSV.exe -- End of file - 9520 bytes

Sinds een aantal dagen krijg ik bij elk programma die ik of windows opstart een melding: "bestand/programma naam" - Ongeldige installatie kopie globalroot\systemroot\system32\hjgruicvqkxtde.dll is niet geschikt voor Windows of het bevat een fout. probeer het programma opnieuw te installeren met behulp van de oorspronkelijke installatie media of neem contact op met de systeembeheerder of softwareleverancier voor ondersteuning. Ik probeer diverse scanprogramma's er overheen te laten, maar die stoppen allemaal na een tijdje. Ook heb ik gisteren al 2x een blauwe scherm melding gehad die lijd naar dat ene dll bestandje. Ik ben eigenlijk wel ten einde raad en heb daarom een hijack logje gemaakt in de hoop dat jullie mij kunnen helpen: Hijacklogje: ------------------------------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:01:03, on 12-7-2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18248) Boot mode: Normal Running processes: C:\Program Files\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Windows\System32\rundll32.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Windows\WindowsMobile\wmdSync.exe C:\Program Files\IDT\WDM\sttray.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\QuickTime\QTTask.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\twhirl\twhirl.exe C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe C:\Windows\system32\Dwm.exe C:\Users\queen butterfly\Desktop\HitmanPro35.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\conime.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = mijnAOL | HP R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.2.0.7\IPSBHO.DLL O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe O4 - HKLM\..\Run: [sysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~2\Server\bin\VERSIO~2.EXE O4 - HKLM\..\Run: [DXM6Patch_981116] C:\Windows\p_981116.exe /Q:A O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: Afbeelding verzenden naar &Bluetooth-apparaat... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Annoteren met Bamboo Link - C:\Program Files\Wacom\Bamboo Link\AnnotateWithErgo.html O8 - Extra context menu item: Converteren naar Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Doel van koppeling converteren naar Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Doel van koppeling toevoegen aan bestaande PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Pagina verzenden naar &Bluetooth-apparaat... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O8 - Extra context menu item: Toevoegen aan bestaande PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O13 - Gopher Prefix: O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\aestsrv.exe O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\Windows\system32\Hpservice.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing) O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\STacSV.exe -- End of file - 9902 bytes