andreharderwijk

Nee, geen enkele verbetering. Ik zal waarschijnlijk opnieuw moeten installeren? In welk geval dan ook harstikke bedankt he voor de hulp

Er flitst een zwart scherm voorbij als ik dat heb gedaan, maar voor de rest niks. (ik doe dit in veilige modus)

Ik heb hier een CD, maar heb geen idee of dit de goede is. Ik zal eerlijk zijn, ben heel slordig met dat soort spullen. Heb mijn pc nog nooit moeten reboote/systeem herstel ofzo. Op de CD staat: Alleen voor levering bij nieuwe pc's. Neem voor productondersteuning contact op met de fabrikant van uw pc. CDrom1 Versie 2005. Ik doe mijn best, In elk geval 100% bedankt voor alle hulp tot nutoe

ComboFix 10-10-04.02 - Administrator 05-10-2010 18:34:05.5.2 - x86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1252.31.1043.18.2046.1764 [GMT 2:00] Gestart vanuit: c:\documents and settings\Administrator\Bureaublad\ComboFix.exe gebruikte Opdracht switches :: c:\documents and settings\Administrator\Mijn documenten\CFScript.txt..txt AV: avast! antivirus 4.7.942 [VPS 000724-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} AV: NOD32 antivirus systeem 2.51 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\winlogon.exe . . . is geïnfecteerd!! Besmet exemplaar van c:\windows\explorer.exe werd aangetroffen en gedesinfecteerd Hersteld exemplaar van - c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe Besmet exemplaar van c:\windows\system32\msgsvc.dll werd aangetroffen en gedesinfecteerd Hersteld exemplaar van - c:\windows\ERDNT\cache\msgsvc.dll . (((((((((((((((((((( Bestanden Gemaakt van 2010-09-05 to 2010-10-05 )))))))))))))))))))))))))))))) . 2010-10-04 14:40 . 2010-10-04 14:40 388096 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2010-10-04 05:38 . 2010-10-05 16:32 -------- d--h--r- c:\documents and settings\Administrator\Onlangs geopend 2010-09-28 13:03 . 2010-09-28 12:59 14383616 ----a-w- C:\gta_sa.exe 2010-09-19 17:03 . 2010-09-19 17:03 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Opera 2010-09-19 17:03 . 2010-09-19 17:03 -------- d-----w- c:\program files\Opera 2010-09-15 16:13 . 2010-09-15 16:13 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Threat Expert 2010-09-15 15:47 . 2010-08-30 11:57 767952 ----a-w- c:\windows\BDTSupport.dll 2010-09-15 15:47 . 2010-08-23 07:36 149456 ----a-w- c:\windows\SGDetectionTool.dll 2010-09-15 15:47 . 2008-11-26 09:08 131 ----a-w- c:\windows\IDB.zip 2010-09-15 15:47 . 2010-08-30 11:57 739280 ----a-w- c:\windows\PCTBDRes.dll 2010-09-15 15:45 . 2010-09-15 15:45 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools 2010-09-15 15:44 . 2010-09-15 15:44 80729096 ----a-w- c:\documents and settings\All Users\Application Data\PC Tools\DownloadManager\Spyware Doctor8.0\sdsetup_aff_dl.exe 2010-09-15 15:44 . 2010-09-15 15:46 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-10-05 16:43 . 2007-06-20 17:22 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-10-05 13:57 . 2007-12-24 19:54 1324 ----a-w- c:\windows\system32\d3d9caps.dat 2010-10-04 20:13 . 2008-05-21 18:05 1 ----a-w- c:\documents and settings\Administrator\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys 2010-10-04 20:13 . 2008-05-21 18:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\OpenOffice.org2 2010-10-04 13:57 . 2009-07-26 23:06 -------- d-----w- c:\documents and settings\Administrator\Application Data\DNA 2010-10-04 05:40 . 2010-01-31 17:46 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent 2010-10-04 05:40 . 2010-08-07 21:42 -------- d-----w- c:\program files\League of Legends 2010-10-04 05:38 . 2009-07-26 23:06 -------- d-----w- c:\program files\DNA 2010-10-03 15:27 . 2009-08-25 19:55 -------- d-----w- c:\program files\Rockstar Games 2010-09-30 19:59 . 2010-03-11 22:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\LimeWirePlus 2010-09-29 12:26 . 2009-07-26 23:06 -------- d-----w- c:\program files\GamersFirst 2010-09-29 12:26 . 2010-05-11 18:58 -------- d-----w- c:\program files\Everest Poker 2010-09-29 12:23 . 2006-12-27 17:39 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-09-29 12:22 . 2009-12-02 19:11 -------- d-----w- c:\documents and settings\All Users\Application Data\ijjigame 2010-09-29 12:22 . 2010-08-15 20:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Gygan 2010-09-29 12:22 . 2009-10-24 22:00 -------- d-----w- c:\program files\Crossfire 2010-09-29 12:20 . 2009-09-13 19:35 -------- d-----w- c:\program files\CCleaner 2010-09-27 13:54 . 2010-01-31 17:47 -------- d-----w- c:\program files\uTorrent 2010-09-25 13:56 . 2009-03-15 12:16 -------- d-----w- c:\program files\Common Files\Symantec Shared 2010-09-18 09:44 . 2009-04-28 20:09 -------- d-----w- c:\program files\iTunes 2010-09-15 16:09 . 2010-09-15 15:45 -------- d-----w- c:\program files\PC Tools Security 2010-09-15 15:47 . 2010-09-15 15:45 -------- d-----w- c:\program files\Common Files\PC Tools 2010-09-15 15:46 . 2010-09-15 15:46 979746 ----a-w- c:\windows\system32\drivers\Cat.DB 2010-09-04 10:07 . 2010-07-18 21:47 -------- d-----w- c:\program files\TheSandyRavage 2010-09-04 09:18 . 2010-09-04 09:18 -------- d-----w- c:\program files\Trend Micro 2010-09-02 17:40 . 2010-07-30 21:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\DivX 2010-08-30 11:57 . 2010-09-15 15:47 1865680 ----a-w- c:\windows\PCTBDCore.dll 2010-08-28 09:25 . 2010-09-15 15:46 247824 ----a-w- c:\windows\system32\drivers\pctgntdi.sys 2010-08-27 14:29 . 2010-08-27 14:29 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2010-08-27 14:29 . 2010-08-27 14:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-27 14:29 . 2010-08-27 14:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-08-27 14:10 . 2010-08-27 14:10 110080 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{95431C66-CF9A-4913-BFFF-6050785AFB65}\IconF7A21AF7.exe 2010-08-27 14:10 . 2010-08-27 14:10 110080 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{95431C66-CF9A-4913-BFFF-6050785AFB65}\IconD7F16134.exe 2010-08-27 14:10 . 2010-08-27 14:10 -------- d-----w- c:\program files\Enigma Software Group 2010-08-27 14:09 . 2008-04-11 20:41 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-08-27 12:57 . 2010-07-30 21:50 57344 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll 2010-08-27 12:54 . 2010-08-27 12:54 144696 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.exe 2010-08-27 12:54 . 2010-07-30 21:50 1062184 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll 2010-08-27 12:54 . 2010-07-30 21:50 850200 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe 2010-08-27 08:13 . 2010-09-15 15:46 159296 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2010-08-27 06:26 . 2010-09-15 15:46 70536 ----a-w- c:\windows\system32\drivers\pctplsg.sys 2010-08-27 06:26 . 2010-09-15 15:46 123968 ----a-w- c:\windows\system32\drivers\pctplfw.sys 2010-08-27 06:25 . 2010-09-15 15:46 79672 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.sys 2010-08-26 07:30 . 2010-09-15 15:47 2074 ----a-w- c:\windows\UDB.zip 2010-08-20 03:00 . 2007-01-02 20:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Ventrilo 2010-08-20 03:00 . 2009-03-11 20:35 -------- d-----w- c:\program files\SwiftKit 2010-08-20 03:00 . 2008-03-24 20:15 -------- d-----w- c:\program files\Teamspeak2_RC2 2010-08-20 03:00 . 2009-09-15 12:35 -------- d-----w- c:\program files\LimeWire 2010-08-20 03:00 . 2009-01-04 01:30 -------- d-----w- c:\program files\RivaTuner v2.22 2010-08-20 03:00 . 2008-07-05 20:50 -------- d-----w- c:\program files\PartyGaming 2010-08-18 11:51 . 2010-09-15 15:46 237632 ----a-w- c:\windows\system32\drivers\PCTCore.sys 2010-08-17 18:24 . 2010-08-17 18:24 -------- d-----w- c:\program files\Counter-Strike 1.6 2010-08-15 20:25 . 2010-08-15 20:25 -------- d-----w- c:\documents and settings\Administrator\Application Data\Stereoscopic Player 2010-08-15 20:24 . 2010-08-15 20:24 -------- d-----w- c:\program files\Stereoscopic Player 2010-08-15 20:16 . 2010-08-15 20:16 -------- d-----w- c:\program files\Xenocode 2010-08-15 20:10 . 2010-08-15 20:10 -------- d-----w- c:\program files\Virtools 2010-08-11 02:16 . 2009-04-10 20:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype 2010-08-10 15:34 . 2006-12-27 23:31 -------- d-----r- c:\program files\Skype 2010-08-10 15:34 . 2010-08-10 15:34 -------- d-----w- c:\program files\Common Files\Skype 2010-08-10 15:34 . 2006-12-27 23:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2010-08-10 15:33 . 2008-07-02 08:55 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM 2010-08-10 14:58 . 2010-09-15 15:46 31960 ----a-w- c:\windows\system32\drivers\pctNdis-DNS.sys 2010-08-07 22:01 . 2010-08-07 22:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\LolClient 2010-08-07 21:47 . 2010-08-07 21:46 -------- d-----w- c:\program files\Common Files\Adobe AIR 2010-08-07 21:31 . 2009-08-31 19:18 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files 2010-07-30 21:49 . 2010-07-30 21:49 54644 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TranscodeEngine\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 54101 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MPEG2Plugin\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 57409 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ControlPanel\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 52963 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 54073 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Qt4.5\Uninstaller.exe 2010-07-16 12:59 . 2010-09-15 15:46 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys 2010-07-16 12:59 . 2010-09-15 15:46 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys . ------- Sigcheck ------- [-] 2008-04-14 . 1247D4D5444E28519BBE31BE8AB4C029 . 510464 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\822ceb2331d0360bde8948c432c9beec\winlogon.exe [-] 2002-12-31 . E2E4199F218F09F10BB030318FF13ECE . 504832 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [-] 2008-04-14 . AA04F042A820BF1868E643575887E1A6 . 1037312 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\822ceb2331d0360bde8948c432c9beec\explorer.exe [-] 2007-06-13 . ABDBD248791E9D639A199AE5F347EB02 . 1036800 . . [6.00.2900.3156] . . c:\windows\explorer.exe [7] 2007-06-13 . 1D6245AFBD3FAABC16A885116BE1874D . 1036800 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe [7] 2002-12-31 . A1D7304A87FC3093150F5E3CC7B0F338 . 1035776 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe [-] 2008-04-14 . E0AEF86A594C9990D6321C5CA239C5B7 . 297472 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\822ceb2331d0360bde8948c432c9beec\termsrv.dll c:\windows\System32\termsrv.dll ... is niet aanwezig !! . ((((((((((((((((((((((((((((( SnapShot@2010-10-04_17.14.17 ))))))))))))))))))))))))))))))))))))))))) . + 2010-10-05 16:43 . 2010-10-05 16:43 16384 c:\windows\temp\Perflib_Perfdata_6a4.dat . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Octoshape Streaming Services"="c:\program files\Octoshape Streaming Services\Administrator\OctoshapeClient.exe" [2006-02-13 214648] "ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2010-09-24 1786168] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-09-26 328056] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-13 323392] "Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-02-06 135664] "Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-08-02 2937528] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-06-20 77824] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-06 148888] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-20 8429568] "nwiz"="nwiz.exe" [2007-04-20 1626112] "SW20"="c:\windows\system32\sw20.exe" [2006-02-06 208896] "SW24"="c:\windows\system32\sw24.exe" [2006-02-06 69632] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2006-12-27 921600] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776] "JMB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-08-14 352256] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-20 81920] "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2007-05-21 124512] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-08-20 1164584] "PCTools FGuard"="c:\program files\PC Tools Security\BDT\FGuard.exe" [2010-08-23 100304] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2002-12-31 15360] [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programma's^Opstarten^LimeWire On Startup.lnk] path=c:\documents and settings\Administrator\Menu Start\Programma's\Opstarten\LimeWire On Startup.lnk backup=c:\windows\pss\LimeWire On Startup.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^GamersFirst LIVE!.lnk] path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\GamersFirst LIVE!.lnk backup=c:\windows\pss\GamersFirst LIVE!.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3] 2009-12-26 12:48 2335952 ----a-w- c:\program files\IObit\Advanced SystemCare 3\AWC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] 2010-02-17 17:37 177472 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] 2009-11-13 15:05 323392 ----a-w- c:\program files\DNA\btdna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] 2009-07-26 14:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-03-18 20:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2010-05-13 14:12 26192168 ----a-r- c:\program files\Skype\Phone\Skype.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"= "c:\\Nexon\\NEXON_EU_Downloader\\NEXON_EU_Downloader_Engine.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\NexonEU\\NGM\\NGM.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\LimeWire Plus\\LimeWire.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Program Files\\League of Legends\\Air\\LolClient.exe"= "c:\\Program Files\\League of Legends\\Game\\League of Legends.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Opera\\opera.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "58715:TCP"= 58715:TCP:Pando Media Booster "58715:UDP"= 58715:UDP:Pando Media Booster "57042:TCP"= 57042:TCP:Pando Media Booster "57042:UDP"= 57042:UDP:Pando Media Booster "8394:TCP"= 8394:TCP:League of Legends Launcher "8394:UDP"= 8394:UDP:League of Legends Launcher "6881:TCP"= 6881:TCP:League of Legends Launcher "6881:UDP"= 6881:UDP:League of Legends Launcher "6967:TCP"= 6967:TCP:League of Legends Launcher "6967:UDP"= 6967:UDP:League of Legends Launcher "6991:TCP"= 6991:TCP:League of Legends Launcher "6991:UDP"= 6991:UDP:League of Legends Launcher "6927:TCP"= 6927:TCP:League of Legends Launcher "6927:UDP"= 6927:UDP:League of Legends Launcher R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [11-2-2010 18:46 5248] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [15-9-2010 17:46 237632] R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [15-9-2010 17:46 338880] R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [15-9-2010 17:46 656320] S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [8-1-2010 1:51 380928] S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools Security\BDT\BDTUpdateService.exe [15-9-2010 17:47 235472] S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [27-1-2010 18:10 5248] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\PC Tools Security\pctsAuxs.exe [15-9-2010 17:45 366840] S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [11-2-2010 18:46 160640] . Inhoud van de 'Gedeelde Taken' map 2010-10-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50] 2010-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1647877149-725345543-500Core.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-02-06 20:30] 2010-10-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1647877149-725345543-500UA.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-02-06 20:30] 2010-10-04 c:\windows\Tasks\Norton Security Scan for Administrator.job - c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-05-09 07:48] . . ------- Bijkomende Scan ------- . uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s LSP: c:\windows\system32\imon.dll LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2d8n1pnt.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://radiobar.toolbarhome.com/?hp=df FF - prefs.js: keyword.URL - hxxp://nl.search.yahoo.com/search?ei=utf-8&fr=megaup&p= ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- [HKEY_USERS\S-1-5-21-1482476501-1647877149-725345543-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,99,0c,5b,bb,51,e5,6d,4d,89,15,ab,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,99,0c,5b,bb,51,e5,6d,4d,89,15,ab,\ [HKEY_USERS\S-1-5-21-1482476501-1647877149-725345543-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:0a,04,dc,73,bf,65,7f,aa,66,96,4a,c4,66,4d,ff,2e,80,61,df,d8,49,2b,37, 26,73,a9,47,69,0c,3d,cc,4a,30,67,84,08,4e,a0,cf,55,dc,10,7c,97,c1,9c,fc,3b,\ "??"=hex:51,26,68,11,bc,f8,f9,83,2f,7f,08,b5,c7,73,36,4c [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Geladen Onder Lopende Processen --------------------- - - - - - - - > 'winlogon.exe'(816) c:\windows\system32\sfc_os.dll - - - - - - - > 'explorer.exe'(1008) c:\windows\system32\sfc_os.dll . Voltooingstijd: 2010-10-05 19:13:21 - machine werd herstart ComboFix-quarantined-files.txt 2010-10-05 17:13 ComboFix2.txt 2010-10-05 14:08 ComboFix3.txt 2010-10-04 18:57 ComboFix4.txt 2010-10-04 17:19 Pre-Run: 14.250.663.936 bytes beschikbaar Post-Run: 14.239.928.320 bytes beschikbaar - - End Of File - - F804B8581254D9F1173204EDB33A7235 Bedankt alvast voor de reacties, Er is nog steeds een zwart scherm.

ik probeer hem even normaal op te starten ---------- Post toegevoegd om 17:44 ---------- Vorige post was om 17:40 ---------- Nee, nog niet verholpen. Ik kan wel screens maken denk ik, ik probeer het even ---------- Post toegevoegd om 17:45 ---------- Vorige post was om 17:44 ---------- Nee geen succes, kan geen paint opstarten natuurlijk.

ComboFix 10-10-04.02 - Administrator 05-10-2010 15:52:30.4.2 - x86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1252.31.1043.18.2046.1761 [GMT 2:00] Gestart vanuit: c:\documents and settings\Administrator\Bureaublad\ComboFix.exe gebruikte Opdracht switches :: c:\documents and settings\Administrator\Mijn documenten\CFScript.txt..txt AV: avast! antivirus 4.7.942 [VPS 000724-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} AV: NOD32 antivirus systeem 2.51 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} FILE :: "c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{26B03CED-4E5A-4057-BCF9-EE80B13FCF94}\_853F67D554F05449430E7E.exe" "c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{26B03CED-4E5A-4057-BCF9-EE80B13FCF94}\_C0C391FA20561A5BDDEDC2.exe" "c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{26B03CED-4E5A-4057-BCF9-EE80B13FCF94}\_C727DF8DB5218D337B8AAB.exe" "c:\windows\Qwagob.exe" "c:\windows\system32\drivers\yswlfky.sys" "e:\fxdrv32.sys" . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{26B03CED-4E5A-4057-BCF9-EE80B13FCF94}\_853F67D554F05449430E7E.exe c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{26B03CED-4E5A-4057-BCF9-EE80B13FCF94}\_C0C391FA20561A5BDDEDC2.exe c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{26B03CED-4E5A-4057-BCF9-EE80B13FCF94}\_C727DF8DB5218D337B8AAB.exe c:\program files\PHPNukeDU c:\program files\PHPNukeDU\PHPNukeDUToolbarHelper.exe c:\program files\PHPNukeDU\tbPHP1.dll c:\program files\PHPNukeDU\tbPHPN.dll c:\program files\PHPNukeDU\toolbar.cfg c:\program files\PHPNukeDU\UNWISE.EXE c:\program files\ToggleDU c:\program files\ToggleDU\tbTog1.dll c:\program files\ToggleDU\tbTogg.dll c:\program files\ToggleDU\ToggleDUToolbarHelper.exe c:\program files\ToggleDU\toolbar.cfg c:\program files\ToggleDU\UNWISE.EXE c:\windows\Qwagob.exe c:\windows\system32\winlogon.exe . . . is geïnfecteerd!! Besmet exemplaar van c:\windows\explorer.exe werd aangetroffen en gedesinfecteerd Hersteld exemplaar van - c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe Besmet exemplaar van c:\windows\system32\msgsvc.dll werd aangetroffen en gedesinfecteerd Hersteld exemplaar van - c:\windows\ERDNT\cache\msgsvc.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_FXDRV32 -------\Service_FXDrv32 -------\Service_vtaevi (((((((((((((((((((( Bestanden Gemaakt van 2010-09-05 to 2010-10-05 )))))))))))))))))))))))))))))) . 2010-10-04 14:40 . 2010-10-04 14:40 388096 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2010-10-04 05:38 . 2010-10-05 13:57 -------- d--h--r- c:\documents and settings\Administrator\Onlangs geopend 2010-09-28 13:03 . 2010-09-28 12:59 14383616 ----a-w- C:\gta_sa.exe 2010-09-19 17:03 . 2010-09-19 17:03 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Opera 2010-09-19 17:03 . 2010-09-19 17:03 -------- d-----w- c:\program files\Opera 2010-09-15 16:13 . 2010-09-15 16:13 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Threat Expert 2010-09-15 15:47 . 2010-08-30 11:57 767952 ----a-w- c:\windows\BDTSupport.dll 2010-09-15 15:47 . 2010-08-23 07:36 149456 ----a-w- c:\windows\SGDetectionTool.dll 2010-09-15 15:47 . 2008-11-26 09:08 131 ----a-w- c:\windows\IDB.zip 2010-09-15 15:47 . 2010-08-30 11:57 739280 ----a-w- c:\windows\PCTBDRes.dll 2010-09-15 15:45 . 2010-09-15 15:45 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools 2010-09-15 15:44 . 2010-09-15 15:44 80729096 ----a-w- c:\documents and settings\All Users\Application Data\PC Tools\DownloadManager\Spyware Doctor8.0\sdsetup_aff_dl.exe 2010-09-15 15:44 . 2010-09-15 15:46 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-10-05 14:02 . 2007-06-20 17:22 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-10-05 13:57 . 2007-12-24 19:54 1324 ----a-w- c:\windows\system32\d3d9caps.dat 2010-10-04 20:13 . 2008-05-21 18:05 1 ----a-w- c:\documents and settings\Administrator\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys 2010-10-04 20:13 . 2008-05-21 18:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\OpenOffice.org2 2010-10-04 13:57 . 2009-07-26 23:06 -------- d-----w- c:\documents and settings\Administrator\Application Data\DNA 2010-10-04 05:40 . 2010-01-31 17:46 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent 2010-10-04 05:40 . 2010-08-07 21:42 -------- d-----w- c:\program files\League of Legends 2010-10-04 05:38 . 2009-07-26 23:06 -------- d-----w- c:\program files\DNA 2010-10-03 15:27 . 2009-08-25 19:55 -------- d-----w- c:\program files\Rockstar Games 2010-09-30 19:59 . 2010-03-11 22:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\LimeWirePlus 2010-09-29 12:26 . 2009-07-26 23:06 -------- d-----w- c:\program files\GamersFirst 2010-09-29 12:26 . 2010-05-11 18:58 -------- d-----w- c:\program files\Everest Poker 2010-09-29 12:23 . 2006-12-27 17:39 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-09-29 12:22 . 2009-12-02 19:11 -------- d-----w- c:\documents and settings\All Users\Application Data\ijjigame 2010-09-29 12:22 . 2010-08-15 20:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Gygan 2010-09-29 12:22 . 2009-10-24 22:00 -------- d-----w- c:\program files\Crossfire 2010-09-29 12:20 . 2009-09-13 19:35 -------- d-----w- c:\program files\CCleaner 2010-09-27 13:54 . 2010-01-31 17:47 -------- d-----w- c:\program files\uTorrent 2010-09-25 13:56 . 2009-03-15 12:16 -------- d-----w- c:\program files\Common Files\Symantec Shared 2010-09-18 09:44 . 2009-04-28 20:09 -------- d-----w- c:\program files\iTunes 2010-09-15 16:09 . 2010-09-15 15:45 -------- d-----w- c:\program files\PC Tools Security 2010-09-15 15:47 . 2010-09-15 15:45 -------- d-----w- c:\program files\Common Files\PC Tools 2010-09-15 15:46 . 2010-09-15 15:46 979746 ----a-w- c:\windows\system32\drivers\Cat.DB 2010-09-04 10:07 . 2010-07-18 21:47 -------- d-----w- c:\program files\TheSandyRavage 2010-09-04 09:18 . 2010-09-04 09:18 -------- d-----w- c:\program files\Trend Micro 2010-09-02 17:40 . 2010-07-30 21:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\DivX 2010-08-30 11:57 . 2010-09-15 15:47 1865680 ----a-w- c:\windows\PCTBDCore.dll 2010-08-28 09:25 . 2010-09-15 15:46 247824 ----a-w- c:\windows\system32\drivers\pctgntdi.sys 2010-08-27 14:29 . 2010-08-27 14:29 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2010-08-27 14:29 . 2010-08-27 14:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-27 14:29 . 2010-08-27 14:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-08-27 14:10 . 2010-08-27 14:10 110080 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{95431C66-CF9A-4913-BFFF-6050785AFB65}\IconF7A21AF7.exe 2010-08-27 14:10 . 2010-08-27 14:10 110080 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{95431C66-CF9A-4913-BFFF-6050785AFB65}\IconD7F16134.exe 2010-08-27 14:10 . 2010-08-27 14:10 -------- d-----w- c:\program files\Enigma Software Group 2010-08-27 14:09 . 2008-04-11 20:41 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-08-27 12:57 . 2010-07-30 21:50 57344 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll 2010-08-27 12:54 . 2010-08-27 12:54 144696 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.exe 2010-08-27 12:54 . 2010-07-30 21:50 1062184 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll 2010-08-27 12:54 . 2010-07-30 21:50 850200 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe 2010-08-27 08:13 . 2010-09-15 15:46 159296 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2010-08-27 06:26 . 2010-09-15 15:46 70536 ----a-w- c:\windows\system32\drivers\pctplsg.sys 2010-08-27 06:26 . 2010-09-15 15:46 123968 ----a-w- c:\windows\system32\drivers\pctplfw.sys 2010-08-27 06:25 . 2010-09-15 15:46 79672 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.sys 2010-08-26 07:30 . 2010-09-15 15:47 2074 ----a-w- c:\windows\UDB.zip 2010-08-20 03:00 . 2007-01-02 20:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Ventrilo 2010-08-20 03:00 . 2009-03-11 20:35 -------- d-----w- c:\program files\SwiftKit 2010-08-20 03:00 . 2008-03-24 20:15 -------- d-----w- c:\program files\Teamspeak2_RC2 2010-08-20 03:00 . 2009-09-15 12:35 -------- d-----w- c:\program files\LimeWire 2010-08-20 03:00 . 2009-01-04 01:30 -------- d-----w- c:\program files\RivaTuner v2.22 2010-08-20 03:00 . 2008-07-05 20:50 -------- d-----w- c:\program files\PartyGaming 2010-08-18 11:51 . 2010-09-15 15:46 237632 ----a-w- c:\windows\system32\drivers\PCTCore.sys 2010-08-17 18:24 . 2010-08-17 18:24 -------- d-----w- c:\program files\Counter-Strike 1.6 2010-08-15 20:25 . 2010-08-15 20:25 -------- d-----w- c:\documents and settings\Administrator\Application Data\Stereoscopic Player 2010-08-15 20:24 . 2010-08-15 20:24 -------- d-----w- c:\program files\Stereoscopic Player 2010-08-15 20:16 . 2010-08-15 20:16 -------- d-----w- c:\program files\Xenocode 2010-08-15 20:10 . 2010-08-15 20:10 -------- d-----w- c:\program files\Virtools 2010-08-11 02:16 . 2009-04-10 20:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype 2010-08-10 15:34 . 2006-12-27 23:31 -------- d-----r- c:\program files\Skype 2010-08-10 15:34 . 2010-08-10 15:34 -------- d-----w- c:\program files\Common Files\Skype 2010-08-10 15:34 . 2006-12-27 23:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2010-08-10 15:33 . 2008-07-02 08:55 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM 2010-08-10 14:58 . 2010-09-15 15:46 31960 ----a-w- c:\windows\system32\drivers\pctNdis-DNS.sys 2010-08-07 22:01 . 2010-08-07 22:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\LolClient 2010-08-07 21:47 . 2010-08-07 21:46 -------- d-----w- c:\program files\Common Files\Adobe AIR 2010-08-07 21:31 . 2009-08-31 19:18 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files 2010-07-30 21:49 . 2010-07-30 21:49 54644 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TranscodeEngine\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 54101 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MPEG2Plugin\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 57409 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ControlPanel\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 52963 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 54073 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Qt4.5\Uninstaller.exe 2010-07-16 12:59 . 2010-09-15 15:46 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys 2010-07-16 12:59 . 2010-09-15 15:46 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys . ------- Sigcheck ------- [-] 2008-04-14 . 1247D4D5444E28519BBE31BE8AB4C029 . 510464 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\822ceb2331d0360bde8948c432c9beec\winlogon.exe [-] 2002-12-31 . E2E4199F218F09F10BB030318FF13ECE . 504832 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [-] 2008-04-14 . AA04F042A820BF1868E643575887E1A6 . 1037312 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\822ceb2331d0360bde8948c432c9beec\explorer.exe [-] 2007-06-13 . ABDBD248791E9D639A199AE5F347EB02 . 1036800 . . [6.00.2900.3156] . . c:\windows\explorer.exe [7] 2007-06-13 . 1D6245AFBD3FAABC16A885116BE1874D . 1036800 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe [7] 2002-12-31 . A1D7304A87FC3093150F5E3CC7B0F338 . 1035776 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe [-] 2008-04-14 . E0AEF86A594C9990D6321C5CA239C5B7 . 297472 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\822ceb2331d0360bde8948c432c9beec\termsrv.dll c:\windows\System32\termsrv.dll ... is niet aanwezig !! . ((((((((((((((((((((((((((((( SnapShot@2010-10-04_17.14.17 ))))))))))))))))))))))))))))))))))))))))) . + 2010-10-05 14:02 . 2010-10-05 14:02 16384 c:\windows\temp\Perflib_Perfdata_540.dat . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Octoshape Streaming Services"="c:\program files\Octoshape Streaming Services\Administrator\OctoshapeClient.exe" [2006-02-13 214648] "ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2010-09-24 1786168] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-09-26 328056] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-13 323392] "Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-02-06 135664] "Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-08-02 2937528] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-06-20 77824] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-06 148888] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-20 8429568] "nwiz"="nwiz.exe" [2007-04-20 1626112] "SW20"="c:\windows\system32\sw20.exe" [2006-02-06 208896] "SW24"="c:\windows\system32\sw24.exe" [2006-02-06 69632] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2006-12-27 921600] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776] "JMB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-08-14 352256] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-20 81920] "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2007-05-21 124512] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-08-20 1164584] "PCTools FGuard"="c:\program files\PC Tools Security\BDT\FGuard.exe" [2010-08-23 100304] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2002-12-31 15360] [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programma's^Opstarten^LimeWire On Startup.lnk] path=c:\documents and settings\Administrator\Menu Start\Programma's\Opstarten\LimeWire On Startup.lnk backup=c:\windows\pss\LimeWire On Startup.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^GamersFirst LIVE!.lnk] path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\GamersFirst LIVE!.lnk backup=c:\windows\pss\GamersFirst LIVE!.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3] 2009-12-26 12:48 2335952 ----a-w- c:\program files\IObit\Advanced SystemCare 3\AWC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] 2010-02-17 17:37 177472 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] 2009-11-13 15:05 323392 ----a-w- c:\program files\DNA\btdna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] 2009-07-26 14:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-03-18 20:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2010-05-13 14:12 26192168 ----a-r- c:\program files\Skype\Phone\Skype.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"= "c:\\Nexon\\NEXON_EU_Downloader\\NEXON_EU_Downloader_Engine.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\NexonEU\\NGM\\NGM.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\LimeWire Plus\\LimeWire.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Program Files\\League of Legends\\Air\\LolClient.exe"= "c:\\Program Files\\League of Legends\\Game\\League of Legends.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Opera\\opera.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "58715:TCP"= 58715:TCP:Pando Media Booster "58715:UDP"= 58715:UDP:Pando Media Booster "57042:TCP"= 57042:TCP:Pando Media Booster "57042:UDP"= 57042:UDP:Pando Media Booster "8394:TCP"= 8394:TCP:League of Legends Launcher "8394:UDP"= 8394:UDP:League of Legends Launcher "6881:TCP"= 6881:TCP:League of Legends Launcher "6881:UDP"= 6881:UDP:League of Legends Launcher "6967:TCP"= 6967:TCP:League of Legends Launcher "6967:UDP"= 6967:UDP:League of Legends Launcher "6991:TCP"= 6991:TCP:League of Legends Launcher "6991:UDP"= 6991:UDP:League of Legends Launcher "6927:TCP"= 6927:TCP:League of Legends Launcher "6927:UDP"= 6927:UDP:League of Legends Launcher R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [11-2-2010 18:46 5248] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [15-9-2010 17:46 237632] R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [15-9-2010 17:46 338880] R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [15-9-2010 17:46 656320] S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [8-1-2010 1:51 380928] S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools Security\BDT\BDTUpdateService.exe [15-9-2010 17:47 235472] S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [27-1-2010 18:10 5248] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\PC Tools Security\pctsAuxs.exe [15-9-2010 17:45 366840] S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [11-2-2010 18:46 160640] . Inhoud van de 'Gedeelde Taken' map 2010-10-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50] 2010-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1647877149-725345543-500Core.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-02-06 20:30] 2010-10-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1647877149-725345543-500UA.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-02-06 20:30] 2010-10-04 c:\windows\Tasks\Norton Security Scan for Administrator.job - c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-05-09 07:48] . . ------- Bijkomende Scan ------- . uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s LSP: c:\windows\system32\imon.dll LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2d8n1pnt.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://radiobar.toolbarhome.com/?hp=df FF - prefs.js: keyword.URL - hxxp://nl.search.yahoo.com/search?ei=utf-8&fr=megaup&p= ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . - - - - ORPHANS VERWIJDERD - - - - AddRemove-PHPNukeDU Toolbar - c:\progra~1\PHPNUK~1\UNWISE.EXE AddRemove-ToggleDU Toolbar - c:\progra~1\ToggleDU\UNWISE.EXE . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- [HKEY_USERS\S-1-5-21-1482476501-1647877149-725345543-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,99,0c,5b,bb,51,e5,6d,4d,89,15,ab,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,99,0c,5b,bb,51,e5,6d,4d,89,15,ab,\ [HKEY_USERS\S-1-5-21-1482476501-1647877149-725345543-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:0a,04,dc,73,bf,65,7f,aa,66,96,4a,c4,66,4d,ff,2e,80,61,df,d8,49,2b,37, 26,73,a9,47,69,0c,3d,cc,4a,30,67,84,08,4e,a0,cf,55,dc,10,7c,97,c1,9c,fc,3b,\ "??"=hex:51,26,68,11,bc,f8,f9,83,2f,7f,08,b5,c7,73,36,4c [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Geladen Onder Lopende Processen --------------------- - - - - - - - > 'winlogon.exe'(816) c:\windows\system32\sfc_os.dll - - - - - - - > 'explorer.exe'(384) c:\windows\system32\sfc_os.dll . Voltooingstijd: 2010-10-05 16:08:43 - machine werd herstart ComboFix-quarantined-files.txt 2010-10-05 14:08 ComboFix2.txt 2010-10-04 18:57 ComboFix3.txt 2010-10-04 17:19 Pre-Run: 14.171.451.392 bytes beschikbaar Post-Run: 14.133.358.592 bytes beschikbaar - - End Of File - - FCA8CFCF2597BC70DEC01CFAEABBF7F8 ---------- Post toegevoegd om 16:12 ---------- Vorige post was om 16:05 ---------- Sorry voor de fout trouwens, heb het nu wel goed gedaan dacht ik.

ComboFix 10-10-03.03 - Administrator 04-10-2010 19:47:48.3.2 - x86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1252.31.1043.18.2046.1715 [GMT 2:00] Gestart vanuit: c:\documents and settings\Administrator\Bureaublad\ComboFix.exe AV: avast! antivirus 4.7.942 [VPS 000724-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} AV: NOD32 antivirus systeem 2.51 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\winlogon.exe . . . is geïnfecteerd!! Besmet exemplaar van c:\windows\explorer.exe werd aangetroffen en gedesinfecteerd Hersteld exemplaar van - c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe Besmet exemplaar van c:\windows\system32\msgsvc.dll werd aangetroffen en gedesinfecteerd Hersteld exemplaar van - c:\windows\ERDNT\cache\msgsvc.dll . (((((((((((((((((((( Bestanden Gemaakt van 2010-09-04 to 2010-10-04 )))))))))))))))))))))))))))))) . 2010-10-04 14:40 . 2010-10-04 14:40 388096 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2010-10-04 05:38 . 2010-10-04 17:46 -------- d--h--r- c:\documents and settings\Administrator\Onlangs geopend 2010-09-28 13:03 . 2010-09-28 12:59 14383616 ----a-w- C:\gta_sa.exe 2010-09-19 17:03 . 2010-09-19 17:03 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Opera 2010-09-19 17:03 . 2010-09-19 17:03 -------- d-----w- c:\program files\Opera 2010-09-15 16:13 . 2010-09-15 16:13 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Threat Expert 2010-09-15 15:47 . 2010-08-30 11:57 767952 ----a-w- c:\windows\BDTSupport.dll 2010-09-15 15:47 . 2010-08-23 07:36 149456 ----a-w- c:\windows\SGDetectionTool.dll 2010-09-15 15:47 . 2008-11-26 09:08 131 ----a-w- c:\windows\IDB.zip 2010-09-15 15:47 . 2010-08-30 11:57 739280 ----a-w- c:\windows\PCTBDRes.dll 2010-09-15 15:45 . 2010-09-15 15:45 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools 2010-09-15 15:44 . 2010-09-15 15:44 80729096 ----a-w- c:\documents and settings\All Users\Application Data\PC Tools\DownloadManager\Spyware Doctor8.0\sdsetup_aff_dl.exe 2010-09-15 15:44 . 2010-09-15 15:46 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools 2010-09-13 17:58 . 2010-09-13 17:09 189952 ----a-w- c:\windows\Qwagob.exe . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-10-04 17:54 . 2007-06-20 17:22 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-10-04 15:26 . 2007-12-24 19:54 1324 ----a-w- c:\windows\system32\d3d9caps.dat 2010-10-04 13:57 . 2008-05-21 18:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\OpenOffice.org2 2010-10-04 13:57 . 2009-07-26 23:06 -------- d-----w- c:\documents and settings\Administrator\Application Data\DNA 2010-10-04 05:40 . 2010-01-31 17:46 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent 2010-10-04 05:40 . 2008-05-21 18:05 1 ----a-w- c:\documents and settings\Administrator\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys 2010-10-04 05:40 . 2010-08-07 21:42 -------- d-----w- c:\program files\League of Legends 2010-10-04 05:38 . 2009-07-26 23:06 -------- d-----w- c:\program files\DNA 2010-10-03 15:27 . 2009-08-25 19:55 -------- d-----w- c:\program files\Rockstar Games 2010-09-30 19:59 . 2010-03-11 22:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\LimeWirePlus 2010-09-29 12:26 . 2009-07-26 23:06 -------- d-----w- c:\program files\GamersFirst 2010-09-29 12:26 . 2010-05-11 18:58 -------- d-----w- c:\program files\Everest Poker 2010-09-29 12:23 . 2006-12-27 17:39 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-09-29 12:22 . 2009-12-02 19:11 -------- d-----w- c:\documents and settings\All Users\Application Data\ijjigame 2010-09-29 12:22 . 2010-08-15 20:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Gygan 2010-09-29 12:22 . 2009-10-24 22:00 -------- d-----w- c:\program files\Crossfire 2010-09-29 12:20 . 2009-09-13 19:35 -------- d-----w- c:\program files\CCleaner 2010-09-27 13:54 . 2010-01-31 17:47 -------- d-----w- c:\program files\uTorrent 2010-09-25 13:56 . 2009-03-15 12:16 -------- d-----w- c:\program files\Common Files\Symantec Shared 2010-09-18 09:44 . 2009-04-28 20:09 -------- d-----w- c:\program files\iTunes 2010-09-15 16:09 . 2010-09-15 15:45 -------- d-----w- c:\program files\PC Tools Security 2010-09-15 15:47 . 2010-09-15 15:45 -------- d-----w- c:\program files\Common Files\PC Tools 2010-09-15 15:46 . 2010-09-15 15:46 979746 ----a-w- c:\windows\system32\drivers\Cat.DB 2010-09-04 10:07 . 2010-07-18 21:47 -------- d-----w- c:\program files\TheSandyRavage 2010-09-04 10:07 . 2009-07-31 20:45 -------- d-----w- c:\program files\PHPNukeDU 2010-09-04 10:07 . 2009-06-19 15:18 -------- d-----w- c:\program files\ToggleDU 2010-09-04 09:18 . 2010-09-04 09:18 -------- d-----w- c:\program files\Trend Micro 2010-09-02 17:40 . 2010-07-30 21:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\DivX 2010-08-30 11:57 . 2010-09-15 15:47 1865680 ----a-w- c:\windows\PCTBDCore.dll 2010-08-28 09:25 . 2010-09-15 15:46 247824 ----a-w- c:\windows\system32\drivers\pctgntdi.sys 2010-08-27 14:29 . 2010-08-27 14:29 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2010-08-27 14:29 . 2010-08-27 14:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-27 14:29 . 2010-08-27 14:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-08-27 14:10 . 2010-08-27 14:10 110080 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{95431C66-CF9A-4913-BFFF-6050785AFB65}\IconF7A21AF7.exe 2010-08-27 14:10 . 2010-08-27 14:10 110080 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{95431C66-CF9A-4913-BFFF-6050785AFB65}\IconD7F16134.exe 2010-08-27 14:10 . 2010-08-27 14:10 -------- d-----w- c:\program files\Enigma Software Group 2010-08-27 14:09 . 2008-04-11 20:41 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-08-27 12:57 . 2010-07-30 21:50 57344 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll 2010-08-27 12:54 . 2010-08-27 12:54 144696 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.exe 2010-08-27 12:54 . 2010-07-30 21:50 1062184 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll 2010-08-27 12:54 . 2010-07-30 21:50 850200 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe 2010-08-27 08:13 . 2010-09-15 15:46 159296 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2010-08-27 06:26 . 2010-09-15 15:46 70536 ----a-w- c:\windows\system32\drivers\pctplsg.sys 2010-08-27 06:26 . 2010-09-15 15:46 123968 ----a-w- c:\windows\system32\drivers\pctplfw.sys 2010-08-27 06:25 . 2010-09-15 15:46 79672 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.sys 2010-08-26 07:30 . 2010-09-15 15:47 2074 ----a-w- c:\windows\UDB.zip 2010-08-20 03:00 . 2007-01-02 20:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Ventrilo 2010-08-20 03:00 . 2009-03-11 20:35 -------- d-----w- c:\program files\SwiftKit 2010-08-20 03:00 . 2008-03-24 20:15 -------- d-----w- c:\program files\Teamspeak2_RC2 2010-08-20 03:00 . 2009-09-15 12:35 -------- d-----w- c:\program files\LimeWire 2010-08-20 03:00 . 2009-01-04 01:30 -------- d-----w- c:\program files\RivaTuner v2.22 2010-08-20 03:00 . 2008-07-05 20:50 -------- d-----w- c:\program files\PartyGaming 2010-08-18 11:51 . 2010-09-15 15:46 237632 ----a-w- c:\windows\system32\drivers\PCTCore.sys 2010-08-17 18:24 . 2010-08-17 18:24 -------- d-----w- c:\program files\Counter-Strike 1.6 2010-08-15 20:25 . 2010-08-15 20:25 -------- d-----w- c:\documents and settings\Administrator\Application Data\Stereoscopic Player 2010-08-15 20:24 . 2010-08-15 20:24 25214 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{26B03CED-4E5A-4057-BCF9-EE80B13FCF94}\_C727DF8DB5218D337B8AAB.exe 2010-08-15 20:24 . 2010-08-15 20:24 25214 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{26B03CED-4E5A-4057-BCF9-EE80B13FCF94}\_C0C391FA20561A5BDDEDC2.exe 2010-08-15 20:24 . 2010-08-15 20:24 25214 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{26B03CED-4E5A-4057-BCF9-EE80B13FCF94}\_853F67D554F05449430E7E.exe 2010-08-15 20:24 . 2010-08-15 20:24 -------- d-----w- c:\program files\Stereoscopic Player 2010-08-15 20:16 . 2010-08-15 20:16 -------- d-----w- c:\program files\Xenocode 2010-08-15 20:10 . 2010-08-15 20:10 -------- d-----w- c:\program files\Virtools 2010-08-11 02:16 . 2009-04-10 20:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype 2010-08-10 15:34 . 2006-12-27 23:31 -------- d-----r- c:\program files\Skype 2010-08-10 15:34 . 2010-08-10 15:34 -------- d-----w- c:\program files\Common Files\Skype 2010-08-10 15:34 . 2006-12-27 23:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2010-08-10 15:33 . 2008-07-02 08:55 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM 2010-08-10 14:58 . 2010-09-15 15:46 31960 ----a-w- c:\windows\system32\drivers\pctNdis-DNS.sys 2010-08-07 22:01 . 2010-08-07 22:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\LolClient 2010-08-07 21:47 . 2010-08-07 21:46 -------- d-----w- c:\program files\Common Files\Adobe AIR 2010-08-07 21:31 . 2009-08-31 19:18 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files 2010-07-30 21:49 . 2010-07-30 21:49 54644 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TranscodeEngine\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 54101 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MPEG2Plugin\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 57409 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ControlPanel\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 52963 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 54073 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Qt4.5\Uninstaller.exe 2010-07-16 12:59 . 2010-09-15 15:46 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys 2010-07-16 12:59 . 2010-09-15 15:46 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys . ------- Sigcheck ------- [-] 2008-04-14 . 1247D4D5444E28519BBE31BE8AB4C029 . 510464 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\822ceb2331d0360bde8948c432c9beec\winlogon.exe [-] 2002-12-31 . E2E4199F218F09F10BB030318FF13ECE . 504832 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [-] 2008-04-14 . AA04F042A820BF1868E643575887E1A6 . 1037312 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\822ceb2331d0360bde8948c432c9beec\explorer.exe [-] 2007-06-13 . ABDBD248791E9D639A199AE5F347EB02 . 1036800 . . [6.00.2900.3156] . . c:\windows\explorer.exe [7] 2007-06-13 . 1D6245AFBD3FAABC16A885116BE1874D . 1036800 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe [7] 2002-12-31 . A1D7304A87FC3093150F5E3CC7B0F338 . 1035776 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe [-] 2008-04-14 . E0AEF86A594C9990D6321C5CA239C5B7 . 297472 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\822ceb2331d0360bde8948c432c9beec\termsrv.dll c:\windows\System32\termsrv.dll ... is niet aanwezig !! . ((((((((((((((((((((((((((((( SnapShot@2010-10-04_17.14.17 ))))))))))))))))))))))))))))))))))))))))) . + 2010-10-04 17:54 . 2010-10-04 17:54 16384 c:\windows\temp\Perflib_Perfdata_530.dat . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Octoshape Streaming Services"="c:\program files\Octoshape Streaming Services\Administrator\OctoshapeClient.exe" [2006-02-13 214648] "ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2010-09-24 1786168] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-09-26 328056] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-13 323392] "Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-02-06 135664] "Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-08-02 2937528] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-06-20 77824] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-06 148888] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-20 8429568] "nwiz"="nwiz.exe" [2007-04-20 1626112] "SW20"="c:\windows\system32\sw20.exe" [2006-02-06 208896] "SW24"="c:\windows\system32\sw24.exe" [2006-02-06 69632] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2006-12-27 921600] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776] "JMB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-08-14 352256] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-20 81920] "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2007-05-21 124512] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-08-20 1164584] "PCTools FGuard"="c:\program files\PC Tools Security\BDT\FGuard.exe" [2010-08-23 100304] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2002-12-31 15360] [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programma's^Opstarten^LimeWire On Startup.lnk] path=c:\documents and settings\Administrator\Menu Start\Programma's\Opstarten\LimeWire On Startup.lnk backup=c:\windows\pss\LimeWire On Startup.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^GamersFirst LIVE!.lnk] path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\GamersFirst LIVE!.lnk backup=c:\windows\pss\GamersFirst LIVE!.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3] 2009-12-26 12:48 2335952 ----a-w- c:\program files\IObit\Advanced SystemCare 3\AWC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] 2010-02-17 17:37 177472 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] 2009-11-13 15:05 323392 ----a-w- c:\program files\DNA\btdna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] 2009-07-26 14:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-03-18 20:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2010-05-13 14:12 26192168 ----a-r- c:\program files\Skype\Phone\Skype.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"= "c:\\Nexon\\NEXON_EU_Downloader\\NEXON_EU_Downloader_Engine.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\NexonEU\\NGM\\NGM.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\LimeWire Plus\\LimeWire.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Program Files\\League of Legends\\Air\\LolClient.exe"= "c:\\Program Files\\League of Legends\\Game\\League of Legends.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Opera\\opera.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "58715:TCP"= 58715:TCP:Pando Media Booster "58715:UDP"= 58715:UDP:Pando Media Booster "57042:TCP"= 57042:TCP:Pando Media Booster "57042:UDP"= 57042:UDP:Pando Media Booster "8394:TCP"= 8394:TCP:League of Legends Launcher "8394:UDP"= 8394:UDP:League of Legends Launcher "6881:TCP"= 6881:TCP:League of Legends Launcher "6881:UDP"= 6881:UDP:League of Legends Launcher "6967:TCP"= 6967:TCP:League of Legends Launcher "6967:UDP"= 6967:UDP:League of Legends Launcher "6991:TCP"= 6991:TCP:League of Legends Launcher "6991:UDP"= 6991:UDP:League of Legends Launcher "6927:TCP"= 6927:TCP:League of Legends Launcher "6927:UDP"= 6927:UDP:League of Legends Launcher R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [11-2-2010 18:46 5248] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [15-9-2010 17:46 237632] R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [15-9-2010 17:46 338880] R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [15-9-2010 17:46 656320] S0 vtaevi;vtaevi;c:\windows\system32\drivers\yswlfky.sys --> c:\windows\system32\drivers\yswlfky.sys [?] S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [8-1-2010 1:51 380928] S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools Security\BDT\BDTUpdateService.exe [15-9-2010 17:47 235472] S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [27-1-2010 18:10 5248] S3 FXDrv32;FXDrv32;\??\e:\fxdrv32.sys --> e:\FXDrv32.sys [?] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\PC Tools Security\pctsAuxs.exe [15-9-2010 17:45 366840] S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [11-2-2010 18:46 160640] . Inhoud van de 'Gedeelde Taken' map 2010-10-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50] 2010-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1647877149-725345543-500Core.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-02-06 20:30] 2010-10-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1647877149-725345543-500UA.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-02-06 20:30] 2010-10-04 c:\windows\Tasks\Norton Security Scan for Administrator.job - c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-05-09 07:48] . . ------- Bijkomende Scan ------- . uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s LSP: c:\windows\system32\imon.dll LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2d8n1pnt.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2510284&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://radiobar.toolbarhome.com/?hp=df FF - prefs.js: keyword.URL - hxxp://nl.search.yahoo.com/search?ei=utf-8&fr=megaup&p= ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- [HKEY_USERS\S-1-5-21-1482476501-1647877149-725345543-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,99,0c,5b,bb,51,e5,6d,4d,89,15,ab,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,99,0c,5b,bb,51,e5,6d,4d,89,15,ab,\ [HKEY_USERS\S-1-5-21-1482476501-1647877149-725345543-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:0a,04,dc,73,bf,65,7f,aa,66,96,4a,c4,66,4d,ff,2e,80,61,df,d8,49,2b,37, 26,73,a9,47,69,0c,3d,cc,4a,30,67,84,08,4e,a0,cf,55,dc,10,7c,97,c1,9c,fc,3b,\ "??"=hex:51,26,68,11,bc,f8,f9,83,2f,7f,08,b5,c7,73,36,4c [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Geladen Onder Lopende Processen --------------------- - - - - - - - > 'winlogon.exe'(816) c:\windows\system32\sfc_os.dll - - - - - - - > 'explorer.exe'(652) c:\windows\system32\sfc_os.dll . Voltooingstijd: 2010-10-04 20:57:47 - machine werd herstart ComboFix-quarantined-files.txt 2010-10-04 18:57 ComboFix2.txt 2010-10-04 17:19 Pre-Run: 14.213.771.264 bytes beschikbaar Post-Run: 14.197.915.648 bytes beschikbaar - - End Of File - - 16AD5925C5CF3BC4F2184370C585CF77 Ik heb het gesleept, ik hoop dat het klopt. Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 20:59:42, on 4-10-2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen R3 - URLSearchHook: PC Tools Browser Guard - {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [sW20] C:\WINDOWS\system32\sw20.exe O4 - HKLM\..\Run: [sW24] C:\WINDOWS\system32\sw24.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW O4 - HKLM\..\Run: [PCTools FGuard] C:\Program Files\PC Tools Security\BDT\FGuard.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\Administrator\OctoshapeClient.exe" -inv:bootrun O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\PC Tools Security\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\PC Tools Security\pctsSvc.exe -- End of file - 8750 bytes

Ik heb de virusscanners niet uit kunnen schakelen maar ik ben gewoon verder gegaan. Hier volgt het logje: ComboFix 10-10-03.03 - Administrator 04-10-2010 19:02:29.2.2 - x86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1252.31.1043.18.2046.1769 [GMT 2:00] Gestart vanuit: c:\documents and settings\Administrator\Bureaublad\ComboFix.exe AV: avast! antivirus 4.7.942 [VPS 000724-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} AV: NOD32 antivirus systeem 2.51 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Voorgaande Run ------- . c:\documents and settings\Administrator\Application Data\63C8473FF707407221B87A06B9139977\enemies-names.txt c:\documents and settings\Administrator\Application Data\63C8473FF707407221B87A06B9139977\local.ini c:\documents and settings\Administrator\Application Data\63C8473FF707407221B87A06B9139977\lsrslt.ini c:\documents and settings\Administrator\Application Data\Dealio\res\widgets.xml c:\documents and settings\Administrator\Application Data\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml c:\documents and settings\Administrator\Menu Start\Programma's\Antimalware Doctor\Antimalware Doctor.lnk c:\documents and settings\Administrator\Menu Start\Programma's\Antimalware Doctor\Uninstall.lnk c:\documents and settings\Administrator\Menu Start\Programma's\Opstarten\OpenOffice.org 2.4 .lnk c:\documents and settings\All Users\Documenten\Server\admin.txt c:\documents and settings\All Users\Documenten\Server\server.dat c:\program files\Dealio Toolbar\FF\chrome.manifest c:\program files\Dealio Toolbar\FF\chrome\content\chevron.js c:\program files\Dealio Toolbar\FF\chrome\content\chevron.xul c:\program files\Dealio Toolbar\FF\chrome\content\login.js c:\program files\Dealio Toolbar\FF\chrome\content\login.xul c:\program files\Dealio Toolbar\FF\chrome\content\parser.js c:\program files\Dealio Toolbar\FF\chrome\content\RssTickerWidget.js c:\program files\Dealio Toolbar\FF\chrome\content\searchbox.js c:\program files\Dealio Toolbar\FF\chrome\content\searchbox.xul c:\program files\Dealio Toolbar\FF\chrome\content\widgichevron.js c:\program files\Dealio Toolbar\FF\chrome\content\widgicomm.js c:\program files\Dealio Toolbar\FF\chrome\content\widgihandling.js c:\program files\Dealio Toolbar\FF\chrome\content\widgilisteners.js c:\program files\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.js c:\program files\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.xul c:\program files\Dealio Toolbar\FF\chrome\content\widgiui.js c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\searchbox.dtd c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.dtd c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.properties c:\program files\Dealio Toolbar\FF\chrome\locale\EN-US\yahoo-search.gif c:\program files\Dealio Toolbar\FF\chrome\skin\amazon.gif c:\program files\Dealio Toolbar\FF\chrome\skin\apple.gif c:\program files\Dealio Toolbar\FF\chrome\skin\barnes.gif c:\program files\Dealio Toolbar\FF\chrome\skin\bestbuy.gif c:\program files\Dealio Toolbar\FF\chrome\skin\chevron.gif c:\program files\Dealio Toolbar\FF\chrome\skin\dealio_logo.gif c:\program files\Dealio Toolbar\FF\chrome\skin\dealio_logo_hover.gif c:\program files\Dealio Toolbar\FF\chrome\skin\ebay.gif c:\program files\Dealio Toolbar\FF\chrome\skin\icon_settings.gif c:\program files\Dealio Toolbar\FF\chrome\skin\macys.gif c:\program files\Dealio Toolbar\FF\chrome\skin\newegg.gif c:\program files\Dealio Toolbar\FF\chrome\skin\overstock.gif c:\program files\Dealio Toolbar\FF\chrome\skin\search-button-hover.gif c:\program files\Dealio Toolbar\FF\chrome\skin\search-button.gif c:\program files\Dealio Toolbar\FF\chrome\skin\search-chevron-hover.gif c:\program files\Dealio Toolbar\FF\chrome\skin\search-chevron.gif c:\program files\Dealio Toolbar\FF\chrome\skin\search_amazon.gif c:\program files\Dealio Toolbar\FF\chrome\skin\search_dealio.gif c:\program files\Dealio Toolbar\FF\chrome\skin\search_ebay.gif c:\program files\Dealio Toolbar\FF\chrome\skin\search_yahoo.gif c:\program files\Dealio Toolbar\FF\chrome\skin\searchbox.css c:\program files\Dealio Toolbar\FF\chrome\skin\separator.gif c:\program files\Dealio Toolbar\FF\chrome\skin\target.gif c:\program files\Dealio Toolbar\FF\chrome\skin\walmart.gif c:\program files\Dealio Toolbar\FF\chrome\skin\widgitoolbarplugin.css c:\program files\Dealio Toolbar\FF\components\config.ini c:\program files\Dealio Toolbar\FF\components\IFBHOHelperWidgiToolbar.xpt c:\program files\Dealio Toolbar\FF\components\IFBHOWidgiToolbar.xpt c:\program files\Dealio Toolbar\FF\install.rdf c:\program files\Dealio Toolbar\IE\4.0.2\config.ini c:\program files\Dealio Toolbar\Res\amazon.gif c:\program files\Dealio Toolbar\Res\apple.gif c:\program files\Dealio Toolbar\Res\barnes.gif c:\program files\Dealio Toolbar\Res\bestbuy.gif c:\program files\Dealio Toolbar\Res\dealio_logo.gif c:\program files\Dealio Toolbar\Res\dealio_logo_hover.gif c:\program files\Dealio Toolbar\Res\ebay.gif c:\program files\Dealio Toolbar\Res\icon_settings.gif c:\program files\Dealio Toolbar\Res\macys.gif c:\program files\Dealio Toolbar\Res\newegg.gif c:\program files\Dealio Toolbar\Res\overstock.gif c:\program files\Dealio Toolbar\Res\search-button-hover.gif c:\program files\Dealio Toolbar\Res\search-button.gif c:\program files\Dealio Toolbar\Res\search-chevron-hover.gif c:\program files\Dealio Toolbar\Res\search-chevron.gif c:\program files\Dealio Toolbar\Res\search_amazon.gif c:\program files\Dealio Toolbar\Res\search_dealio.gif c:\program files\Dealio Toolbar\Res\search_ebay.gif c:\program files\Dealio Toolbar\Res\search_yahoo.gif c:\program files\Dealio Toolbar\Res\target.gif c:\program files\Dealio Toolbar\Res\walmart.gif c:\program files\Dealio Toolbar\Res\widgets.xml c:\program files\Dealio Toolbar\sscfg.ini c:\program files\Dealio Toolbar\SSFF\chrome.manifest c:\program files\Dealio Toolbar\SSFF\chrome\content\plugin.js c:\program files\Dealio Toolbar\SSFF\chrome\content\plugin.xul c:\program files\Dealio Toolbar\SSFF\chrome\content\protection.js c:\program files\Dealio Toolbar\SSFF\chrome\content\utils.js c:\program files\Dealio Toolbar\SSFF\chrome\locale\en-US\searchsettingsplugin.dtd c:\program files\Dealio Toolbar\SSFF\chrome\locale\en-US\searchsettingsplugin.properties c:\program files\Dealio Toolbar\SSFF\chrome\skin\yahoo.xml c:\program files\Dealio Toolbar\SSFF\components\IFBHOSearch.xpt c:\program files\Dealio Toolbar\SSFF\components\IFBHOSearchHelperEngine.xpt c:\program files\Dealio Toolbar\SSFF\components\IFHelperPreferences.xpt c:\program files\Dealio Toolbar\SSFF\components\SearchSettingsFF.dll c:\program files\Dealio Toolbar\SSFF\components\sscfg.ini c:\program files\Dealio Toolbar\SSFF\install.rdf c:\windows\system\WINSPOOL.DRV c:\windows\system32\_000008_.tmp.dll c:\windows\system32\14073633.dll c:\windows\system32\19235070.dll c:\windows\system32\20621209.dll c:\windows\system32\302092.dll c:\windows\system32\c_dll.dll D:\Autorun.inf D:\hl.exe -- Voorgaande Run -- c:\windows\system32\winlogon.exe . . . is geïnfecteerd!! c:\windows\system32\winlogon.exe . . . is geïnfecteerd!! Besmet exemplaar van c:\windows\explorer.exe werd aangetroffen en gedesinfecteerd Hersteld exemplaar van - c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe c:\windows\system32\winlogon.exe . . . is geïnfecteerd!! Besmet exemplaar van c:\windows\explorer.exe werd aangetroffen en gedesinfecteerd Hersteld exemplaar van - c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe c:\windows\system32\msgsvc.dll . . . is geïnfecteerd!! -------- c:\windows\system32\winlogon.exe . . . is geïnfecteerd!! Besmet exemplaar van c:\windows\explorer.exe werd aangetroffen en gedesinfecteerd Hersteld exemplaar van - c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe c:\windows\system32\msgsvc.dll . . . is geïnfecteerd!! . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SSHNAS (((((((((((((((((((( Bestanden Gemaakt van 2010-09-04 to 2010-10-04 )))))))))))))))))))))))))))))) . 2010-10-04 14:40 . 2010-10-04 14:40 388096 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2010-10-04 05:38 . 2010-10-04 14:45 -------- d--h--r- c:\documents and settings\Administrator\Onlangs geopend 2010-09-28 13:03 . 2010-09-28 12:59 14383616 ----a-w- C:\gta_sa.exe 2010-09-19 17:03 . 2010-09-19 17:03 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Opera 2010-09-19 17:03 . 2010-09-19 17:03 -------- d-----w- c:\program files\Opera 2010-09-15 16:13 . 2010-09-15 16:13 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Threat Expert 2010-09-15 15:47 . 2010-08-30 11:57 767952 ----a-w- c:\windows\BDTSupport.dll 2010-09-15 15:47 . 2010-08-23 07:36 149456 ----a-w- c:\windows\SGDetectionTool.dll 2010-09-15 15:47 . 2008-11-26 09:08 131 ----a-w- c:\windows\IDB.zip 2010-09-15 15:47 . 2010-08-30 11:57 739280 ----a-w- c:\windows\PCTBDRes.dll 2010-09-15 15:45 . 2010-09-15 15:45 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools 2010-09-15 15:44 . 2010-09-15 15:44 80729096 ----a-w- c:\documents and settings\All Users\Application Data\PC Tools\DownloadManager\Spyware Doctor8.0\sdsetup_aff_dl.exe 2010-09-15 15:44 . 2010-09-15 15:46 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools 2010-09-13 17:58 . 2010-09-13 17:09 189952 ----a-w- c:\windows\Qwagob.exe . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-10-04 17:11 . 2007-06-20 17:22 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-10-04 15:26 . 2007-12-24 19:54 1324 ----a-w- c:\windows\system32\d3d9caps.dat 2010-10-04 13:57 . 2008-05-21 18:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\OpenOffice.org2 2010-10-04 13:57 . 2009-07-26 23:06 -------- d-----w- c:\documents and settings\Administrator\Application Data\DNA 2010-10-04 05:40 . 2010-01-31 17:46 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent 2010-10-04 05:40 . 2008-05-21 18:05 1 ----a-w- c:\documents and settings\Administrator\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys 2010-10-04 05:40 . 2010-08-07 21:42 -------- d-----w- c:\program files\League of Legends 2010-10-04 05:38 . 2009-07-26 23:06 -------- d-----w- c:\program files\DNA 2010-10-03 15:27 . 2009-08-25 19:55 -------- d-----w- c:\program files\Rockstar Games 2010-09-30 19:59 . 2010-03-11 22:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\LimeWirePlus 2010-09-29 12:26 . 2009-07-26 23:06 -------- d-----w- c:\program files\GamersFirst 2010-09-29 12:26 . 2010-05-11 18:58 -------- d-----w- c:\program files\Everest Poker 2010-09-29 12:23 . 2006-12-27 17:39 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-09-29 12:22 . 2009-12-02 19:11 -------- d-----w- c:\documents and settings\All Users\Application Data\ijjigame 2010-09-29 12:22 . 2010-08-15 20:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Gygan 2010-09-29 12:22 . 2009-10-24 22:00 -------- d-----w- c:\program files\Crossfire 2010-09-29 12:20 . 2009-09-13 19:35 -------- d-----w- c:\program files\CCleaner 2010-09-27 13:54 . 2010-01-31 17:47 -------- d-----w- c:\program files\uTorrent 2010-09-25 13:56 . 2009-03-15 12:16 -------- d-----w- c:\program files\Common Files\Symantec Shared 2010-09-18 09:44 . 2009-04-28 20:09 -------- d-----w- c:\program files\iTunes 2010-09-15 16:09 . 2010-09-15 15:45 -------- d-----w- c:\program files\PC Tools Security 2010-09-15 15:47 . 2010-09-15 15:45 -------- d-----w- c:\program files\Common Files\PC Tools 2010-09-15 15:46 . 2010-09-15 15:46 979746 ----a-w- c:\windows\system32\drivers\Cat.DB 2010-09-04 10:07 . 2010-07-18 21:47 -------- d-----w- c:\program files\TheSandyRavage 2010-09-04 10:07 . 2009-07-31 20:45 -------- d-----w- c:\program files\PHPNukeDU 2010-09-04 10:07 . 2009-06-19 15:18 -------- d-----w- c:\program files\ToggleDU 2010-09-04 09:18 . 2010-09-04 09:18 -------- d-----w- c:\program files\Trend Micro 2010-09-02 17:40 . 2010-07-30 21:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\DivX 2010-08-30 11:57 . 2010-09-15 15:47 1865680 ----a-w- c:\windows\PCTBDCore.dll 2010-08-28 09:25 . 2010-09-15 15:46 247824 ----a-w- c:\windows\system32\drivers\pctgntdi.sys 2010-08-27 14:29 . 2010-08-27 14:29 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2010-08-27 14:29 . 2010-08-27 14:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-27 14:29 . 2010-08-27 14:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-08-27 14:10 . 2010-08-27 14:10 110080 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{95431C66-CF9A-4913-BFFF-6050785AFB65}\IconF7A21AF7.exe 2010-08-27 14:10 . 2010-08-27 14:10 110080 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{95431C66-CF9A-4913-BFFF-6050785AFB65}\IconD7F16134.exe 2010-08-27 14:10 . 2010-08-27 14:10 -------- d-----w- c:\program files\Enigma Software Group 2010-08-27 14:09 . 2008-04-11 20:41 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-08-27 12:57 . 2010-07-30 21:50 57344 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll 2010-08-27 12:54 . 2010-08-27 12:54 144696 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.exe 2010-08-27 12:54 . 2010-07-30 21:50 1062184 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll 2010-08-27 12:54 . 2010-07-30 21:50 850200 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe 2010-08-27 08:13 . 2010-09-15 15:46 159296 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2010-08-27 06:26 . 2010-09-15 15:46 70536 ----a-w- c:\windows\system32\drivers\pctplsg.sys 2010-08-27 06:26 . 2010-09-15 15:46 123968 ----a-w- c:\windows\system32\drivers\pctplfw.sys 2010-08-27 06:25 . 2010-09-15 15:46 79672 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.sys 2010-08-26 07:30 . 2010-09-15 15:47 2074 ----a-w- c:\windows\UDB.zip 2010-08-20 03:00 . 2007-01-02 20:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Ventrilo 2010-08-20 03:00 . 2009-03-11 20:35 -------- d-----w- c:\program files\SwiftKit 2010-08-20 03:00 . 2008-03-24 20:15 -------- d-----w- c:\program files\Teamspeak2_RC2 2010-08-20 03:00 . 2009-09-15 12:35 -------- d-----w- c:\program files\LimeWire 2010-08-20 03:00 . 2009-01-04 01:30 -------- d-----w- c:\program files\RivaTuner v2.22 2010-08-20 03:00 . 2008-07-05 20:50 -------- d-----w- c:\program files\PartyGaming 2010-08-18 11:51 . 2010-09-15 15:46 237632 ----a-w- c:\windows\system32\drivers\PCTCore.sys 2010-08-17 18:24 . 2010-08-17 18:24 -------- d-----w- c:\program files\Counter-Strike 1.6 2010-08-15 20:25 . 2010-08-15 20:25 -------- d-----w- c:\documents and settings\Administrator\Application Data\Stereoscopic Player 2010-08-15 20:24 . 2010-08-15 20:24 25214 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{26B03CED-4E5A-4057-BCF9-EE80B13FCF94}\_C727DF8DB5218D337B8AAB.exe 2010-08-15 20:24 . 2010-08-15 20:24 25214 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{26B03CED-4E5A-4057-BCF9-EE80B13FCF94}\_C0C391FA20561A5BDDEDC2.exe 2010-08-15 20:24 . 2010-08-15 20:24 25214 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{26B03CED-4E5A-4057-BCF9-EE80B13FCF94}\_853F67D554F05449430E7E.exe 2010-08-15 20:24 . 2010-08-15 20:24 -------- d-----w- c:\program files\Stereoscopic Player 2010-08-15 20:16 . 2010-08-15 20:16 -------- d-----w- c:\program files\Xenocode 2010-08-15 20:10 . 2010-08-15 20:10 -------- d-----w- c:\program files\Virtools 2010-08-11 02:16 . 2009-04-10 20:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype 2010-08-10 15:34 . 2006-12-27 23:31 -------- d-----r- c:\program files\Skype 2010-08-10 15:34 . 2010-08-10 15:34 -------- d-----w- c:\program files\Common Files\Skype 2010-08-10 15:34 . 2006-12-27 23:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2010-08-10 15:33 . 2008-07-02 08:55 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM 2010-08-10 14:58 . 2010-09-15 15:46 31960 ----a-w- c:\windows\system32\drivers\pctNdis-DNS.sys 2010-08-07 22:01 . 2010-08-07 22:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\LolClient 2010-08-07 21:47 . 2010-08-07 21:46 -------- d-----w- c:\program files\Common Files\Adobe AIR 2010-08-07 21:31 . 2009-08-31 19:18 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files 2010-07-30 21:49 . 2010-07-30 21:49 54644 ----a-w- c:\documents and settings\All Users\Application Data\DivX\TranscodeEngine\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 54101 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MPEG2Plugin\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 57409 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ControlPanel\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 52963 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe 2010-07-30 21:49 . 2010-07-30 21:49 54073 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Qt4.5\Uninstaller.exe 2010-07-16 12:59 . 2010-09-15 15:46 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys 2010-07-16 12:59 . 2010-09-15 15:46 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys . ------- Sigcheck ------- [-] 2008-04-14 . 1247D4D5444E28519BBE31BE8AB4C029 . 510464 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\822ceb2331d0360bde8948c432c9beec\winlogon.exe [-] 2002-12-31 . E2E4199F218F09F10BB030318FF13ECE . 504832 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe [-] 2008-04-14 . AA04F042A820BF1868E643575887E1A6 . 1037312 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\822ceb2331d0360bde8948c432c9beec\explorer.exe [-] 2007-06-13 . ABDBD248791E9D639A199AE5F347EB02 . 1036800 . . [6.00.2900.3156] . . c:\windows\explorer.exe [7] 2007-06-13 . 1D6245AFBD3FAABC16A885116BE1874D . 1036800 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe [7] 2002-12-31 . A1D7304A87FC3093150F5E3CC7B0F338 . 1035776 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe [-] 2008-04-14 . E0AEF86A594C9990D6321C5CA239C5B7 . 297472 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\822ceb2331d0360bde8948c432c9beec\termsrv.dll c:\windows\System32\termsrv.dll ... is niet aanwezig !! . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Octoshape Streaming Services"="c:\program files\Octoshape Streaming Services\Administrator\OctoshapeClient.exe" [2006-02-13 214648] "ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2010-09-24 1786168] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-09-26 328056] "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-13 323392] "Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-02-06 135664] "Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-08-02 2937528] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-06-20 77824] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-06 148888] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-20 8429568] "nwiz"="nwiz.exe" [2007-04-20 1626112] "SW20"="c:\windows\system32\sw20.exe" [2006-02-06 208896] "SW24"="c:\windows\system32\sw24.exe" [2006-02-06 69632] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2006-12-27 921600] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776] "JMB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-08-14 352256] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-20 81920] "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2007-05-21 124512] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-08-20 1164584] "PCTools FGuard"="c:\program files\PC Tools Security\BDT\FGuard.exe" [2010-08-23 100304] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2002-12-31 15360] [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Menu Start^Programma's^Opstarten^LimeWire On Startup.lnk] path=c:\documents and settings\Administrator\Menu Start\Programma's\Opstarten\LimeWire On Startup.lnk backup=c:\windows\pss\LimeWire On Startup.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^GamersFirst LIVE!.lnk] path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\GamersFirst LIVE!.lnk backup=c:\windows\pss\GamersFirst LIVE!.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3] 2009-12-26 12:48 2335952 ----a-w- c:\program files\IObit\Advanced SystemCare 3\AWC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] 2010-02-17 17:37 177472 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] 2009-11-13 15:05 323392 ----a-w- c:\program files\DNA\btdna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] 2009-07-26 14:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-03-18 20:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2010-05-13 14:12 26192168 ----a-r- c:\program files\Skype\Phone\Skype.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"= "c:\\Nexon\\NEXON_EU_Downloader\\NEXON_EU_Downloader_Engine.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\NexonEU\\NGM\\NGM.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\LimeWire Plus\\LimeWire.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Program Files\\League of Legends\\Air\\LolClient.exe"= "c:\\Program Files\\League of Legends\\Game\\League of Legends.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Opera\\opera.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "58715:TCP"= 58715:TCP:Pando Media Booster "58715:UDP"= 58715:UDP:Pando Media Booster "57042:TCP"= 57042:TCP:Pando Media Booster "57042:UDP"= 57042:UDP:Pando Media Booster "8394:TCP"= 8394:TCP:League of Legends Launcher "8394:UDP"= 8394:UDP:League of Legends Launcher "6881:TCP"= 6881:TCP:League of Legends Launcher "6881:UDP"= 6881:UDP:League of Legends Launcher "6967:TCP"= 6967:TCP:League of Legends Launcher "6967:UDP"= 6967:UDP:League of Legends Launcher "6991:TCP"= 6991:TCP:League of Legends Launcher "6991:UDP"= 6991:UDP:League of Legends Launcher "6927:TCP"= 6927:TCP:League of Legends Launcher "6927:UDP"= 6927:UDP:League of Legends Launcher R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [11-2-2010 18:46 5248] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [15-9-2010 17:46 237632] R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [15-9-2010 17:46 338880] R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [15-9-2010 17:46 656320] S0 vtaevi;vtaevi;c:\windows\system32\drivers\yswlfky.sys --> c:\windows\system32\drivers\yswlfky.sys [?] S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [8-1-2010 1:51 380928] S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools Security\BDT\BDTUpdateService.exe [15-9-2010 17:47 235472] S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [27-1-2010 18:10 5248] S3 FXDrv32;FXDrv32;\??\e:\fxdrv32.sys --> e:\FXDrv32.sys [?] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\PC Tools Security\pctsAuxs.exe [15-9-2010 17:45 366840] S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [11-2-2010 18:46 160640] . Inhoud van de 'Gedeelde Taken' map 2010-10-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50] 2010-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1647877149-725345543-500Core.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-02-06 20:30] 2010-10-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1647877149-725345543-500UA.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-02-06 20:30] 2010-10-04 c:\windows\Tasks\Norton Security Scan for Administrator.job - c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-05-09 07:48] . . ------- Bijkomende Scan ------- . uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s LSP: c:\windows\system32\imon.dll LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2d8n1pnt.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2510284&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://radiobar.toolbarhome.com/?hp=df FF - prefs.js: keyword.URL - hxxp://nl.search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2d8n1pnt.default\extensions\{076d3a79-f20b-4e97-a0e0-c4e2384243a7}\components\FFExternalAlert.dll FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2d8n1pnt.default\extensions\{076d3a79-f20b-4e97-a0e0-c4e2384243a7}\components\RadioWMPCore.dll FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2d8n1pnt.default\extensions\radiobar@toolbar\components\toolbarhomewmp.dll FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll FF - component: c:\program files\PC Tools Security\BDT\Firefox\platform\WINNT_x86-msvc\components\libheuristic.dll FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\plugins\npoctoshape.dll FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: c:\documents and settings\All Users\Application Data\NexonEU\NGM\npNxGameeu.dll FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npJoostPlugin.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npoctoshape.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll FF - plugin: c:\program files\Octoshape Streaming Services\Administrator\octoprogram-L03-NMS1008042_SUA_000\npoctoshape.dll FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . - - - - ORPHANS VERWIJDERD - - - - WebBrowser-{3AD798D0-4642-4C55-BC14-CFE7DD19E0D1} - (no file) WebBrowser-{46735DEE-F862-49D1-876D-6382794DC625} - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{80E09551-926A-432B-9B67-F18C3F172ABF} - (no file) . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- [HKEY_USERS\S-1-5-21-1482476501-1647877149-725345543-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,99,0c,5b,bb,51,e5,6d,4d,89,15,ab,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,99,0c,5b,bb,51,e5,6d,4d,89,15,ab,\ [HKEY_USERS\S-1-5-21-1482476501-1647877149-725345543-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:0a,04,dc,73,bf,65,7f,aa,66,96,4a,c4,66,4d,ff,2e,80,61,df,d8,49,2b,37, 26,73,a9,47,69,0c,3d,cc,4a,30,67,84,08,4e,a0,cf,55,dc,10,7c,97,c1,9c,fc,3b,\ "??"=hex:51,26,68,11,bc,f8,f9,83,2f,7f,08,b5,c7,73,36,4c [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Geladen Onder Lopende Processen --------------------- - - - - - - - > 'winlogon.exe'(816) c:\windows\system32\sfc_os.dll - - - - - - - > 'explorer.exe'(1024) c:\windows\system32\sfc_os.dll c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.NLD c:\windows\system32\browselc.dll . Voltooingstijd: 2010-10-04 19:19:58 - machine werd herstart ComboFix-quarantined-files.txt 2010-10-04 17:19 Pre-Run: 14.256.787.456 bytes beschikbaar Post-Run: 14.210.256.896 bytes beschikbaar - - End Of File - - FCA1DD97EAB2DE8F4780C9B26BCF7F3B

Het ging allemaal geweldig en ik moest restarten, nja het programma zelf. Dus dat was die denk aan het doen en toen ging er iets fout. Er miste iets. Ik herhaal het stappenplan wel. Ik dacht ik meld het maar effe Bedankt alvast

Ik heb de 2 dingen verwijderd. Zit nu nog steeds in veilige modus. MBAM LOGJE: Malwarebytes' Anti-Malware 1.46 Malwarebytes Databaseversie: 4541 Windows 5.1.2600 Service Pack 2 (Safe Mode) Internet Explorer 8.0.6001.18702 4-10-2010 18:17:15 mbam-log-2010-10-04 (18-17-15).txt Scantype: Snelle scan Objecten gescand: 125319 Verstreken tijd: 4 minuut/minuten, 16 seconde(n) Geheugenprocessen geïnfecteerd: 0 Geheugenmodulen geïnfecteerd: 0 Registersleutels geïnfecteerd: 0 Registerwaarden geïnfecteerd: 0 Registerdata geïnfecteerd: 0 Mappen geïnfecteerd: 0 Bestanden geïnfecteerd: 0 Geheugenprocessen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Geheugenmodulen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registersleutels geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registerwaarden geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registerdata geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Mappen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Bestanden geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) HiJackThis Logje: Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 18:18:07, on 4-10-2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\WINDOWS\system32\NOTEPAD.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen R3 - URLSearchHook: PC Tools Browser Guard - {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [sW20] C:\WINDOWS\system32\sw20.exe O4 - HKLM\..\Run: [sW24] C:\WINDOWS\system32\sw24.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW O4 - HKLM\..\Run: [PCTools FGuard] C:\Program Files\PC Tools Security\BDT\FGuard.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\Administrator\OctoshapeClient.exe" -inv:bootrun O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.org 2.4 .lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\PC Tools Security\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\PC Tools Security\pctsSvc.exe -- End of file - 9536 bytes Bedankt voor de snelle reactie!

Beste mensen Na het opstarten van mijn pc krijg ik gewoon een zwart scherm. Ik kan dan alleen nog taakbeheer opstarten waarbij ik wel gewoon kan google enzovoort? Ik snap er niks meer van en het is heel irritant. Voordat dit gebeurde gaf mijn pc aan dat ik een virus had(NOD32) dus ik had hem verwijderd, alleen vertelde het programma mij dat ik moest reboote. Dat had ik gedaan en nu gebeurt dit. Hier Hijack logje in veilige modus Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 16:45:08, on 4-10-2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen R3 - URLSearchHook: PC Tools Browser Guard - {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Security\BDT\PCTBrowserDefender.dll O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [sW20] C:\WINDOWS\system32\sw20.exe O4 - HKLM\..\Run: [sW24] C:\WINDOWS\system32\sw24.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW O4 - HKLM\..\Run: [PCTools FGuard] C:\Program Files\PC Tools Security\BDT\FGuard.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\Administrator\OctoshapeClient.exe" -inv:bootrun O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe O4 - HKCU\..\Run: [YXE7DXCQ37] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Qff.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.org 2.4 .lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Browser Defender Update Service - Unknown owner - C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\PC Tools Security\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\PC Tools Security\pctsSvc.exe -- End of file - 9352 bytes

Helemaal verholpen, Perfect en bedankt!

Nee, het is helemaal weg denk ik. Heel erg bedankt voor jou/jullie help.

Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 22:04:23, on 4-9-2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Application Updater\ApplicationUpdater.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\smax4.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\DivX\DivX Update\DivXUpdate.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Octoshape Streaming Services\Administrator\OctoshapeClient.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Pando Networks\Media Booster\PMB.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\WINDOWS\explorer.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe C:\WINDOWS\system32\mspaint.exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\DivX\DivX Plus Player\DivX Plus Player.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ijji - Where Gamers Unite! R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [sW20] C:\WINDOWS\system32\sw20.exe O4 - HKLM\..\Run: [sW24] C:\WINDOWS\system32\sw24.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\Administrator\OctoshapeClient.exe" -inv:bootrun O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe O4 - Startup: OpenOffice.org 2.4 .lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\Administrator\Application Data\DVDVideoSoftIEHelpers\youtubetomp3.htm O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 10528 bytes Veel dank

Malwarebytes' Anti-Malware 1.46 Malwarebytes Databaseversie: 4541 Windows 5.1.2600 Service Pack 2 Internet Explorer 8.0.6001.18702 4-9-2010 12:21:45 mbam-log-2010-09-04 (12-21-45).txt Scantype: Snelle scan Objecten gescand: 127153 Verstreken tijd: 7 minuut/minuten, 36 seconde(n) Geheugenprocessen geïnfecteerd: 0 Geheugenmodulen geïnfecteerd: 0 Registersleutels geïnfecteerd: 2 Registerwaarden geïnfecteerd: 0 Registerdata geïnfecteerd: 0 Mappen geïnfecteerd: 0 Bestanden geïnfecteerd: 0 Geheugenprocessen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Geheugenmodulen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registersleutels geïnfecteerd: HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully. Registerwaarden geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registerdata geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Mappen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Bestanden geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 12:32:18, on 4-9-2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Application Updater\ApplicationUpdater.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\smax4.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\DivX\DivX Update\DivXUpdate.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Octoshape Streaming Services\Administrator\OctoshapeClient.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Pando Networks\Media Booster\PMB.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\WINDOWS\explorer.exe C:\Program Files\League of Legends\lol.launcher.exe C:\Program Files\League of Legends\Air\LOLClient.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe C:\Program Files\League of Legends\Game\League of Legends.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ijji - Where Gamers Unite! R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file) O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: (no name) - {80e09551-926a-432b-9b67-f18c3f172abf} - (no file) O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [sW20] C:\WINDOWS\system32\sw20.exe O4 - HKLM\..\Run: [sW24] C:\WINDOWS\system32\sw24.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\Administrator\OctoshapeClient.exe" -inv:bootrun O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe O4 - Startup: OpenOffice.org 2.4 .lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\Administrator\Application Data\DVDVideoSoftIEHelpers\youtubetomp3.htm O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 10925 bytes