Tergend trage laptop 100% CPU verbruik

kweezie wabbit · 11 januari 2012

Open een nieuw kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Folder::

c:\program files\BabylonToolbar

c:\users\Anja\AppData\Local\Babylon

c:\programdata\Babylon

c:\users\Anja\AppData\Roaming\Babylon

File::

C:\user.js

Firefox::

FF - ProfilePath - c:\users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\5rhy1mfo.default\

FF - prefs.js: browser.startup.homepage -

FF - user.js: extensions.BabylonToolbar_i.id - 10f88a49000000000000001f3ac92810

FF - user.js: extensions.BabylonToolbar_i.hardId - 10f88a49000000000000001f3ac92810

FF - user.js: extensions.BabylonToolbar_i.instlDay - 15342

FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1717:49

FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar_i.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar_i.tlbrId - base

FF - user.js: extensions.BabylonToolbar_i.newTab - false

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=108973

FF - user.js: extensions.BabylonToolbar_i.babExt -

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar_i.instlRef - std

Sla dit bestand op je bureaublad op als CFScript

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

Soekie · 11 januari 2012

Oké!

Kreeg wel even de foutmelding dat PEV.exe niet meer werkte, maar hij is gewoon doorgegaan en het is gelukt.

Die babylon kwam trouwens mee met quiktime wat ik moest installeren om iets werkgerelateerd te doen, maar de installatie van QT is dus nooit gelukt. :-/

ComboFix 12-01-09.03 - 11/01/2012 17:16:08.9.1 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.2037.1020 [GMT 1:00]

Gestart vanuit: c:\downloaded with mozilla\ComboFix.exe

gebruikte Opdracht switches :: c:\users\\Desktop\CFScript.txt

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"C:\user.js"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\BabylonToolbar

c:\program files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll

c:\program files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll

c:\program files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe

c:\program files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll

c:\program files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll

c:\program files\BabylonToolbar\BabylonToolbar\1.5.3.17\uninstall.exe

c:\programdata\Babylon

c:\users\\AppData\Local\Babylon

c:\users\\AppData\Local\Babylon\Setup\bab033.tbinst.dat

c:\users\\AppData\Local\Babylon\Setup\Babylon.dat

c:\users\\AppData\Local\Babylon\Setup\BExternal.dll

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\cmbx.png

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\common.js

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\eula.html

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\lngs.png

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\page1.css

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\page1.html

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\page1.js

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\page1Lrg.css

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\page2.css

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\page2.html

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\page2.js

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\page2Lrg.css

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\page9.html

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\pBar.gif

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\title1.png

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\title2.png

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\toolBar.jpg

c:\users\\AppData\Local\Babylon\Setup\HtmlScreens\vIcn.png

c:\users\\AppData\Local\Babylon\Setup\IECookieLow.dll

c:\users\\AppData\Local\Babylon\Setup\Setup-tbmntr903-9.0.3.33.zpb

c:\users\\AppData\Local\Babylon\Setup\Setup.exe

c:\users\\AppData\Local\Babylon\Setup\SetupStrings.dat

c:\users\\AppData\Local\Babylon\Setup\sqlite3.dll

c:\users\\AppData\Roaming\Babylon

c:\users\\AppData\Roaming\Babylon\log_file.txt

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-12-11 to 2012-01-11 ))))))))))))))))))))))))))))))

.

2012-01-11 16:31 . 2012-01-11 16:31 -------- d-----w- c:\users\\AppData\Local\temp

2012-01-11 16:31 . 2012-01-11 16:31 -------- d-----w- c:\users\Public\AppData\Local\temp

2012-01-11 16:31 . 2012-01-11 16:31 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-01-11 05:58 . 2012-01-11 05:58 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4BE671B2-5D57-4183-84D8-E91AF408907F}\offreg.dll

2012-01-10 07:30 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4BE671B2-5D57-4183-84D8-E91AF408907F}\mpengine.dll

2012-01-03 19:40 . 2012-01-03 19:40 -------- d-----w- c:\users\\AppData\Local\MPlayer

2012-01-03 19:26 . 2012-01-05 12:17 -------- d-----w- c:\users\\.smplayer

2012-01-03 19:22 . 2012-01-03 19:24 -------- d-----w- c:\program files\SMPlayer

2012-01-03 19:10 . 2012-01-03 19:18 -------- d-----w- c:\users\\AppData\Roaming\vlc

2012-01-03 19:06 . 2012-01-03 19:06 -------- d-----w- c:\program files\VideoLAN

2012-01-03 18:25 . 2012-01-03 18:25 -------- d-----w- c:\programdata\Apple Computer

2012-01-03 18:25 . 2010-04-16 17:00 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin6.dll

2012-01-03 18:25 . 2010-04-16 17:00 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin5.dll

2012-01-03 18:25 . 2010-04-16 17:00 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin4.dll

2012-01-03 18:25 . 2010-04-16 17:00 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin3.dll

2012-01-03 18:25 . 2010-04-16 17:00 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin2.dll

2012-01-03 18:25 . 2010-04-16 17:00 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin.dll

2012-01-03 18:25 . 2010-03-17 20:53 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2012-01-03 18:25 . 2010-03-17 20:53 69632 ----a-w- c:\windows\system32\QuickTime.qts

2012-01-03 18:25 . 2010-03-17 20:53 180224 ----a-w- c:\windows\system32\QTCF.dll

2012-01-03 18:25 . 2012-01-03 18:33 -------- d-----w- c:\program files\QuickTime Alternative

2012-01-03 17:03 . 2012-01-03 17:01 39401336 ----a-w- c:\windows\system32\QuickTimeInstaller.exe

2012-01-03 16:50 . 2012-01-03 16:50 237 ----a-w- C:\user.js

2012-01-02 21:27 . 2012-01-02 21:27 -------- d-----w- c:\windows\nl

2012-01-02 21:21 . 2012-01-02 21:21 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2012-01-02 21:20 . 2009-09-04 16:44 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll

2012-01-02 21:20 . 2009-09-04 16:44 515416 ----a-w- c:\windows\system32\XAudio2_5.dll

2012-01-02 21:20 . 2009-09-04 16:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll

2012-01-02 21:19 . 2006-11-29 12:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll

2012-01-02 15:04 . 2012-01-02 15:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-01-02 15:04 . 2011-12-10 14:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-31 18:30 . 2011-12-31 18:30 232512 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys

2011-12-31 18:29 . 2011-12-31 18:30 -------- d-----w- c:\program files\DAEMON Tools Pro

2011-12-31 16:51 . 2011-12-31 16:51 -------- d-----w- C:\superoneclick

2011-12-31 16:40 . 2011-12-31 16:40 -------- d-----w- C:\Root

2011-12-31 16:40 . 2011-12-31 16:40 -------- d-----w- C:\Exploits

2011-12-31 16:40 . 2011-12-31 16:40 -------- d-----w- C:\Devices

2011-12-31 16:40 . 2011-12-31 16:40 -------- d-----w- C:\Dependencies

2011-12-31 16:40 . 2011-12-31 16:40 -------- d-----w- C:\ADB

2011-12-29 22:48 . 2011-12-29 22:48 -------- d-----w- c:\program files\MyFree Codec

2011-12-29 21:18 . 2011-12-29 21:18 -------- d-----w- C:\Temp

2011-12-29 21:16 . 2011-12-29 21:16 -------- d-----w- c:\users\\AppData\Local\Samsung

2011-12-29 21:15 . 2011-12-29 21:15 -------- d-----w- c:\users\\AppData\Roaming\Samsung

2011-12-29 21:11 . 2011-10-27 01:25 1416680 ----a-w- c:\windows\system32\WdfCoInstaller01005.dll

2011-12-29 21:11 . 2011-10-27 01:25 1416680 ----a-w- c:\windows\system32\drivers\WdfCoInstaller01005.dll

2011-12-29 21:11 . 2011-10-27 01:25 136808 ----a-w- c:\windows\system32\drivers\ssadmdm.sys

2011-12-29 21:11 . 2011-10-27 01:25 12776 ----a-w- c:\windows\system32\drivers\ssadmdfl.sys

2011-12-29 21:11 . 2011-10-27 01:25 10472 ----a-w- c:\windows\system32\drivers\ssadcmnt.sys

2011-12-29 21:11 . 2011-10-27 01:25 10472 ----a-w- c:\windows\system32\drivers\ssadcm.sys

2011-12-29 21:11 . 2011-10-27 01:25 10344 ----a-w- c:\windows\system32\drivers\ssadwhnt.sys

2011-12-29 21:11 . 2011-10-27 01:25 10344 ----a-w- c:\windows\system32\drivers\ssadwh.sys

2011-12-29 21:11 . 2011-10-27 01:25 30312 ----a-w- c:\windows\system32\drivers\ssadadb.sys

2011-12-29 21:11 . 2011-10-27 01:25 121064 ----a-w- c:\windows\system32\drivers\ssadbus.sys

2011-12-29 21:11 . 2011-10-27 01:25 114280 ----a-w- c:\windows\system32\drivers\ssadserd.sys

2011-12-29 16:08 . 2011-12-29 21:06 -------- d-----w- c:\programdata\Samsung

2011-12-29 16:03 . 2011-12-29 16:03 -------- d-----w- c:\users\\AppData\Local\Downloaded Installations

2011-12-29 15:17 . 2011-12-29 15:17 -------- d-----w- c:\program files\Microsoft.NET

2011-12-28 21:48 . 2011-12-28 21:49 -------- d-----w- c:\program files\Speccy

2011-12-28 16:24 . 2011-11-08 12:10 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2011-12-27 15:10 . 2011-12-27 15:10 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-12-22 14:33 . 2011-11-08 14:42 2048 ----a-w- c:\windows\system32\tzres.dll

2011-12-16 18:23 . 2011-10-27 08:01 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-12-16 18:23 . 2011-10-27 08:01 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-12-15 23:35 . 2011-11-23 13:37 2043904 ----a-w- c:\windows\system32\win32k.sys

2011-12-15 21:53 . 2011-10-25 15:56 49152 ----a-w- c:\windows\system32\csrsrv.dll

2011-12-15 20:59 . 2011-10-14 16:02 429056 ----a-w- c:\windows\system32\EncDec.dll

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-29 15:38 . 2011-11-29 15:38 90112 ----a-w- c:\windows\MAMCityDownload.ocx

2011-11-29 15:38 . 2011-11-29 15:38 325552 ----a-w- c:\windows\MASetupCaller.dll

2011-11-29 15:38 . 2011-11-29 15:38 30568 ----a-w- c:\windows\MusiccityDownload.exe

2011-11-29 15:38 . 2011-11-29 15:38 974848 ----a-w- c:\windows\system32\cis-2.4.dll

2011-11-29 15:38 . 2011-11-29 15:38 81920 ----a-w- c:\windows\system32\issacapi_bs-2.3.dll

2011-11-29 15:38 . 2011-11-29 15:38 65536 ----a-w- c:\windows\system32\issacapi_pe-2.3.dll

2011-11-29 15:38 . 2011-11-29 15:38 57344 ----a-w- c:\windows\system32\MTXSYNCICON.dll

2011-11-29 15:38 . 2011-11-29 15:38 57344 ----a-w- c:\windows\system32\MK_Lyric.dll

2011-11-29 15:38 . 2011-11-29 15:38 57344 ----a-w- c:\windows\system32\issacapi_se-2.3.dll

2011-11-29 15:38 . 2011-11-29 15:38 569344 ----a-w- c:\windows\system32\muzdecode.ax

2011-11-29 15:38 . 2011-11-29 15:38 491520 ----a-w- c:\windows\system32\muzapp.dll

2011-11-29 15:38 . 2011-11-29 15:38 49152 ----a-w- c:\windows\system32\MaJGUILib.dll

2011-11-29 15:38 . 2011-11-29 15:38 45056 ----a-w- c:\windows\system32\MaXMLProto.dll

2011-11-29 15:38 . 2011-11-29 15:38 45056 ----a-w- c:\windows\system32\MACXMLProto.dll

2011-11-29 15:38 . 2011-11-29 15:38 40960 ----a-w- c:\windows\system32\MTTELECHIP.dll

2011-11-29 15:38 . 2011-11-29 15:38 40960 ----a-w- c:\windows\system32\MAMACExtract.dll

2011-11-29 15:38 . 2011-11-29 15:38 352256 ----a-w- c:\windows\system32\MSLUR71.dll

2011-11-29 15:38 . 2011-11-29 15:38 258048 ----a-w- c:\windows\system32\muzoggsp.ax

2011-11-29 15:38 . 2011-11-29 15:38 245760 ----a-w- c:\windows\system32\MSCLib.dll

2011-11-29 15:38 . 2011-11-29 15:38 24576 ----a-w- c:\windows\system32\MASetupCleaner.exe

2011-11-29 15:38 . 2011-11-29 15:38 200704 ----a-w- c:\windows\system32\muzwmts.dll

2011-11-29 15:38 . 2011-11-29 15:38 172032 ----a-w- c:\windows\system32\muzapp.exe

2011-11-29 15:38 . 2011-11-29 15:38 155648 ----a-w- c:\windows\system32\MSFLib.dll

2011-11-29 15:38 . 2011-11-29 15:38 143360 ----a-w- c:\windows\system32\3DAudio.ax

2011-11-29 15:38 . 2011-11-29 15:38 135168 ----a-w- c:\windows\system32\muzaf1.dll

2011-11-29 15:38 . 2011-11-29 15:38 131072 ----a-w- c:\windows\system32\muzmpgsp.ax

2011-11-29 15:38 . 2011-11-29 15:38 122880 ----a-w- c:\windows\system32\muzeffect.ax

2011-11-29 15:38 . 2011-11-29 15:38 118784 ----a-w- c:\windows\system32\MaDRM.dll

2011-11-29 15:38 . 2011-11-29 15:38 110592 ----a-w- c:\windows\system32\muzmp4sp.ax

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-06 133656]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-06 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-06 166424]

"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-03 959976]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-09-07 159744]

"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-08-28 36864]

"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2008-02-15 405504]

"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk

backup=c:\windows\pss\Digital Line Detect.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk

backup=c:\windows\pss\QuickSet.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk

backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^Users^Anja^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3 .lnk]

path=c:\users\Anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3 .lnk

backup=c:\windows\pss\OpenOffice.org 3.3 .lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-12-18 07:58 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]

2007-09-07 06:49 159744 ----a-w- c:\program files\DellTPad\Apoint.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent]

2011-08-17 07:29 4527424 ----a-w- c:\program files\DAEMON Tools Pro\DTAgent.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DELL Webcam Manager]

2007-07-27 15:43 118784 ------w- c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]

2009-05-21 09:13 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]

2008-02-13 18:21 16384 ----a-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]

2008-01-18 11:40 17920 ----a-w- c:\dell\E-Center\EULALauncher.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]

2007-03-21 12:00 174872 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]

2011-12-27 14:21 937360 ----a-w- c:\program files\Samsung\Kies\KiesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]

2011-12-27 14:21 21392 ----a-w- c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]

2011-12-27 14:21 3508624 ----a-w- c:\program files\Samsung\Kies\KiesTrayAgent.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM02Mon.exe]

2007-08-28 05:51 36864 ----a-w- c:\windows\OEM02Mon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]

2007-11-01 14:39 189736 ------w- c:\program files\Dell\MediaDirect\PCMService.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlusService]

2011-10-24 15:51 801792 ----a-w- c:\program files\Yuna Software\Messenger Plus!\PlusService.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

2008-04-19 12:39 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

.

R3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\DRIVERS\a38usbxp.sys [2004-04-30 24832]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-11-12 73728]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

Inhoud van de 'Gedeelde Taken' map

.

2012-01-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-30 19:19]

.

2012-01-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-30 19:19]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/ig/dell?hl=nl&client=dell-row&channel=be&ibd=3080419

IE: Download all links using BitComet - j:\program files\BitComet\BitComet.exe/AddAllLink.htm

IE: Download all videos using BitComet - j:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: Download link using &BitComet - j:\program files\BitComet\BitComet.exe/AddLink.htm

TCP: DhcpNameServer = 134.58.126.3 134.58.127.1

FF - ProfilePath - c:\users\Anja\AppData\Roaming\Mozilla\Firefox\Profiles\5rhy1mfo.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

.

- - - - ORPHANS VERWIJDERD - - - -

.

AddRemove-BabylonToolbar - c:\program files\BabylonToolbar\BabylonToolbar\1.5.3.17\uninstall.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-01-11 17:31

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,71,1b,84,bd,9a,ae,bf,46,b0,7d,96,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,71,1b,84,bd,9a,ae,bf,46,b0,7d,96,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)