Opstart (boot) super traag

Ro_mien · 3 mei 2011

Sinds een tijdje start mijn pc héééél erg traag op (van zwart scherm tot aanmeldingsscherm, pc zelf is redelijk snel).

Hier is een logje van in eventvwr (boottime = 221298 !!!)

Kan iemand me helpen om dit sneller te maken?

-System

-Provider[ Name] Microsoft-Windows-Diagnostics-Performance[ Guid] {cfc18ec0-96b1-4eba-961b-622caee05b0a}

EventID100Version1Level1Task4002Opcode34Keywords0x8000000000010000-TimeCreated[ SystemTime] 2011-05-03T11:21:54.189Z

EventRecordID9604-Correlation[ ActivityID] {00000000-C6C8-0000-149B-0BC28309CC01}

-Execution[ ProcessID] 1716[ ThreadID] 2036

ChannelMicrosoft-Windows-Diagnostics-Performance/OperationalComputerArbochim-Security[ UserID] S-1-5-19

-EventData

BootTsVersion2BootStartTime2011-05-03T11:17:58.780ZBootEndTime2011-05-03T11:21:51.912ZSystemBootInstance1296UserBootInstance1236BootTime221298MainPathBootTime144098BootKernelInitTime34BootDriverInitTime13908BootDevicesInitTime305BootPrefetchInitTime66256BootPrefetchBytes123342848BootAutoChkTime0BootSmssInitTime9028BootCriticalServicesInitTime3230BootUserProfileProcessingTime1988BootMachineProfileProcessingTime2685BootExplorerInitTime14302BootNumStartupApps3BootPostBootTime77200BootIsRebootAfterInstallfalseBootRootCauseStepImprovementBits0BootRootCauseGradualImprovementBits0BootRootCauseStepDegradationBits0BootRootCauseGradualDegradationBits0BootIsDegradationfalseBootIsStepDegradationfalseBootIsGradualDegradationfalseBootImprovementDelta0BootDegradationDelta0BootIsRootCauseIdentifiedfalse

Dasle · 4 mei 2011

Download HijackThis.

Klik bij "HijackThis Downloads" op "Installer".

Bestand HijackThis.msi opslaan. Daarna kiezen voor "uitvoeren".

Hijackthis wordt nu op je PC geïnstalleerd, een snelkoppeling wordt op je bureaublad geplaatst.

Klik op de snelkoppeling om HijackThis te starten

Klik ofwel op "Do a systemscan and save a logfile", ofwel eerst op "Scan" en dan op "Savelog".

Er opent een kladblokvenster, hou gelijktijdig de CTRL en A-toets ingedrukt, nu is alles geselecteerd. Hou gelijktijdig de CTRL en C-toets ingedrukt, nu is alles gekopieerd. Plak nu het HJT logje in je bericht door CTRL en V-toets.

Krijg je een melding ""For some reason your system denied writing to the Host file ....", klik dan gewoon door op de OK-toets.

Let op : Windows Vista & 7 gebruikers dienen HijackThis als “administrator” uit te voeren via rechtermuisknop “als administrator uitvoeren". Indien dit via de snelkoppeling niet lukt voer je HijackThis als administrator uit in de volgende map : C:\Program Files\Trend Micro\HiJackThis of C:\Program Files (x86)\Trend Micro\HiJackThis.

Ro_mien · 5 mei 2011

Hoi Dasle,

Hier is mijn logje !

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:58:51, on 5/05/2011

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.19048)

Boot mode: Normal

Running processes:

C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\PROGRA~1\HP\DIGITA~1\bin\hpqbam08.exe

C:\PROGRA~1\HP\DIGITA~1\bin\hpqgpc01.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer aangeboden door Dell

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\4.3.0.5\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\4.3.0.5\IPSBHO.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.3.0.5\coIEPlg.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL

O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CAB

O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{DB831D54-4EE7-4AC8-8430-CC47C4154E06}: NameServer = 195.238.2.21,195.238.2.22

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 5265 bytes

Dasle · 5 mei 2011

Als een expert online komt helpt deze je verder met je logje ;-)

kape · 5 mei 2011

Dit logje is probleemloos. Je mag het volgende even uitvoeren :

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:

Klik hier

2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.

3. Dubbelklik op "Combofix.exe" om de tool te starten.

4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion", herstart dan de computer.

5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Ro_mien · 9 mei 2011

ComboFix 11-05-08.04 - ARBOCHIM NV 09/05/2011 9:01.8.2 - x86

Microsoft® Windows Vista™ Business 6.0.6002.2.1252.32.1043.18.2045.797 [GMT 2:00]

Gestart vanuit: c:\users\ARBOCHIM NV\Desktop\ComboFix.exe

AV: Norton 360 *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

FW: Norton 360 *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

SP: Norton 360 *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\ARBOCHIM NV\Documents\Readiris.DUS

.

Besmet exemplaar van c:\windows\system32\userinit.exe werd aangetroffen en gedesinfecteerd

Hersteld exemplaar van - c:\windows\ERDNT\cache\userinit.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-04-09 to 2011-05-09 ))))))))))))))))))))))))))))))

.

2011-05-09 07:12 . 2011-05-09 07:12 -------- d-----w- c:\users\Romina\AppData\Local\temp

2011-05-09 07:12 . 2011-05-09 07:12 -------- d-----w- c:\users\Romina.Arbochim\AppData\Local\temp

2011-05-09 07:12 . 2011-05-09 07:12 -------- d-----w- c:\users\RA\AppData\Local\temp

2011-05-09 07:12 . 2011-05-09 07:12 -------- d-----w- c:\users\Public\AppData\Local\temp

2011-05-09 07:12 . 2011-05-09 07:12 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-05-09 07:12 . 2011-05-09 07:12 -------- d-----w- c:\users\Administrator\AppData\Local\temp

2011-05-09 06:33 . 2011-05-09 06:34 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{5411B0F9-3B1F-4281-B0C1-501EF52C7FE8}

2011-05-06 11:18 . 2011-04-11 07:04 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3DB0EFAC-B29D-49F2-B71B-21EC15D5C131}\mpengine.dll

2011-05-06 11:12 . 2011-05-06 11:13 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{0335E3C3-C213-461F-880A-36E866C9F7C0}

2011-05-05 06:54 . 2011-05-05 06:54 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{2F621F99-8A4C-4876-9EAE-76F7179A1790}

2011-05-04 06:36 . 2011-05-04 06:36 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{F518C4C8-D9F4-45B8-8A43-A99DC9C8DB4B}

2011-05-03 07:16 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll

2011-05-03 07:16 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll

2011-05-03 07:15 . 2011-03-12 21:55 876032 ----a-w- c:\windows\system32\XpsPrint.dll

2011-05-03 07:02 . 2011-05-03 07:02 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{DE28E515-6E62-4FB8-8562-FD31CD8D030E}

2011-05-02 06:22 . 2011-05-02 06:23 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{140F786E-E0DC-4A6F-8122-97D8C8AAF279}

2011-04-29 06:31 . 2011-04-29 06:31 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{2F26501B-02A8-41B3-8848-6F4C80CFB133}

2011-04-28 06:59 . 2011-04-28 06:59 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{08EE6891-09F4-4B03-B062-7B4A65FB5A91}

2011-04-27 06:34 . 2011-04-27 06:34 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{B5C94EBC-A199-4648-8EFD-E5BC28E676D6}

2011-04-26 06:22 . 2011-04-26 06:22 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{9BB1FD93-FB51-4F98-8E29-0374069ADF69}

2011-04-22 06:21 . 2011-04-22 06:22 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{980410BC-C1D4-4655-A7AC-C4D09FE48344}

2011-04-20 06:33 . 2011-04-20 06:33 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{F88D5EA5-068B-4FA1-9654-D7747A8DBB42}

2011-04-19 06:28 . 2011-04-19 06:28 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{E2134571-CCF8-4604-88F5-BC6CBB213BAF}

2011-04-18 11:49 . 2011-04-18 11:49 -------- d-----w- c:\program files\Readiris Pro 11

2011-04-18 11:40 . 2011-04-19 11:00 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\Roxio

2011-04-18 11:34 . 2011-04-18 11:34 -------- d-----w- C:\found.002

2011-04-18 06:32 . 2011-04-18 06:32 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{189FB5BD-FA2C-4BB7-9CBF-797B5AFBD966}

2011-04-15 11:52 . 2011-04-15 11:52 -------- d-----w- c:\windows\system32\N360_BACKUP

2011-04-15 10:09 . 2011-03-03 13:25 2041856 ----a-w- c:\windows\system32\win32k.sys

2011-04-15 10:09 . 2011-03-03 15:42 739328 ----a-w- c:\windows\system32\inetcomm.dll

2011-04-15 10:09 . 2011-02-17 06:23 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-04-15 10:09 . 2011-03-03 10:50 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-04-15 10:09 . 2011-02-12 08:39 191488 ----a-w- c:\windows\system32\FXSCOVER.exe

2011-04-15 06:28 . 2011-04-15 06:28 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{07DA4839-E1CD-4963-BD12-8BB3B7328C8B}

2011-04-14 06:57 . 2011-05-09 07:17 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\temp

2011-04-14 06:18 . 2011-04-14 06:18 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\{FD2502FF-1356-4A25-93C4-FD092078910D}

2011-04-11 14:02 . 2011-04-11 14:02 -------- d-----w- c:\users\ARBOCHIM NV\AppData\Local\Apple Computer

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-26 11:38 . 2011-04-06 11:08 4092928 ----a-w- c:\windows\system32\Redemption.dll

2011-03-16 07:13 . 2010-06-24 10:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-03-15 08:41 . 2011-03-15 08:36 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2011-03-03 15:40 . 2011-05-03 07:16 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll

2011-03-03 15:40 . 2011-05-03 07:16 542720 ----a-w- c:\windows\apppatch\AcLayers.dll

2011-03-03 15:40 . 2011-05-03 07:16 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll

2011-03-03 15:40 . 2011-05-03 07:16 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll

2011-03-01 10:12 . 2011-04-07 20:02 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll

2011-03-01 10:12 . 2011-04-07 20:02 53632 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll

2011-03-01 10:12 . 2011-04-07 20:02 29568 ----a-w- c:\windows\system32\LMIport.dll

2011-03-01 10:12 . 2011-04-07 20:02 87424 ----a-w- c:\windows\system32\LMIinit.dll

2011-02-22 14:13 . 2011-03-23 07:49 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll

2011-02-22 13:33 . 2011-03-23 07:49 1068544 ----a-w- c:\windows\system32\DWrite.dll

2011-02-22 13:33 . 2011-03-23 07:49 797696 ----a-w- c:\windows\system32\FntCache.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-05 68856]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders credssp.dll, schannel.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk

backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk

backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk]

backup=c:\windows\pss\Google Updater.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Ringo Launcher.lnk]

backup=c:\windows\pss\Ringo Launcher.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDDMStatus.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDDMStatus.lnk

backup=c:\windows\pss\WDDMStatus.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]

2008-10-14 19:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2011-01-22 05:05 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]

c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [bU]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCS2Service]

2005-10-19 16:19 49152 ----a-w- c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCSService]

2003-08-21 15:12 32768 ----a-w- c:\program files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link Air Utility]

2003-09-03 16:49 3358720 ----a-w- c:\program files\D-Link\Air Utility\AirCFG.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link AirPlus G]

2005-11-23 13:04 1544192 ----a-w- c:\program files\D-Link\AirPlus G\AirGCFG.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2007-05-08 15:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]

2006-09-29 11:39 151552 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2006-10-03 10:35 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2006-10-03 10:37 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]

2010-12-21 09:53 1483264 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]

2006-10-20 16:23 118784 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]

2007-05-06 16:10 405504 ----a-w- c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

2006-11-10 11:35 90112 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2007-05-24 23:40 77824 ----a-w- c:\program files\Java\jre1.6.0\bin\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

2007-12-05 14:18 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"SpybotSnD"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 135664]

R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 135664]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R4 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [x]

R4 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]

R4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0403000.005\SYMDS.SYS [2010-02-04 328752]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0403000.005\SYMEFA.SYS [2010-04-22 173104]

S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\BASHDefs\20110430.001\BHDrvx86.sys [2011-04-15 802936]

S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0403000.005\ccHPx86.sys [2010-02-26 501888]

S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\IPSDefs\20110506.001\IDSvix86.sys [2011-03-14 353912]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0403000.005\Ironx86.SYS [2010-04-29 116784]

S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\N360\0403000.005\SYMTDIV.SYS [2010-05-06 339504]

S2 N360;Norton 360;c:\program files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe [2010-02-26 126392]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-03-15 102448]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqddsvc hpqcxs08

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

HPService REG_MULTI_SZ HPSLPSVC

.

Inhoud van de 'Gedeelde Taken' map

.

2011-05-09 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-05 07:40]

.

2011-05-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 09:38]

.

2011-05-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-20 09:38]

.

2011-05-09 c:\windows\Tasks\User_Feed_Synchronization-{A075225D-A541-4EC5-859A-ECF39CA174F5}.job

- c:\windows\system32\msfeedssync.exe [2011-04-15 04:43]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/

uInternet Settings,ProxyOverride = *.local

TCP: {DB831D54-4EE7-4AC8-8430-CC47C4154E06} = 195.238.2.21,195.238.2.22

.

------- Bestandsassociaties -------

.

.txt=

.

- - - - ORPHANS VERWIJDERD - - - -

.

Toolbar-Locked - (no file)

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-05-09 09:17

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\N360]

"ImagePath"="\"c:\program files\Norton 360\Engine\4.3.0.5\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\4.3.0.5\diMaster.dll\" /prefetch:1"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-4193266179-2733219216-3454118930-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{073CF3BD-2341-0F7F-B711-41ACFDCDEE82}*]

"bbhhklochnngdeeeeodffbelgdoohjoiiogl"=hex:61,61,00,00

"abhhklochnngdeeeeokgacnodcnlgnefdi"=hex:61,61,00,00

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'Explorer.exe'(2616)

c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll

c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL

c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_dut.nlr

c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\windows\system32\DRIVERS\xaudio.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\windows\system32\WUDFHost.exe

c:\windows\system32\DllHost.exe

c:\windows\system32\wbem\unsecapp.exe

c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe

c:\progra~1\HP\DIGITA~1\bin\hpqbam08.exe

c:\progra~1\HP\DIGITA~1\bin\hpqgpc01.exe

c:\windows\servicing\TrustedInstaller.exe

.

**************************************************************************

.

Voltooingstijd: 2011-05-09 09:25:35 - machine werd herstart

ComboFix-quarantined-files.txt 2011-05-09 07:25

ComboFix2.txt 2011-04-14 06:57

ComboFix3.txt 2011-04-13 13:11

ComboFix4.txt 2011-04-13 08:21

ComboFix5.txt 2011-05-09 06:55

.

Pre-Run: 246,992,781,312 bytes beschikbaar

Post-Run: 248,223,006,720 bytes beschikbaar

.

- - End Of File - - C0997EEB9B5B41288388F18CD57C7171

kape · 9 mei 2011

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Folder::

c:\users\ARBOCHIM NV\AppData\Local\{5411B0F9-3B1F-4281-B0C1-501EF52C7FE8}

c:\users\ARBOCHIM NV\AppData\Local\{0335E3C3-C213-461F-880A-36E866C9F7C0}

c:\users\ARBOCHIM NV\AppData\Local\{2F621F99-8A4C-4876-9EAE-76F7179A1790}

c:\users\ARBOCHIM NV\AppData\Local\{F518C4C8-D9F4-45B8-8A43-A99DC9C8DB4B}

c:\users\ARBOCHIM NV\AppData\Local\{DE28E515-6E62-4FB8-8562-FD31CD8D030E}

c:\users\ARBOCHIM NV\AppData\Local\{140F786E-E0DC-4A6F-8122-97D8C8AAF279}

c:\users\ARBOCHIM NV\AppData\Local\{2F26501B-02A8-41B3-8848-6F4C80CFB133}

c:\users\ARBOCHIM NV\AppData\Local\{08EE6891-09F4-4B03-B062-7B4A65FB5A91}

c:\users\ARBOCHIM NV\AppData\Local\{B5C94EBC-A199-4648-8EFD-E5BC28E676D6}

c:\users\ARBOCHIM NV\AppData\Local\{9BB1FD93-FB51-4F98-8E29-0374069ADF69}

c:\users\ARBOCHIM NV\AppData\Local\{980410BC-C1D4-4655-A7AC-C4D09FE48344}

c:\users\ARBOCHIM NV\AppData\Local\{F88D5EA5-068B-4FA1-9654-D7747A8DBB42}

c:\users\ARBOCHIM NV\AppData\Local\{E2134571-CCF8-4604-88F5-BC6CBB213BAF}

C:\found.002

c:\users\ARBOCHIM NV\AppData\Local\{189FB5BD-FA2C-4BB7-9CBF-797B5AFBD966}

c:\users\ARBOCHIM NV\AppData\Local\{07DA4839-E1CD-4963-BD12-8BB3B7328C8B}

c:\users\ARBOCHIM NV\AppData\Local\{FD2502FF-1356-4A25-93C4-FD092078910D}

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht … en laat dan even weten hoe de toestand nu is ?

Ro_mien · 9 mei 2011

Nee, nog altijd erg traag. Hier is mijn nieuw logje.

ComboFix 11-05-08.04 - ARBOCHIM NV 09/05/2011 10:26:50.9.2 - x86

Microsoft® Windows Vista™ Business 6.0.6002.2.1252.32.1043.18.2045.1039 [GMT 2:00]

Gestart vanuit: c:\users\ARBOCHIM NV\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\ARBOCHIM NV\Desktop\CFScript.txt

AV: Norton 360 *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

FW: Norton 360 *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

SP: Norton 360 *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-04-09 to 2011-05-09 ))))))))))))))))))))))))))))))

.

2011-05-09 08:40 . 2011-05-09 08:40 -------- d-----w- c:\users\Romina\AppData\Local\temp

2011-05-09 08:40 . 2011-05-09 08:40 -------- d-----w- c:\users\Romina.Arbochim\AppData\Local\temp

2011-05-09 08:40 . 2011-05-09 08:40 -------- d-----w- c:\users\RA\AppData\Local\temp

2011-05-09 08:40 . 2011-05-09 08:40 -------- d-----w- c:\users\Public\AppData\Local\temp

2011-05-09 08:40 . 2011-05-09 08:40 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-05-09 08:40 . 2011-05-09 08:40 -------- d-----w- c:\users\Administrator\AppData\Local\temp

2011-05-09 07:51 . 2007-03-23 02:05 29272 ----a-r- c:\windows\system32\AdobePDF.dll