ComboFix 09-03-14.01 - baas 2001-01-01 0:16:39.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1043.18.3068.1866 [GMT 1:00] Gestart vanuit: c:\users\baas\Desktop\ComboFix.exe . (((((((((((((((((((( Bestanden Gemaakt van 2009-02-14 to 2009-03-14 )))))))))))))))))))))))))))))) . 2009-03-12 21:23 . 2009-03-12 21:23 d-------- c:\users\baas\AppData\Roaming\Malwarebytes 2009-03-12 21:22 . 2009-03-12 21:22 d-------- c:\users\All Users\Malwarebytes 2009-03-12 21:22 . 2009-03-12 21:22 d-------- c:\programdata\Malwarebytes 2009-03-12 21:22 . 2009-03-12 21:23 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-03-12 21:22 . 2009-02-11 10:19 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2009-03-12 21:22 . 2009-02-11 10:19 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2009-03-12 21:14 . 2009-03-12 21:07 15,688 --a------ c:\windows\System32\lsdelete.exe 2009-03-12 21:07 . 2009-03-12 21:07 64,160 --a------ c:\windows\System32\drivers\Lbd.sys 2009-03-12 21:05 . 2009-03-12 21:07 d-------- c:\users\All Users\Lavasoft 2009-03-12 21:05 . 2009-03-12 21:05 d--h-c--- c:\users\All Users\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-03-12 21:05 . 2009-03-12 21:07 d-------- c:\programdata\Lavasoft 2009-03-12 21:05 . 2009-03-12 21:05 d--h-c--- c:\programdata\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-03-12 21:05 . 2009-03-12 21:05 d-------- c:\program files\Lavasoft 2009-03-12 19:51 . 2009-03-12 19:51 d-------- c:\program files\Trend Micro 2009-03-12 19:01 . 2009-03-12 19:11 d-------- c:\users\All Users\Hitman Pro 2009-03-12 19:01 . 2009-03-12 19:11 d-------- c:\programdata\Hitman Pro 2009-03-12 18:23 . 2009-03-12 18:36 d-a------ c:\users\All Users\TEMP 2009-03-12 18:23 . 2009-03-12 18:36 d-a------ c:\programdata\TEMP 2009-03-11 23:26 . 2009-03-11 21:29 101,128 --a------ c:\windows\System32\drivers\pwipf6.sys 2009-03-11 21:35 . 2009-03-11 23:22 d-------- c:\users\baas\AppData\Roaming\Webroot 2009-03-11 21:35 . 2009-03-11 21:46 d-------- c:\users\All Users\Webroot 2009-03-11 21:35 . 2009-03-11 21:46 d-------- c:\programdata\Webroot 2009-03-11 21:35 . 2009-03-11 21:35 d-------- c:\program files\Webroot 2009-03-11 21:35 . 2009-03-11 21:35 d-------- c:\program files\MSSOAP 2009-03-11 21:35 . 2009-03-05 17:10 1,553,784 --a------ c:\windows\WRSetup.dll 2009-03-11 21:29 . 2009-03-11 21:29 164 --a------ c:\windows\install.dat 2009-03-11 16:52 . 2009-02-09 04:10 2,033,152 --a------ c:\windows\System32\win32k.sys 2009-03-11 16:52 . 2008-11-27 05:43 268,288 --a------ c:\windows\System32\schannel.dll 2009-03-09 20:23 . 2005-05-14 20:09 2,179,072 --a------ c:\windows\System32\mfc71d.dll 2009-03-09 20:23 . 2006-07-11 18:06 544,768 --a------ c:\windows\System32\msvcr71d.dll 2009-03-09 20:23 . 2006-05-12 08:37 490,496 --a------ c:\windows\System32\MP4Splitter.ax 2009-03-09 20:23 . 2004-01-10 17:02 258,048 --a------ c:\windows\System32\GplMpgDec.ax 2009-03-09 20:23 . 2005-09-28 01:31 24,576 --a------ c:\windows\System32\ControlSubX.ocx 2009-03-09 20:23 . 1998-07-13 00:00 20,992 --a------ c:\windows\System32\CMCT2FR.DLL 2009-03-09 18:54 . 2009-03-09 19:01 d-------- c:\users\baas\AppData\Roaming\GrabIt 2009-03-08 19:38 . 2009-03-08 19:38 d-------- c:\users\baas\AppData\Roaming\Ahead 2009-03-08 19:38 . 2009-03-08 19:38 d-------- c:\users\All Users\Ahead 2009-03-08 19:38 . 2009-03-08 19:38 d-------- c:\programdata\Ahead 2009-03-08 19:35 . 2009-03-08 19:35 d-------- c:\users\All Users\Nero 2009-03-08 19:35 . 2009-03-08 19:35 d-------- c:\programdata\Nero 2009-03-08 19:35 . 2009-03-08 19:35 d-------- c:\program files\Nero 2009-03-08 19:35 . 2009-03-08 19:37 d-------- c:\program files\Common Files\Ahead 2009-03-08 19:26 . 2009-03-08 19:26 d-------- c:\program files\MagicISO 2009-03-08 15:56 . 2009-03-08 15:56 d-------- c:\program files\Microsoft Silverlight 2009-03-08 15:54 . 2009-03-08 15:54 d-------- c:\program files\Microsoft 2009-03-08 15:52 . 2008-12-16 04:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL 2009-03-08 15:52 . 2008-12-16 06:31 7,680 --a------ c:\windows\System32\spwmp.dll 2009-03-08 15:52 . 2008-12-16 06:31 4,096 --a------ c:\windows\System32\msdxm.ocx 2009-03-08 15:52 . 2008-12-16 06:31 4,096 --a------ c:\windows\System32\dxmasf.dll 2009-03-06 12:45 . 2008-06-20 02:14 781,344 --a------ c:\windows\System32\PresentationNative_v0300.dll 2009-03-06 12:45 . 2008-06-20 02:14 622,080 --a------ c:\windows\System32\icardagt.exe 2009-03-06 12:45 . 2008-06-20 02:14 105,016 --a------ c:\windows\System32\PresentationCFFRasterizerNative_v0300.dll 2009-03-06 12:45 . 2008-06-20 02:14 97,800 --a------ c:\windows\System32\infocardapi.dll 2009-03-06 12:45 . 2008-06-20 02:14 43,544 --a------ c:\windows\System32\PresentationHostProxy.dll 2009-03-06 12:45 . 2008-06-20 02:14 37,384 --a------ c:\windows\System32\infocardcpl.cpl 2009-03-06 12:45 . 2008-06-20 02:14 11,264 --a------ c:\windows\System32\icardres.dll 2009-03-06 12:44 . 2008-06-20 02:14 326,160 --a------ c:\windows\System32\PresentationHost.exe 2009-03-06 12:39 . 2008-07-27 19:03 282,112 --a------ c:\windows\System32\mscoree.dll 2009-03-06 12:39 . 2008-07-27 19:03 158,720 --a------ c:\windows\System32\mscorier.dll 2009-03-06 12:39 . 2008-07-27 19:03 96,760 --a------ c:\windows\System32\dfshim.dll 2009-03-06 12:39 . 2008-07-27 19:03 41,984 --a------ c:\windows\System32\netfxperf.dll 2009-03-06 12:38 . 2008-07-27 19:03 83,968 --a------ c:\windows\System32\mscories.dll 2009-03-06 12:28 . 2009-03-06 12:28 d-------- c:\program files\Bonjour 2009-03-05 20:20 . 2009-03-05 20:20 d-------- c:\users\baas\AppData\Roaming\PeerNetworking 2009-02-28 11:44 . 2009-02-28 11:44 d-------- c:\program files\AviSynth 2.5 2009-02-28 02:21 . 2009-02-28 02:21 d-------- c:\users\baas\AppData\Roaming\Apple Computer 2009-02-28 02:20 . 2009-02-28 02:21 d-------- c:\program files\iTunes 2009-02-28 02:20 . 2009-02-28 02:20 d-------- c:\program files\iPod 2009-02-28 02:19 . 2009-02-28 02:20 d-------- c:\users\All Users\Apple Computer 2009-02-28 02:19 . 2009-02-28 02:20 d-------- c:\programdata\Apple Computer 2009-02-28 02:19 . 2009-02-28 02:20 d-------- c:\program files\QuickTime 2009-02-28 02:19 . 2009-02-28 02:19 d-------- c:\program files\Apple Software Update 2009-02-28 02:18 . 2009-02-28 02:18 d-------- c:\users\All Users\Apple 2009-02-28 02:18 . 2009-02-28 02:18 d-------- c:\programdata\Apple 2009-02-28 02:18 . 2009-02-28 02:20 d-------- c:\program files\Common Files\Apple 2009-02-25 15:24 . 2009-02-25 15:24 176,752 --a------ c:\windows\System32\drivers\ssidrv.sys 2009-02-25 15:24 . 2009-02-25 15:24 29,808 --a------ c:\windows\System32\drivers\ssfs0bbc.sys 2009-02-25 15:24 . 2009-02-25 15:24 23,152 --a------ c:\windows\System32\drivers\sshrmd.sys 2009-02-19 11:31 . 2009-02-19 11:31 184,496 --a------ c:\windows\System32\drivers\symtdi.sys 2009-02-19 11:31 . 2009-02-19 11:31 96,560 --a------ c:\windows\System32\drivers\symfw.sys 2009-02-19 11:31 . 2009-02-19 11:31 41,008 --a------ c:\windows\System32\drivers\symndisv.sys 2009-02-19 11:31 . 2009-02-19 11:31 38,576 --a------ c:\windows\System32\drivers\symids.sys 2009-02-19 11:31 . 2009-02-19 11:31 24,112 --a------ c:\windows\System32\drivers\SymIMV.sys 2009-02-19 11:31 . 2009-02-19 11:31 22,320 --a------ c:\windows\System32\drivers\symredrv.sys 2009-02-19 11:31 . 2009-02-19 11:31 13,616 --a------ c:\windows\System32\drivers\symdns.sys 2009-02-19 11:31 . 2009-02-19 11:31 9,844 --a------ c:\windows\System32\drivers\SymRedir.cat 2009-02-19 11:31 . 2009-02-19 11:31 1,611 --a------ c:\windows\System32\drivers\SymRedir.inf 2009-02-15 17:08 . 2008-12-05 05:32 428,544 --a------ c:\windows\System32\EncDec.dll 2009-02-15 17:08 . 2008-12-05 05:32 293,376 --a------ c:\windows\System32\psisdecd.dll 2009-02-15 17:08 . 2008-12-05 05:31 217,088 --a------ c:\windows\System32\psisrndr.ax 2009-02-15 17:08 . 2008-12-05 05:31 177,664 --a------ c:\windows\System32\mpg2splt.ax 2009-02-15 17:08 . 2008-12-05 05:31 80,896 --a------ c:\windows\System32\MSNP.ax . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-15 09:13 --------- d-----w c:\programdata\Google Updater 2009-03-14 19:12 --------- d-----w c:\program files\Google 2009-03-12 18:13 --------- d-----w c:\program files\AIM6 2009-03-12 17:08 --------- d-----w c:\users\baas\AppData\Roaming\uTorrent 2009-03-12 17:08 --------- d-----w c:\program files\Windows Mail 2009-03-10 18:31 --------- d-----w c:\programdata\Microsoft Help 2009-03-09 17:24 --------- d-----w c:\program files\EasyBits For Kids 2009-03-07 13:46 70,952 ----a-w c:\users\baas\AppData\Roaming\GDIPFONTCACHEV1.DAT 2009-02-28 22:42 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-01-15 06:11 827,392 ----a-w c:\windows\System32\wininet.dll 2009-01-14 16:39 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf 2009-01-08 12:29 410,984 ----a-w c:\windows\System32\deploytk.dll 2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini 2000-12-31 23:01 147,496 ----a-w c:\users\All Users\nvModes.dat 2000-12-31 23:01 147,496 ----a-w c:\programdata\nvModes.dat 2000-12-31 23:01 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat 2000-12-31 23:01 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 2289664] "DetectTray"="c:\program files\DVBT\DetectTray.exe" [2007-10-15 131072] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-14 39408] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-14 13535776] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-14 92704] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800] "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504] "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-04-23 468264] "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-14 202032] "OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-11-01 554288] "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-11-20 488752] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-08 136600] "KPN"="c:\program files\KPN\bin\sprtcmd.exe" [2008-06-06 198184] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-14 185872] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048] "osCheck"="c:\program files\Norton 360 Premier Edition\osCheck.exe" [2008-02-26 988512] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-02-06 177472] "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-06-27 442467] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-12 515416] "SpySweeper"="c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe" [2009-03-05 6308728] c:\users\baas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Schermopname en Snel starten.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-01-16 727592] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3codecp"= l3codecp.acm [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]bootdelete\[u]0[/u]lsdelete [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{6BD0B6C3-AD16-446F-BF9B-1903FD707E7A}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play "{538497D9-A9BF-4C41-9882-152939CF8D6E}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program "{AABAB0EC-A634-4A8F-A261-8E571FEC7BC8}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector "{7BB11FFB-8673-4324-A97C-5E42EC5A68FA}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{519EA552-E52D-4C19-837C-C1767FA66875}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{629ECD3D-7871-4961-96D5-2F1590D75124}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{70E18D32-24B7-47D9-8432-3D4B30A557C1}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{91FF247D-9AB9-410F-A441-FA4EBDEA4187}"= UDP:c:\program files\KPN\agent\bin\bcont.exe:bcont.exe "{6CD5A4A9-1608-4A4B-B7BC-E44D62F34096}"= TCP:c:\program files\KPN\agent\bin\bcont.exe:bcont.exe "{3764AE02-0361-42CC-9EAB-2635087E2E65}"= UDP:f:\\uTorrent.exe:µTorrent (TCP-In) "{543CB132-D98B-4515-BF30-35E7B7868012}"= TCP:f:\\uTorrent.exe:µTorrent (UDP-In) "{78ED7F0B-6C81-444F-A60B-D476FB42A04D}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{5039BAAC-DDAD-49B4-AA81-09C7D9ED7A8C}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{9FCE9515-424B-4721-9A8B-32CF36A56988}"= UDP:8081:f:\sabnzbd\SABnzbd.exe --server localhost:8081 "{12749DF7-BE41-47F9-B40F-37B3B22EFE4D}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{863854CF-CCFA-405C-B437-A6A5F493F26B}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [2009-03-12 64160] R0 ssfs0bbc;ssfs0bbc;c:\windows\System32\drivers\ssfs0bbc.sys [2009-02-25 29808] R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\ipsdefs\20090310.004\IDSvix86.sys [2009-03-11 270384] R1 pwipf6;Privacyware Filter Driver;c:\windows\System32\drivers\pwipf6.sys [2009-03-11 101128] R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_030ac640\AEstSrv.exe [2008-08-28 73728] R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [2008-01-21 21504] R2 hpsrv;HP Service;c:\windows\System32\hpservice.exe [2008-03-18 24880] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 951632] R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-02-18 149352] R2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [2008-06-21 341328] R2 sprtsvc_KPN;SupportSoft Sprocket Service (KPN);c:\program files\KPN\bin\sprtsvc.exe [2008-06-06 202016] R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [2009-03-11 1178728] R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-06-21 193840] R3 enecir;ENE CIR Receiver;c:\windows\System32\drivers\enecir.sys [2008-01-24 52736] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-02-28 101936] R3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [2008-04-11 84240] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [2008-05-14 43552] R3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [2009-02-19 41008] S3 COH_Mon;COH_Mon;c:\windows\System32\drivers\COH_Mon.sys [2008-01-12 23888] S3 EC168BDA;EC168BDA service;c:\windows\System32\drivers\EC168BDA.sys [2006-11-29 107904] S3 wrssweep;Webroots Volume Access Driver;c:\progra~1\Webroot\WEBROO~1\Cleanup\wrssweep.sys [2009-03-11 23168] --- Andere Services/Drivers In Geheugen --- *NewlyCreated* - COMHOST [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs ezSharedSvc [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Common Files\LightScribe\LSRunOnce.exe" . Inhoud van de 'Gedeelde Taken' map 2009-03-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-12 21:07] 2009-03-13 c:\windows\Tasks\User_Feed_Synchronization-{6BC7A9B3-1C93-4563-894B-1A0F3EBFC6B7}.job - c:\windows\system32\msfeedssync.exe [2008-01-21 03:24] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.jaah.nl/ mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_nl&c=83&bd=Pavilion&pf=cnnb uInternet Settings,ProxyOverride = *.local . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-14 00:32:54 Windows 6.0.6001 Service Pack 1 NTFS scannen van verborgen processen ... scannen van verborgen autostart items ... scannen van verborgen bestanden ... Scan succesvol afgerond verborgen bestanden: 0 ************************************************************************** . --------------------- DLLs Geladen Onder Lopende Processen --------------------- - - - - - - - > 'Explorer.exe'(5000) c:\windows\system32\btmmhook.dll c:\windows\System32\NLSLexicons0013.dll c:\program files\Microsoft Office\Office10\msohev.dll . Voltooingstijd: 2009-03-14 0:35:33 ComboFix-quarantined-files.txt 2009-03-13 23:35:27 Pre-Run: 87,395,827,712 bytes beschikbaar Post-Run: 87,405,862,912 bytes beschikbaar 266 --- E O F --- 2009-03-12 22:20:23