buffalo18

7 mei 2012

Probleem is intussen al opgelost, voorlopig toch. Toch nog een vraagje, onderaan het logje zie ik veel (file missing) bij toch belangrijke bestanden? Kan dit geen kwaad?

7 mei 2012

Ik heb denk ik een Trojaans paard op m'n pc staan. Mijn browser doet raar (chrome), als ik op vorige klik bijvoorbeeld sluit hij de pagina. Bij taakbeheer verschijnen de toepassingen, processen en services voor een halve seconde om dan te verdwijnen/verschijnen/verdwijnen... Ik ben nu een scan aan het doen met avast. Hieronder een logje van HijackThis

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 11:38:25, on 7/05/2012

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16421)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe

C:\Users\Klaas\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Users\Klaas\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Users\Klaas\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Klaas\Downloads\HijackThis.exe

C:\Windows\SysWOW64\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Dell Official Site - The Power To Do More | Dell

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Dell Official Site - The Power To Do More | Dell

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {87775fdb-6972-41f9-ae51-8326e38cb206} - (no file)

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O2 - BHO: Aanmeldhulp voor Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Softonic Helper Object - {E87806B5-E908-45FD-AF5E-957D83E58E68} - C:\Program Files (x86)\Softonic\Softonic\1.5.21.0\bh\Softonic.dll

O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll

O3 - Toolbar: Softonic Toolbar - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Program Files (x86)\Softonic\Softonic\1.5.21.0\SoftonicTlbr.dll

O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O4 - HKLM\..\Run: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

O4 - HKLM\..\RunOnce: [installShieldSetup] C:\PROGRA~2\INSTAL~1\{399C3~1\setup.exe -rebootC:\PROGRA~2\INSTAL~1\{399C3~1\reboot.ini -l0x13

O4 - HKCU\..\Run: [Google Update] "C:\Users\Klaas\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

O4 - Startup: Dropbox.lnk = Klaas\AppData\Roaming\Dropbox\bin\Dropbox.exe

O4 - Global Startup: McAfee Security Scan Plus.lnk = ?

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 11273 bytes

21 januari 2012

Je kan het even proberen zonder ... maar anders wordt het zoeken geblazen ;-)

Is gestart, maar euhm, nu kan ik daar geen cd meer van maken zeker? Als er evt. bestanden weg zijn?

21 januari 2012

Dan gaan we de essentiële Windows-bestanden even controleren. Tik in zoekopdracht de volgende opdracht sfc /scannow in en laat dit runnen. Onderweg wordt normaal gevraagd naar de Windows-CD. Hou deze alvast bij de hand.

Euhm Windows-cd? Ik heb nooit een Windows-cd gezien hoor. Windows 7 was gewoon geïnstalleerd, maar heb daar nooit cd van gezien. Ik herinner me wel dat hij me vroeg om een soort van cd te maken, waarschijnlijk voor dit soort gevallen. Maar waar die ligt..? Geen idee denk ik..

21 januari 2012

En ... maakt dit enig verschil ?

Bwa, probeerde zonet een PDF te openen, 5 minuten later was hij open . Dus niet echt nee, misschien pc nog eens herstarten, maar daarnet duurde het ook weer zeer lang tegen dat ik eindelijk pc kon gebruiken. Bureaublad verschijnt wel heel snel maar dan blokkeert hij precies. En 5 minuten later schiet alles in gang .

Toch bedankt voor de hulp...

21 januari 2012

a2scan_120121-105242

Emsisoft Emergency Kit - Versie 1.0

Laatste Update: 1/21/2012 10:51:40 AM

Scaninstellingen:

Scantype: Diepe Scan

Objecten: Geheugen, Sporen, Cookies, C:\, H:\

Scan archieven: Aan

Heuristieken: Uit

ADS Scan: Aan

Scan gestart: 1/21/2012 10:52:42 AM

c:\programdata\microsoft\windows\start menu\programs\cain Ontdekt: Trace.Directory.Cain!A2

c:\program files (x86)\cain Ontdekt: Trace.Directory.Cain!A2

c:\windows\system32\drivers\imon Ontdekt: Trace.Directory.AllMonitor!A2

Key: HKEY_LOCAL_MACHINE\software\Classes\Interface\{AEBF09E2-0C15-43C8-99BF-928C645D98A0} Ontdekt: Trace.Registry.ShoppingReports!A2

Key: HKEY_LOCAL_MACHINE\software\Classes\Interface\{AEBF09E2-0C15-43C8-99BF-928C645D98A0}\ProxyStubClsid32 Ontdekt: Trace.Registry.ShoppingReports!A2

Key: HKEY_LOCAL_MACHINE\software\Classes\Interface\{AEBF09E2-0C15-43C8-99BF-928C645D98A0}\TypeLib Ontdekt: Trace.Registry.ShoppingReports!A2

c:\windows\system32\drivers\imon\bar.jpg Ontdekt: Trace.File.AllMonitor!A2

Key: HKEY_CURRENT_USER\software\cain\settings Ontdekt: Trace.Registry.Cain!A2

Key: HKEY_LOCAL_MACHINE\software\classes\interface\{1d4db7d3-6ec9-47a3-bd87-1e41684e07bb} Ontdekt: Trace.Registry.IBISToolbar!A2

C:\Users\Klaas\AppData\Roaming\Microsoft\Windows\Cookies\klaas@doubleclick[1].txt Ontdekt: Trace.TrackingCookie.doubleclick!A2

C:\Users\Klaas\AppData\Roaming\Microsoft\Windows\Cookies\klaas@serving-sys[1].txt Ontdekt: Trace.TrackingCookie.serving-sys!A2

C:\Users\Klaas\AppData\Roaming\Microsoft\Windows\Cookies\klaas@serving-sys[2].txt Ontdekt: Trace.TrackingCookie.serving-sys!A2

Gescand

Bestanden: 104005

Sporen: 403649

Cookies: 140

Processen: 60

Gevonden

Bestanden: 0

Sporen: 9

Cookies: 3

Processen: 0

Registersleutels: 0

Scan Geëindigd: 1/21/2012 1:42:37 PM

Scantijd: 2:49:55

C:\Users\Klaas\AppData\Roaming\Microsoft\Windows\Cookies\klaas@serving-sys[1].txt Verwijderd Trace.TrackingCookie.serving-sys!A2

C:\Users\Klaas\AppData\Roaming\Microsoft\Windows\Cookies\klaas@serving-sys[2].txt Verwijderd Trace.TrackingCookie.serving-sys!A2

C:\Users\Klaas\AppData\Roaming\Microsoft\Windows\Cookies\klaas@doubleclick[1].txt Verwijderd Trace.TrackingCookie.doubleclick!A2

Key: HKEY_LOCAL_MACHINE\software\classes\interface\{1d4db7d3-6ec9-47a3-bd87-1e41684e07bb} Verwijderd Trace.Registry.IBISToolbar!A2

Key: HKEY_CURRENT_USER\software\cain\settings Verwijderd Trace.Registry.Cain!A2

c:\windows\system32\drivers\imon\bar.jpg Verwijderd Trace.File.AllMonitor!A2

Key: HKEY_LOCAL_MACHINE\software\Classes\Interface\{AEBF09E2-0C15-43C8-99BF-928C645D98A0} Verwijderd Trace.Registry.ShoppingReports!A2

Key: HKEY_LOCAL_MACHINE\software\Classes\Interface\{AEBF09E2-0C15-43C8-99BF-928C645D98A0}\ProxyStubClsid32 Verwijderd Trace.Registry.ShoppingReports!A2

Key: HKEY_LOCAL_MACHINE\software\Classes\Interface\{AEBF09E2-0C15-43C8-99BF-928C645D98A0}\TypeLib Verwijderd Trace.Registry.ShoppingReports!A2

c:\windows\system32\drivers\imon Verwijderd Trace.Directory.AllMonitor!A2

c:\programdata\microsoft\windows\start menu\programs\cain Verwijderd Trace.Directory.Cain!A2

c:\program files (x86)\cain Verwijderd Trace.Directory.Cain!A2

Verwijderd

Bestanden: 0

Sporen: 9

Cookies: 3

21 januari 2012

Traagheid is er nog steeds, maar is precies wel beter. Alles start precies met een lag op. Ik open verschillende programma's, het duurt zeer lang voor er iets opent, maar plots openen ze allemaal. Ook bij herstarten was pc zeer traag (programma's laden enzo), maar dan plots wel gebruiksklaar.

ComboFix 12-01-19.02 - Klaas 21/01/2012 9:15:41.2.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.32.1043.18.4091.2650 [GMT 1:00]

Gestart vanuit: C:\Users\Klaas\Desktop\ComboFix.exe

gebruikte Opdracht switches :: C:\Users\Klaas\Desktop\CFScript.txt

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

(((((((((((((((((((( Bestanden Gemaakt van 2011-12-21 to 2012-01-21 ))))))))))))))))))))))))))))))

2012-01-21 08:34:03 . 2012-01-21 08:34:03 -------- d-----w- C:\Users\Default\AppData\Local\temp

2012-01-20 16:44:04 . 2012-01-20 16:44:06 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-01-20 08:34:41 . 2012-01-06 05:15:20 8602168 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3DA80C37-7514-4C5C-B4F9-D7CDB0CF24FC}\mpengine.dll

2012-01-11 07:47:15 . 2011-10-26 05:25:16 1572864 ----a-w- C:\Windows\system32\quartz.dll

2012-01-11 07:47:15 . 2011-10-26 05:25:15 366592 ----a-w- C:\Windows\system32\qdvd.dll

2012-01-11 07:47:15 . 2011-10-26 04:32:11 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll

2012-01-11 07:47:15 . 2011-10-26 04:32:11 1328128 ----a-w- C:\Windows\SysWow64\quartz.dll

2012-01-11 07:47:13 . 2011-11-19 14:58:00 77312 ----a-w- C:\Windows\system32\packager.dll

2012-01-11 07:47:13 . 2011-11-19 14:01:00 67072 ----a-w- C:\Windows\SysWow64\packager.dll

2012-01-11 07:47:13 . 2011-11-17 06:41:18 1731920 ----a-w- C:\Windows\system32\ntdll.dll

2012-01-11 07:47:13 . 2011-11-17 05:38:39 1292080 ----a-w- C:\Windows\SysWow64\ntdll.dll

2012-01-08 11:20:38 . 2012-01-08 11:20:40 -------- d-----w- C:\Users\Klaas\AppData\Roaming\Stellarium

2012-01-08 11:20:01 . 2012-01-08 11:20:36 -------- d-----w- C:\Program Files (x86)\Stellarium

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

2011-12-10 14:24:08 . 2010-05-22 18:08:47 23152 ----a-w- C:\Windows\system32\drivers\mbam.sys

2011-12-06 20:34:22 . 2011-12-06 20:34:22 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2011-11-24 04:52:09 . 2011-12-14 16:14:14 3145216 ----a-w- C:\Windows\system32\win32k.sys

2011-11-15 13:29:56 . 2009-10-25 21:51:11 270720 ------w- C:\Windows\system32\MpSigStub.exe

2011-11-05 05:32:50 . 2011-12-14 16:14:06 2048 ----a-w- C:\Windows\system32\tzres.dll

2011-11-05 04:26:03 . 2011-12-14 16:14:06 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2011-11-04 01:53:39 . 2011-12-15 02:01:56 2309120 ----a-w- C:\Windows\system32\jscript9.dll

2011-11-04 01:44:47 . 2011-12-15 02:01:56 1390080 ----a-w- C:\Windows\system32\wininet.dll

2011-11-04 01:44:21 . 2011-12-15 02:01:56 1493504 ----a-w- C:\Windows\system32\inetcpl.cpl

2011-11-04 01:34:43 . 2011-12-15 02:02:00 2382848 ----a-w- C:\Windows\system32\mshtml.tlb

2011-11-03 22:47:42 . 2011-12-15 02:01:56 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll

2011-11-03 22:40:21 . 2011-12-15 02:01:56 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2011-11-03 22:39:47 . 2011-12-15 02:01:56 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll

2011-11-03 22:31:57 . 2011-12-15 02:02:00 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2011-10-29 10:56:39 . 2011-10-29 10:56:39 189248 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe

2011-10-29 10:56:38 . 2011-10-29 10:56:38 75136 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe

2011-10-26 05:21:20 . 2011-12-14 16:14:17 43520 ----a-w- C:\Windows\system32\csrsrv.dll

2006-05-03 09:06:54 163328 --sh--r- C:\Windows\SysWOW64\flvDX.dll

2007-02-21 10:47:16 31232 --sh--r- C:\Windows\SysWOW64\msfDX.dll

2008-03-16 12:30:52 216064 --sh--r- C:\Windows\SysWOW64\nbDX.dll

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-08-07 09:18:12 120104 ----a-w- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NVIDIA nTune"="C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" [2008-08-18 08:01:50 145408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"EgisTecLiveUpdate"="C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 21:09:34 199464]

"LManager"="C:\Program Files (x86)\Launch Manager\LManager.exe" [2009-08-27 20:47:18 1200136]

"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 13:49:28 249064]

"ConnectionCenter"="C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" [2011-08-11 11:27:02 358336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux7"=wdmaud.drv

R0 Lbd;Lbd;C:\Windows\system32\DRIVERS\Lbd.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 12:16:28 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 13:27:14 138576]

R2 gupdate;Google Updateservice (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-01-31 11:55:36 135664]

R2 MWLService;MyWinLocker Service;C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-08-07 09:18:54 311592]

R2 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-21 00:25:50 62720]

R2 WDSmartWareBackgroundService;WD SmartWare Background Service;C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [2009-06-16 08:58:08 20480]

R3 AF9035BDA;Cinergy T-Stick service;C:\Windows\system32\DRIVERS\AF9035BDA.sys [x]

R3 gupdatem;Google Update-service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-01-31 11:55:36 135664]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\Drivers\RtsUStor.sys [x]

R3 RtsUIR;Realtek IR Driver;C:\Windows\system32\DRIVERS\Rts516xIR.sys [x]

R3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 11:37:14 517096]

R3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys [x]

R3 WatAdminSvc;Windows Activation Technologies-service;C:\Windows\system32\Wat\WatAdminSvc.exe [x]

S0 sptd;sptd;C:\Windows\System32\Drivers\sptd.sys [x]

S1 ctxusbm;Citrix USB Monitor Driver;C:\Windows\system32\DRIVERS\ctxusbm.sys [x]

S1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [x]

S1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [x]

S1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys [x]

S2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe [2009-07-14 01:39:46 27136]

S2 ePowerSvc;Acer ePower Service;C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-08-19 05:40:12 796192]

S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);C:\Windows\system32\Drivers\FPSensor.sys [x]

S2 Greg_Service;GRegService;C:\Program Files (x86)\Acer\Registration\GregHSRW.exe [2009-06-04 13:04:50 1150496]

S2 IGBASVC;EgisTec Service;c:\Program Files (x86)\Acer Bio Protection\BASVC.exe [2009-08-06 05:21:04 3450368]

S2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Program Files (x86)\Trust\Trust R-series Mouse And Keyboard\KMWDSrv.exe [2007-02-28 16:12:12 208896]

S2 LVPrcS64;Process Monitor;C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2009-10-06 23:47:10 191000]

S2 NPF;NetGroup Packet Filter Driver;C:\Windows\system32\drivers\npf.sys [x]

S2 NPF_devolo;NetGroup Packet Filter Driver (devolo);C:\Windows\sysWOW64\drivers\npf_devolo.sys [2010-06-10 12:32:14 34048]

S2 RS_Service;Raw Socket Service;C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [2009-07-10 09:54:44 253952]

S2 TunngleService;TunngleService;C:\Program Files (x86)\Tunngle\TnglCtrl.exe [2010-09-14 10:47:24 716024]

S2 Updater Service;Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 01:47:12 240160]

S2 vpnagent;Cisco AnyConnect VPN Agent;C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [2009-02-03 20:39:09 427192]

S2 WDDMService;WD SmartWare Drive Manager Service;C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2009-10-14 13:31:44 116224]

S3 hidshim;Service for HID-KMDF Shim layer;C:\Windows\system32\DRIVERS\hidshim.sys [x]

S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\k57nd60a.sys [x]

S3 LVPr2M64;Logitech LVPr2M64 Driver;C:\Windows\system32\DRIVERS\LVPr2M64.sys [x]

S3 LVUSBS64;Logitech USB Monitor Filter;C:\Windows\system32\drivers\LVUSBS64.sys [x]

S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys [x]

S3 nuvotonhidgeneric;Nuvoton EC Generic HID;C:\Windows\system32\DRIVERS\nuvotonhidgeneric.sys [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys [x]

S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);C:\Windows\system32\DRIVERS\tap0901t.sys [x]

S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\system32\DRIVERS\wdcsam64.sys [x]

S3 WSDPrintDevice;WSD-ondersteuning voor afdrukken via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys [x]

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

Akamai REG_MULTI_SZ Akamai

Inhoud van de 'Gedeelde Taken' map

2012-01-20 C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1200137767-1035772069-1397413781-1000Core.job

- C:\Users\Klaas\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-11-30 17:00:52 . 2011-11-30 17:00:51]

2012-01-21 C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1200137767-1035772069-1397413781-1000UA.job

- C:\Users\Klaas\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-11-30 17:00:52 . 2011-11-30 17:00:51]

2012-01-21 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-01-31 14:15:26 . 2010-01-31 11:55:36]

2012-01-21 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-01-31 14:15:26 . 2010-01-31 11:55:36]

2012-01-19 C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1200137767-1035772069-1397413781-1000Core.job

- C:\Users\Klaas\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-19 15:39:07 . 2010-06-16 17:30:33]

2012-01-21 C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1200137767-1035772069-1397413781-1000UA.job

- C:\Users\Klaas\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-19 15:39:07 . 2010-06-16 17:30:33]

--------- x86-64 -----------

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-08-07 09:19:54 137512 ----a-w- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 02:03:32 186904]

"RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-06 02:32:06 8060960]

"SynTPEnh"="C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe" [bU]

------- Bijkomende Scan -------

uLocal Page = C:\Windows\system32\blank.htm

mLocal Page = C:\Windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.0.1

DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} - hxxps://asavpn1.ugent.be/CACHE/stc/11/binaries/vpnweb.cab

FF - ProfilePath - C:\Users\Klaas\AppData\Roaming\Mozilla\Firefox\Profiles\gukytds7.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

- - - - ORPHANS VERWIJDERD - - - -

Toolbar-Locked - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)

21 januari 2012

Ook uitgevoerd

ComboFix 12-01-19.02 - Klaas 21/01/2012 8:02:28.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.32.1043.18.4091.2740 [GMT 1:00]

Gestart vanuit: C:\Users\Klaas\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

C:\install.exe

c:\Program Files (x86)\Acer Bio Protection\PwdFilterV64.dll

C:\Program Files (x86)\Common Files\Acer GameZone online.ico

C:\Users\Klaas\AppData\Roaming\Microsoft\Windows\Recent\ChattChitto.url

C:\Users\Klaas\AppData\Roaming\Sdat.exe

C:\Windows\SysWow64\drivers\imon\anti_end.dll

C:\Windows\SysWow64\drivers\imon\browse_setting.ini

C:\Windows\SysWow64\drivers\imon\gdiplus.dll

C:\Windows\SysWow64\drivers\imon\imonsmtp.exe

C:\Windows\SysWow64\drivers\imon\install_lsp.exe

C:\Windows\SysWow64\drivers\imon\th_imgbrowser.ocx

C:\Windows\SysWow64\drivers\imon\uninstall.exe

C:\Windows\SysWow64\drivers\imon\wodSmtp.ocx

(((((((((((((((((((( Bestanden Gemaakt van 2011-12-21 to 2012-01-21 ))))))))))))))))))))))))))))))

2012-01-21 07:23:28 . 2012-01-21 07:23:28 -------- d-----w- C:\Users\Default\AppData\Local\temp