snoks12

Pff, een stuk rustiger op mijn compu geworden... Hierbij de mwb-log: Malwarebytes' Anti-Malware 1.46 Malwarebytes Databaseversie: 4161 Windows 6.0.6002 Service Pack 2 Internet Explorer 7.0.6002.18005 1-6-2010 22:37:36 mbam-log-2010-06-01 (22-37-36).txt Scantype: Snelle scan Objecten gescand: 150640 Verstreken tijd: 9 minuut/minuten, 0 seconde(n) Geheugenprocessen geïnfecteerd: 1 Geheugenmodulen geïnfecteerd: 0 Registersleutels geïnfecteerd: 12 Registerwaarden geïnfecteerd: 12 Registerdata geïnfecteerd: 1 Mappen geïnfecteerd: 1 Bestanden geïnfecteerd: 107 Geheugenprocessen geïnfecteerd: C:\RECYCLER\S-1-5-21-6332008111-1561667415-380559042-1683\mgrls32.exe (Worm.Autorun. -> Unloaded process successfully. Geheugenmodulen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registersleutels geïnfecteerd: HKEY_CLASSES_ROOT\AppID\{38061edc-40bb-4618-a8da-e56353347e6d} (Adware.EZlife) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\{7b6a2552-e65b-4a9e-add4-c45577ffd8fd} (Adware.EZLife) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\M5T8QL3YW3 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\QZAIB7KITK (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully. Registerwaarden geïnfecteerd: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mpkcomka (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12cfg214-k641-12sf-n85p (Worm.Autorun. -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mpkcomka (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell (Worm.AutoRun) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oijpjwtk (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tucseotc (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ggsmothe (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lgmlswya (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrjovbf (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qnosrkwi (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jqhjvqwi (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> Quarantined and deleted successfully. Registerdata geïnfecteerd: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (C:\RECYCLER\S-1-5-21-2016670394-9591193587-918921124-1875\mgrls32.exe,C:\RECYCLER\S-1-5-21-6332008111-1561667415-380559042-1683\mgrls32.exe,C:\RECYCLER\S-1-5-21-4192392071-3139007611-464556117-3515\mgrls32.exe,C:\RECYCLER\S-1-5-21-2639675593-4403551773-923167266-2320\mgrls32.exe,C:\RECYCLER\S-1-5-21-7239614884-6926513032-549165320-3055\mgrls32.exe,C:\RECYCLER\S-1-5-21-4087039021-2001018283-973878229-4191\mgrls32.exe,C:\RECYCLER\S-1-5-21-1965554726-0557768395-368092185-5321\mgrls32.exe,C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe,explorer.exe,C:\RECYCLER\S-1-5-21-7904278565-8364839039-616190046-3952\mgrls32.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully. Mappen geïnfecteerd: C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811 (Trojan.Agent) -> Quarantined and deleted successfully. Bestanden geïnfecteerd: C:\Users\Yuk Sie\mpkcomka.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe (Worm.Autorun. -> Quarantined and deleted successfully. C:\Windows\System32\mpkcomka.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\RECYCLER\S-1-5-21-1965554726-0557768395-368092185-5321\mgrls32.exe (Worm.Autorun. -> Quarantined and deleted successfully. C:\RECYCLER\S-1-5-21-2016670394-9591193587-918921124-1875\mgrls32.exe (Worm.Autorun. -> Quarantined and deleted successfully. C:\RECYCLER\S-1-5-21-2639675593-4403551773-923167266-2320\mgrls32.exe (Worm.Autorun. -> Delete on reboot. C:\RECYCLER\S-1-5-21-4087039021-2001018283-973878229-4191\mgrls32.exe (Worm.Autorun. -> Delete on reboot. C:\RECYCLER\S-1-5-21-4192392071-3139007611-464556117-3515\mgrls32.exe (Worm.Autorun. -> Quarantined and deleted successfully. C:\RECYCLER\S-1-5-21-6332008111-1561667415-380559042-1683\mgrls32.exe (Worm.Autorun. -> Delete on reboot. C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe (Worm.Autorun. -> Quarantined and deleted successfully. C:\RECYCLER\S-1-5-21-7239614884-6926513032-549165320-3055\mgrls32.exe (Worm.Autorun. -> Quarantined and deleted successfully. C:\RECYCLER\S-1-5-21-7904278565-8364839039-616190046-3952\mgrls32.exe (Worm.Autorun. -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\vpbkr.exe (Virus.Virut) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM1526.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM1535.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM1776.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM2A8A.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM2B35.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM2DC4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM37A.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM3DBA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM4A97.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM4DE0.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM55BD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM6A09.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM7D3A.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM7FAA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM8ED6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TM99BF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TMAA13.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TMB201.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TMB2DA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TMB865.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TMCBD7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TMD356.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TMD48E.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TMD98C.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TMDBED.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TMDEBB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TME022.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TME790.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\~TMEEF0.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\d06a33ac.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\d66063ed.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\dbe4cf84.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\e8292c14.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\e83007ed.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\f6bad057.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\f8328f8a.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\347.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\368.exe (Trojan.Downloader) -> Delete on reboot. C:\Users\Yuk Sie\AppData\Local\Temp\3d6e9eb5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\446.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\459.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\482458b6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\489328d0.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\496.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\4da4c072.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\517.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\524.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\530.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\546.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\550.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\558.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\awkvrft.exe (Trojan.Oficla) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\011.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\0ae4ce62.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\100.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\106.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\111.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\153.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\184.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\185.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\186.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\20be11a7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\226.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\248.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\252.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\257.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\316.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\343.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\imiyus.exe (Trojan.Oficla) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\janfw.exe (Virus.Virut) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\589.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\598.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\600.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\710ddec7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\761.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\763.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\831.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\864.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\884.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\8980ffd4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\926.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\952.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\955.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\958.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\a004a9aa.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Local\Temp\a6b63a00.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\Desktop\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Roaming\Microsoft\Windows\Start Menu\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully. C:\Users\Yuk Sie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Doctor.lnk (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully. C:\Windows\System32\sshnas21.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Quarantined and deleted successfully. En de HJT-log: Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 22:52:27, on 1-6-2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v7.00 (7.00.6002.18005) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Windows\System32\rundll32.exe C:\Windows\PLFSetI.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\McAfee\Common Framework\UdaterUI.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\Apoint2K\ApMsgFwd.exe C:\Program Files\Apoint2K\Apntex.exe C:\Users\YUKSIE~1\AppData\Local\Temp\RtkBtMnt.exe C:\Program Files\McAfee\Common Framework\McTray.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Windows\system32\NOTEPAD.EXE C:\Windows\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Yahoo! UK & Ireland R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Yahoo! UK & Ireland R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Yahoo! UK & Ireland R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKCU\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O17 - HKLM\System\CCS\Services\Tcpip\..\{1906F51C-326F-4712-ADA6-86937004F43D}: NameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{1906F51C-326F-4712-ADA6-86937004F43D}: NameServer = 192.168.1.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 7710 bytes Blij dat ik van de wormen en paarden met virussen af ben! enorm bedankt!

Komt-ie dan (kostte even moeite door alle virus- en foutmeldingen): Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 21:40:14, on 1-6-2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v7.00 (7.00.6002.18005) Boot mode: Normal Running processes: C:\Windows\RtHDVCpl.exe C:\Windows\System32\rundll32.exe C:\Windows\PLFSetI.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\McAfee\Common Framework\UdaterUI.exe C:\Windows\System32\regsvr32.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\uTorrent\uTorrent.exe C:\Windows\System32\rundll32.exe C:\Users\Yuk Sie\AppData\Roaming\C024448F3981114A5EDB045945DD15AB\gotnewupdate000.exe C:\Program Files\McAfee\Common Framework\McTray.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Apoint2K\ApMsgFwd.exe C:\Windows\System32\regedit.exe C:\Program Files\Apoint2K\Apntex.exe C:\Users\YUKSIE~1\AppData\Local\Temp\RtkBtMnt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\WerFault.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\WerFault.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\WerFault.exe C:\Windows\system32\WerFault.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\WerFault.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\Explorer.EXE C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe C:\Windows\system32\DllHost.exe C:\RECYCLER\S-1-5-21-6682770782-9530995253-412219321-2596\mgrls32.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Yahoo! UK & Ireland R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Yahoo! UK & Ireland R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Yahoo! UK & Ireland R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: voguecash browser enhancer - {E6A5FC0F-4081-F713-400F-A52AC2B705A0} - C:\Windows\system32\pzutzsdpvdsoaxq.dll O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file) O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [skb] rundll32 "ssjsqfpt.dll",,Run O4 - HKLM\..\Run: [kngjaadbdob] C:\Windows\System32\regsvr32.exe /s "C:\Windows\system32\pzutzsdpvdsoaxq.dll" O4 - HKLM\..\Run: [Regedit32] C:\Windows\system32\regedit.exe O4 - HKLM\..\Run: [mpkcomka] C:\Windows\System32\mpkcomka.exe O4 - HKCU\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [Halo2] rundll32.exe C:\Windows\system32\sshnas21.dll,GetMainWnd O4 - HKCU\..\Run: [gotnewupdate000.exe] C:\Users\Yuk Sie\AppData\Roaming\C024448F3981114A5EDB045945DD15AB\gotnewupdate000.exe O4 - HKCU\..\Run: [M5T8QL3YW3] C:\Users\YUKSIE~1\AppData\Local\Temp\Fwi.exe O4 - HKCU\..\Run: [12CFG214-K641-12SF-N85P] C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe O4 - HKCU\..\Run: [mpkcomka] C:\Users\Yuk Sie\mpkcomka.exe O4 - HKCU\..\Run: [dqptxqmr] C:\Users\Yuk Sie\AppData\Local\qsdedhfcl\hmrcfiatssd.exe O4 - HKCU\..\Run: [btkqjgkk] C:\Users\Yuk Sie\AppData\Local\exsxfcmyw\hwyuxittssd.exe O4 - HKCU\..\Run: [sdwvbouc] C:\Users\Yuk Sie\AppData\Local\flpijpdru\ivafdjmtssd.exe O4 - HKCU\..\Run: [npaboblc] C:\Users\Yuk Sie\AppData\Local\frccllkqk\ifniscutssd.exe O4 - HKCU\..\Run: [jljbswft] C:\Users\Yuk Sie\AppData\Local\gylsodulr\itbphlftssd.exe O4 - HKCU\..\Run: [mdupufwk] C:\Users\Yuk Sie\AppData\Local\yxwfsvvin\imtbmfdtssd.exe O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Startup: Antimalware Doctor.lnk = C:\Users\Yuk Sie\AppData\Roaming\C024448F3981114A5EDB045945DD15AB\gotnewupdate000.exe O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O17 - HKLM\System\CCS\Services\Tcpip\..\{1906F51C-326F-4712-ADA6-86937004F43D}: NameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{1906F51C-326F-4712-ADA6-86937004F43D}: NameServer = 192.168.1.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 11872 bytes

Beste mensen, Ik heb een antimalware doctor te pakken. McAffee is niet in staat om deze te verwijderen. Mag ik alvast een Hijacklog opsturen, zoals de anderen?