politie virus

EightFourSix · 4 februari 2013

Zoek.exe Version 4.0.0.1 Updated 04-February-2013

Tool run by Anna‹ck on ma 04/02/2013 at 16:10:47,97.

Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x86

Running in: Normal Mode Internet Access Detected

==== Running Processes ======================

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\SMINST\BLService.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Google\Update\1.3.21.124\GoogleCrashHandler.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\igfxsrvc.exe

C:\Windows\system32\conime.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Program Files\Epson Software\Event Manager\EEventManager.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\DivX\DivX Update\DivXUpdate.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files\Searchqu Toolbar\Datamngr\datamngrUI.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Ask.com\Updater\Updater.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Ares\Ares.exe

C:\Windows\System32\spool\drivers\w32x86\3\E_FATIFIE.EXE

C:\Windows\ehome\ehtray.exe

C:\Program Files\MyTomTom 3\MyTomTomSA.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE

C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe

C:\Windows\system32\taskeng.exe

C:\Users\Annaïck\Downloads\zoek.exe

C:\Users\ANNACK~1\AppData\Local\Temp\RarSFX1\zoek.com

C:\Windows\system32\wbem\wmiprvse.exe

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

hijackthis

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"bProtector Start Page"=-

==== Deleting Files \ Folders ======================

"C:\Users\Annaïck\AppData\Roaming\Babylon" not found

"C:\Users\Annaïck\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk" not found

"C:\Users\Annaïck\AppData\Local\Ilivid Player" not found

"C:\Users\Annaïck\AppData\Local\APN" not found

"C:\Users\Annaïck\AppData\Local\Conduit" not found

"C:\Users\Annaïck\AppData\LocalLow\AskToolbar" not found

"C:\Users\Annaïck\AppData\LocalLow\facemoods.com" not found

"C:\Users\Annaïck\AppData\LocalLow\BabylonToolbar" not found

"C:\Users\Annaïck\AppData\LocalLow\DataMngr" not found

"C:\Users\Annaïck\AppData\LocalLow\searchqutoolbar" not found

"C:\Users\Annaïck\AppData\LocalLow\Conduit" not found

"C:\Users\Annaïck\AppData\Local\Google\Chrome\User Data\Default\bProtectorPreferences" not found

"C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml" deleted

"C:\Program Files\Mozilla Firefox\searchplugins\Search_Results.xml" deleted

"C:\ProgramData\0tbpw.pad" deleted

"C:\ProgramData\ism_0_llatsni.pad" deleted

"C:\Program Files\Ask.com\Updater\Updater.exe" deleted

"C:\Program Files\Searchqu Toolbar\Datamngr\datamngrUI.exe" deleted

"C:\Program Files\BabylonToolbar" deleted

"C:\Program Files\Ask.com" deleted

"C:\Program Files\Searchqu Toolbar" not deleted

"C:\ProgramData\Ask" deleted

"C:\ProgramData\boost_interprocess" deleted

"C:\ProgramData\Babylon" deleted

"C:\Program Files\Ask.com\Updater" deleted

"C:\Program Files\Searchqu Toolbar\Datamngr" not deleted

==== System Specs ======================

Windows: Windows Vista Home Premium Edition Service Pack 2 (Build 6002)

Internet Explorer: 9.0.8112.16421

Memory (RAM): 3003 MB

CPU Info: Intel® Pentium® Dual CPU T3200 @ 2.00GHz

CPU Speed: 1374,4 MHz

Sound Card: Luidsprekers (Conexant High Def |

Display Adapters: Mobile Intel® 4 Series Express Chipset Family | Mobile Intel® 4 Series Express Chipset Family | RDPDD Chained DD | RDP Encoder Mirror Driver

Monitors: 1x; Algemeen PnP-beeldscherm |

Screen Resolution: 1440 X 900 - 32 bit

Network: Network Present

Network Adapters: Atheros AR5007 802.11b/g WiFi Adapter | Realtek RTL8102E Family PCI-E Fast Ethernet NIC (NDIS 6.0)

CD / DVD Drives: 1x (E: | ) E: Optiarc DVD RW AD-7561S

Ports: COM3 LPT Port NOT Present.

Mouse: 5 Button Wheel Mouse Present

Hard Disks: C: 223,5GB | D: 9,4GB

Hard Disks - Free: C: 100,4GB | D: 1,7GB

Manufacturer *: Hewlett-Packard

BIOS Info: AT/AT COMPATIBLE | 10/01/08 | HPQOEM - 1

Time Zone: Romance (standaardtijd)

Motherboard *: Wistron 360C

Sun Java version: 1.6.0_38

Country: Belgi‰

Language: NLB

==== Files Recently Created / Modified ======================

====== C:\Windows ====

====== C:\Users\ANNACK~1\AppData\Local\Temp ====

====== C:\Windows\system32 =====

====== C:\Windows\system32\drivers =====

====== C:\Windows\Tasks ======

====== C:\Windows\Temp ======

======= C:\Program Files =====

2013-01-20 00:42:05 -------- d-----w- C:\Program Files\Mozilla Maintenance Service

======= C: =====

====== C:\Users\Anna‹ck\AppData\Roaming ======

2013-01-14 10:12:09 -------- d-----w- C:\users\Gast\AppData\Locallow\AskToolbar

====== C:\Users\Anna‹ck ======

2013-01-20 00:42:05 -------- d-----w- C:\ProgramData\Mozilla

====== C: exe-files ==

2013-02-01 00:54:27 52F4DB8858B265619B3AB0E95E737CA9 135168 ----a-w- C:\Users\Annaïck\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8ET4WFTU\calc[1].exe

=== C: other files ==

2013-02-03 13:33:28 4335D8DA53A3717E1C400AE1835ADAC7 12459888 ----a-w- C:\Users\Annaïck\AppData\Local\Google\Chrome\User Data\PepperFlash\11.5.31.138\pepflashplayer.dll

2013-02-01 17:51:55 F253012A5F20FC6EB1923346D9E9EB98 4537856 ----a-w- C:\Users\Annaïck\AppData\Local\Google\Chrome\User Data\SwiftShader\1.0.3.0\libGLESv2.dll

2013-02-01 17:51:55 A532B0F927C7D00EAF26E9B53E15F6A2 100864 ----a-w- C:\Users\Annaïck\AppData\Local\Google\Chrome\User Data\SwiftShader\1.0.3.0\libEGL.dll

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]

"WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter"

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /detectMem"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]

"WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter"

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /detectMem"

[HKEY_USERS\S-1-5-21-4214379145-256237986-2173896754-1000\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun"

"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe /background"

"ares"="C:\Program Files\Ares\Ares.exe -h"

"Epson Stylus SX510W(Netwerk)"="C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIFIE.EXE /FU C:\Windows\TEMP\E_S1ED6.tmp /EF HKCU"

"ehTray.exe"="C:\Windows\ehome\ehTray.exe"

"Facebook Update"="C:\Users\Anna‹ck\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver"

"MyTomTomSA.exe"="C:\Program Files\MyTomTom 3\MyTomTomSA.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"

"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe"

"EEventManager"="C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe"

"IgfxTray"="C:\Windows\system32\igfxtray.exe"

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe"

"Persistence"="C:\Windows\system32\igfxpers.exe"

"DivXUpdate"="C:\Program Files\DivX\DivX Update\DivXUpdate.exe /CHECKNOW"

"avast"="C:\Program Files\AVAST Software\Avast\avastUI.exe /nogui"

"DATAMNGR"="C:\PROGRA~1\SEARCH~1\Datamngr\DATAMN~1.EXE"

"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe"

"ApnUpdater"="C:\Program Files\Ask.com\Updater\Updater.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun"

"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe /background"

"ares"="C:\Program Files\Ares\Ares.exe -h"

"Epson Stylus SX510W(Netwerk)"="C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIFIE.EXE /FU C:\Windows\TEMP\E_S1ED6.tmp /EF HKCU"

"ehTray.exe"="C:\Windows\ehome\ehTray.exe"

"Facebook Update"="C:\Users\Anna‹ck\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver"

"MyTomTomSA.exe"="C:\Program Files\MyTomTom 3\MyTomTomSA.exe"

==== Startup Registry Disabled ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher]