logje nakijken aub?

louka · 22 september 2013

Beste PC-specialisten,

Zouden jullie zo vriendelijk willen zijn dit logje eens na te kijken aub.

Na scanning met AVG-free krijg ik steeds de melding van bedreigingen. "IRP-koppelpunt....c\windows\system32\Drivers\spff.sys enz.."

Hoe kan ik die bedreigingen verwijderen?

Alvast hartelijk bedankt voor de moeite!

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 20:49:24, on 22-9-2013

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v9.00 (9.00.8112.16476)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\AVG\AVG2013\avgui.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\Macromed\Flash\FlashUtil32_11_8_800_175_ActiveX.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.nl

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Google

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer!

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [basicsmssmenu] "C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [sPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"Troubleshoot problems installing Service Pack 1 (SP1) for Windows 7 and Windows Server 2008 R2" /build:7601 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [sPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"Troubleshoot problems installing Service Pack 1 (SP1) for Windows 7 and Windows Server 2008 R2" /build:7601 (User 'Default user')

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} (20-20 3D Viewer for IKEA) - http://kitchenplanner.ikea.com/be/Core/Player/2020PlayerAX_IKEA_Win32.cab

O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect125.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgidsagent.exe

O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgwdsvc.exe

O23 - Service: Basics Service - Seagate Technology LLC - C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe

--

End of file - 6449 bytes

kape · 23 september 2013

Download ComboFix van één van de onderstaande locaties naar het bureaublad.

Bleeping Computer

Info Spyware

Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met ComboFix.exe

(hier of hier) kan je lezen hoe je de gebruikte beveiligingssoftware kunt uitschakelen.

Dubbelklik op "ComboFix" om de tool te starten, Windows Vista, 7 & 8 gebruikers zullen een melding krijgen van UAC (Gebruikersaccountbeheer), klik hier op Ja / yes.
Op een Windows XP computer zal ComboFix de "Recovery Console" installeren als deze nog niet aanwezig is. (Een actieve internet verbinding is dan een vereiste).
Klik in het venster bij het 'Installeren van de Recovery Console' op "Ok".
Klik in het info scherm op "Ja" als de Recovery Console met succes is geïnstalleerd.
Klik in het scherm van de disclaimer op "I Agree", de benodigde onderdelen worden nu uitgepakt en middels ERUNT wordt er een register back-up gemaakt.
Wanneer dit gereed is zal ComboFix vanzelf starten, in het blauwe scherm ziet u de voortgang van de systeemscan die wordt uitgevoerd.
Belangrijk! gebruik de computer tijdens de scan niet voor andere zaken.
Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden zoals bijvoorbeeld bij de aanwezigheid van een rootkit, dit is normaal.
Wanneer ComboFix gereed is, zal het een logbestand aanmaken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

* Noot !!! Indien u één van de onderstaande meldingen krijgt na het gebruik van ComboFix herstart dan de computer.

Er is geprobeerd een ongeldige bewerking uit te voeren op een registersleutel die is gemarkeerd voor verwijdering.
Illegal operation attempted on a registry key that has been marked for deletion.

louka · 23 september 2013

Beste Kape,

Hartelijk bedankt voor uw snelle reactie.

Zie hier het combifix logje.

Hopelijk geraakt dit vlug opgelost..

Alvast bedankt

ComboFix 13-09-23.02 - Gebruiker 23-09-2013 19:26:03.1.2 - x86

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.31.1043.18.3549.2448 [GMT 2:00]

Gestart vanuit: c:\users\Gebruiker\Downloads\ComboFix.exe

AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((( Bestanden Gemaakt van 2013-08-23 to 2013-09-23 ))))))))))))))))))))))))))))))

.

2013-09-23 17:31 . 2013-09-23 17:31 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-09-22 19:04 . 2013-09-22 19:04 -------- d-----w- c:\users\Gebruiker\AppData\Local\Secunia PSI

2013-09-22 19:04 . 2013-09-22 19:04 -------- d-----w- c:\program files\Secunia

2013-09-22 07:07 . 2013-09-22 07:07 -------- d-----w- c:\program files\ESET

2013-09-19 12:23 . 2013-09-19 12:23 -------- d-----w- c:\programdata\Oracle

2013-09-19 12:21 . 2013-09-19 12:21 -------- d-----w- c:\program files\Common Files\Java

2013-09-19 12:21 . 2013-09-19 12:21 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-09-19 12:21 . 2013-09-19 12:21 -------- d-----w- c:\program files\Java

2013-09-19 10:19 . 2013-09-19 10:19 -------- d-----w- c:\windows\system32\SPReview

2013-09-18 20:08 . 2013-09-18 20:08 -------- d-----w- c:\windows\CheckSur

2013-09-18 19:45 . 2013-09-18 19:45 -------- d-----w- c:\users\Gebruiker\AppData\Local\ElevatedDiagnostics

2013-09-18 13:11 . 2013-09-18 13:11 -------- d-----w- C:\AdwCleaner

2013-09-13 06:33 . 2013-09-13 06:33 -------- d-----w- c:\users\Default\AppData\Roaming\TuneUp Software

2013-09-09 23:34 . 2013-09-09 23:34 22328 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys

2013-09-04 23:43 . 2013-09-04 23:43 39224 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-09-21 14:58 . 2013-04-04 16:46 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-09-21 14:58 . 2013-04-04 16:46 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-09-19 12:21 . 2013-04-18 10:08 790440 ----a-w- c:\windows\system32\deployJava1.dll

2013-09-19 12:21 . 2013-04-18 10:08 868264 ----a-w- c:\windows\system32\npDeployJava1.dll

2013-07-19 23:51 . 2013-07-19 23:51 246072 ----a-w- c:\windows\system32\drivers\avglogx.sys

2013-07-19 23:50 . 2013-07-19 23:50 60216 ----a-w- c:\windows\system32\drivers\avgidshx.sys

2013-07-19 23:50 . 2013-07-19 23:50 208184 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys

2013-07-19 23:50 . 2013-07-19 23:50 171320 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2013-07-03 08:32 . 2013-07-03 08:32 16024 ----a-w- c:\windows\system32\drivers\psi_mf_x86.sys

2013-06-30 23:45 . 2013-06-30 23:45 96568 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-09-04 1173504]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-02 135168]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-02 167424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-02 144384]

"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2013-08-15 4411440]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"basicsmssmenu"="c:\program files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe" [2007-10-09 169328]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-09-19 280576]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]

Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE /tsr [2007-4-19 64864]

Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2013-7-3 563416]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]

2009-06-17 10:13 2363392 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent]

2010-02-22 14:17 1226024 ----a-w- c:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe

.

R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [2013-07-04 4939312]

R2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2013-07-03 660184]

R3 2310_00;2310_00;c:\windows\system32\DRIVERS\2310_00.sys [2009-06-12 135200]

R3 arcm_x86;arcm_x86;c:\windows\system32\DRIVERS\arcm_x86.sys [2009-11-09 43552]

R3 hcw99rc;Hauppauge Nova-DT IR Driver;c:\windows\System32\Drivers\hcw99rc.sys [2007-03-23 10368]

R3 hptiop;hptiop;c:\windows\system32\DRIVERS\hptiop.sys [2009-04-28 15008]

R3 hptmv;hptmv;c:\windows\system32\DRIVERS\hptmv.sys [2006-09-27 71968]

R3 hptmv6;hptmv6;c:\windows\system32\DRIVERS\hptmv6.sys [2007-11-01 120352]

R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 132480]

R3 ioatdma1;ioatdma1;c:\windows\System32\Drivers\qd16032.sys [2009-11-16 36552]

R3 ioatdma2;Intel® QuickData Technology device ver.2;c:\windows\System32\Drivers\qd26032.sys [2009-11-16 37576]

R3 iSSetup;iSSetup;c:\windows\system32\DRIVERS\iSSetup.sys [2007-06-19 75672]

R3 m5287;m5287;c:\windows\system32\DRIVERS\m5287.sys [2006-07-20 104320]

R3 m5288;m5288;c:\windows\system32\DRIVERS\m5288.sys [2006-07-19 211072]

R3 m5289;m5289;c:\windows\system32\DRIVERS\m5289.sys [2005-07-04 52480]

R3 MegaSR1;MegaSR1;c:\windows\system32\DRIVERS\MegaSR1.sys [2008-06-26 397632]

R3 MODRC;WinFast TV Dongle With Infrared Receiver;c:\windows\system32\DRIVERS\modrc.sys [2006-11-14 13056]

R3 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys [2007-05-25 137728]

R3 NBv834x;Killer Xeno Gaming Adapter Service;c:\windows\system32\DRIVERS\Xeno7x86.sys [2009-11-01 104992]

R3 nvamacpi;nvamacpi;c:\windows\system32\DRIVERS\NVAMACPI.sys [2009-07-17 24608]

R3 rr172x;rr172x;c:\windows\system32\DRIVERS\rr172x.sys [2007-11-01 101920]

R3 rr174x;rr174x;c:\windows\system32\DRIVERS\rr174x.sys [2007-11-01 126496]

R3 rr2210;rr2210;c:\windows\system32\DRIVERS\rr2210.sys [2007-11-01 122400]

R3 rr232x;rr232x;c:\windows\system32\DRIVERS\rr232x.sys [2008-05-05 120352]

R3 rr2340;rr2340;c:\windows\system32\DRIVERS\rr2340.sys [2009-12-31 128608]

R3 rr2522;rr2522;c:\windows\system32\DRIVERS\rr2522.sys [2009-12-31 132704]

R3 rr62x;rr62x;c:\windows\system32\DRIVERS\rr62x.sys [2009-12-21 122464]

R3 SI3112r;SI3112r;c:\windows\system32\DRIVERS\SI3112r.sys [2007-02-01 110128]

R3 SI3114;SI3114;c:\windows\system32\DRIVERS\SI3114.sys [2006-11-10 68912]

R3 SI3124;SI3124;c:\windows\system32\DRIVERS\SI3124.sys [2006-11-02 76208]

R3 Si3124r5;Si3124r5;c:\windows\system32\DRIVERS\Si3124r5.sys [2006-09-20 207152]

R3 TTP7;Flash Update for TerraTec PHASE 26 USB;c:\windows\system32\DRIVERS\ttp7up.sys [2005-11-09 12928]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [2013-04-06 1343400]

R3 WinTVCIUSB;WinTVCIUSB;c:\windows\system32\DRIVERS\hcw11.sys [2008-02-28 91136]

S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [2013-07-19 60216]

S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [2013-07-19 246072]

S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2013-09-04 39224]

S0 ioatdma;Intel® QuickData Technology Device;c:\windows\System32\Drivers\ioatdma.sys [2009-11-16 36552]

S0 johci;JMicron 1394 Filter Driver;c:\windows\system32\DRIVERS\johci.sys [2008-10-09 15200]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2013-04-03 691696]

S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [2013-07-19 208184]

S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [2013-09-09 22328]

S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2013-07-19 171320]

S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2013-03-21 182072]

S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [2013-07-23 283136]

S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2010-02-18 462632]

S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2013-07-03 1228504]

S3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y6232.sys [2009-10-20 223960]

S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf_x86.sys [2013-07-03 16024]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2009-06-17 10:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Inhoud van de 'Gedeelde Taken' map

.

2013-09-22 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-04 14:58]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

TCP: DhcpNameServer = 195.130.130.130 195.130.131.130

.

- - - - ORPHANS VERWIJDERD - - - -

.

Toolbar-Locked - (no file)

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Voltooingstijd: 2013-09-23 19:32:06

ComboFix-quarantined-files.txt 2013-09-23 17:32

ComboFix2.txt 2011-11-11 09:09

.

Pre-Run: 159.843.962.880 bytes beschikbaar

Post-Run: 159.747.805.184 bytes beschikbaar

.

- - End Of File - - AF4569361FD798565DB05A830C46274A

A36C5E4F47E84449FF07ED3517B43A31

kape · 23 september 2013

Ga naar de site van ESET Online Scanner.

Klik op de knop “Run ESET Online Scanner”

In een apart scherm krijg je de vraag om EsetSmartInstaller te downloaden

Klik op de link van esetsmartinstaller_enu.exe en dan start de download automatisch op.

Kies voor “Download” van dit bestand.

Klik op “uitvoeren” van dit bestand esetsmartinstaller_enu.exe

Zet een vinkje bij “YES, I accept the Terms of Use”

Klik op “Start”

Klik op "Advanced settings"

Zet een vinkje bij de volgende opties:

Remove found threats
Scan archives
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth technology

Klik op “Start”

De computer wordt nu gescand. Dit kan best lang duren, heb dus geduld.

Je mag het venster sluiten wanneer de scan klaar is.

Gebruik Kladblok om het logje te openen. Dit logje vind je op de locatie C:\\Program Files\\Eset\\EsetOnlineScanner\\log.txt

Kopieer en plak de inhoud van dit logje in je volgende bericht.

louka · 24 september 2013

Beste Kape,

Na een scan van bijna 2 u heeft eset 12 bedreigingen gevonden, en ze in quarantine gezet.

Als log kreeg ik enkel dit..

ESETSmartInstaller@High as downloader log:

all ok

Het onderstaande is een copy van het eindscherm na scanning maar ik denk niet dat je er iets mee bent?

C:\output\Documents\loaris1245-setup.exe a variant of Win32/1AntiVirus application cleaned by deleting - quarantined

C:\output\Documents\Trojan Remover 1.2\iexplore.exe.exe a variant of Win32/1AntiVirus application cleaned by deleting - quarantined

C:\System Volume Information\SystemRestore\FRStaging\Users\Gebruiker\Documents\loaris1245-setup.exe a variant of Win32/1AntiVirus application cleaned by deleting - quarantined

C:\System Volume Information\SystemRestore\FRStaging\Users\Gebruiker\Documents\Trojan Remover 1.2\iexplore.exe.exe a variant of Win32/1AntiVirus application cleaned by deleting - quarantined

C:\Users\Gebruiker\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\13d80325-6ccf0bc0 a variant of Java/Exploit.Agent.OBF trojan cleaned by deleting - quarantined

C:\Windows\Setup\SCRIPTS\Windows7Loader.exe Win32/HackTool.WinActivator.I application cleaned by deleting - quarantined

C:\Windows.old\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\jtsv1642.default\extensions\bbrs_002@blabbers.com\chrome\content\witmain.js Win32/BrowserCompanion.G application cleaned by deleting - quarantined

C:\Windows.old\Documents and Settings\Administrator\Local Settings\Application Data\Babylon\Setup\BExternal.dll a variant of Win32/Toolbar.Babylon.F application cleaned by deleting - quarantined

C:\Windows.old\Documents and Settings\Administrator\Local Settings\Application Data\Babylon\Setup\IECookieLow.dll a variant of Win32/Toolbar.Babylon.E application cleaned by deleting - quarantined

C:\Windows.old\Documents and Settings\Administrator\Local Settings\Application Data\Babylon\Setup\Setup.exe a variant of Win32/Toolbar.Babylon.H application cleaned by deleting - quarantined

C:\Windows.old\Documents and Settings\Administrator\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\63\15a15ebf-34a18bc4 multiple threats cleaned by deleting - quarantined

C:\Windows.old\Program Files\PDFCreator\message.exe a variant of Win32/InstallCore.A application cleaned by deleting - quarantined

louka · 24 september 2013

Kape,

Ik heb die eset scanner nog eens laten lopen.

Niets meer gevonden en nu was er wel een logje.. raar..

ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=c02cd36e75e26547865527f388e1adc1

# engine=15237

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2013-09-24 01:23:30

# local_time=2013-09-24 03:23:30 (+0100, West-Europa (zomertijd))

# country="Netherlands"

# lang=1033

# osver=6.1.7600 NT

# compatibility_mode=1039 16777213 100 92 22213 67166594 0 0

# compatibility_mode=5893 16776574 100 94 14854372 132468975 0 0

# scanned=298621

# found=0

# cleaned=0

# scan_time=6949

Als ik avg laat scannen detecteert hij nog steeds bedreigingen..

kape · 25 september 2013

Als ik avg laat scannen detecteert hij nog steeds bedreigingen..

Kan je die bedreigingen van AVG hier eens in een berichtje zetten. Graag de volledige locatie die AVG aangeeft.

louka · 25 september 2013

Kape,ik hoop dat je hier iets mee kan aanvangen..

Nogmaals hartelijk bedankt voor alle moeite.

pci.sys,koppelpunt import ntoskrnl.exe loDetachDevice=>spvg.sys +0x2CDDC