nancyvang

Ik heb mijn emails terug. Gelukkig xD

Ik heb mijn emailaccount per ongeluk verwijderd kan ik mijn emails nog terug krijgen. Zo ja kan iemand mij daar bij helpen. Bedankt alvast.

windows vista restore staat nog als snelkoppeling op mijn bureaublad dit kwam steeds voor toen het virus er nog op zat. Als ik op start druk blijft het linkervenster leeg rechts staan mijn programma's zoals documenten afbeeldingen enz. En ik heb nog geen internet teken. Ik maak steeds verbinding via netwerkcentrum. Dit zijn de dingen die mij opvallen. ---------- Post toegevoegd om 11:37 ---------- Vorige post was om 11:35 ---------- Ik heb inmiddels internetteken gevonden. ---------- Post toegevoegd om 11:42 ---------- Vorige post was om 11:37 ---------- En hij geeft nog aan dat sommige opstart programma's zijn geblokkeerd

hier een nieuwe log ik hoop dat deze wel goed is. ComboFix 11-06-19.0r1 - Nancy 20-06-2011 22:40:49.3.1 - x86 Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.31.1043.18.2037.1010 [GMT 2:00] Gestart vanuit: c:\users\Nancy\Desktop\ComboFix.exe gebruikte Opdracht switches :: c:\users\Nancy\Desktop\CFScript.txt..txt AV: Norton AntiVirus *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\windows\system32\ConduitEngine.tmp" . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\Conduit c:\program files\Conduit\Community Alerts\Alert.dll c:\program files\InnoGames_International c:\program files\InnoGames_International\GottenAppsContextMenu.xml c:\program files\InnoGames_International\InnoGames_InternationalToolbarHelper.exe c:\program files\InnoGames_International\ldrtbInno.dll c:\program files\InnoGames_International\OtherAppsContextMenu.xml c:\program files\InnoGames_International\prxtbInno.dll c:\program files\InnoGames_International\SharedAppsContextMenu.xml c:\program files\InnoGames_International\tbInno.dll c:\program files\InnoGames_International\toolbar.cfg c:\program files\InnoGames_International\ToolbarContextMenu.xml c:\program files\InnoGames_International\uninstall.exe c:\users\Nancy\AppData\Local\{0B37F928-84AD-4098-9C93-ABB7779AA081} c:\users\Nancy\AppData\Local\{0F03B390-2011-47B2-9336-2FDA2B4A4360} c:\users\Nancy\AppData\Local\{0F752173-ED2D-4B7F-A37B-B8AEC2DCBCCD} c:\users\Nancy\AppData\Local\{10321860-2BDF-4E78-BDB3-5BCD07AD629D} c:\users\Nancy\AppData\Local\{11D7D134-D62D-4565-86C5-3C3FA205F9B7} c:\users\Nancy\AppData\Local\{2366CA52-A42F-4C02-8B66-6E7413266579} c:\users\Nancy\AppData\Local\{24AA0B77-3005-4350-A855-BFEAFEF6F74A} c:\users\Nancy\AppData\Local\{2BBF3D80-17C0-4CA6-ADB0-D974AE317FDB} c:\users\Nancy\AppData\Local\{2BF7FE24-A06A-420B-9649-EB418974AAD0} c:\users\Nancy\AppData\Local\{2E311ACA-3649-450A-92AC-8D0D230D7F51} c:\users\Nancy\AppData\Local\{2E3D7290-AD94-4171-A7A8-D2BCEC78021A} c:\users\Nancy\AppData\Local\{2F8574D1-E0CA-4E9E-A57E-3736C21462EB} c:\users\Nancy\AppData\Local\{45692F7C-B55D-4749-B797-45233B117F34} c:\users\Nancy\AppData\Local\{4BABDD26-206E-4298-998C-F077AAE04A58} c:\users\Nancy\AppData\Local\{4D6A9A06-0957-4D52-92CB-8E69DDBD4CB4} c:\users\Nancy\AppData\Local\{4DE5EE15-2C05-4B22-9628-8C99B70B4C0C} c:\users\Nancy\AppData\Local\{4E0A34E5-C147-4B9F-ACF5-4C604628D904} c:\users\Nancy\AppData\Local\{527569DB-3B2F-4FE7-8EE5-9CA8502B136B} c:\users\Nancy\AppData\Local\{585AAEA6-CDA6-48D1-AA7A-939BFE92542B} c:\users\Nancy\AppData\Local\{66E4BAF8-6C76-442C-90D8-7248F48B4CDD} c:\users\Nancy\AppData\Local\{69CFC663-C1D2-4177-8AEF-03E14B316570} c:\users\Nancy\AppData\Local\{6A60A271-6D8E-4C47-B521-712850B3EA75} c:\users\Nancy\AppData\Local\{746AFE7F-06CA-4AAE-8892-3E630E900FD0} c:\users\Nancy\AppData\Local\{75BA0DB9-3BB4-4655-9649-A659B8E1EC96} c:\users\Nancy\AppData\Local\{7BCB44D8-D4FB-402A-A6BA-9774902EAAB3} c:\users\Nancy\AppData\Local\{89040DCA-974D-4F14-A85D-3C90DC375D20} c:\users\Nancy\AppData\Local\{89AD610B-15F9-4286-8484-F9A94803146D} c:\users\Nancy\AppData\Local\{8AF9163F-B6CC-4B75-8002-65E658370B13} c:\users\Nancy\AppData\Local\{92572B97-72EF-4417-A512-13BB18D53462} c:\users\Nancy\AppData\Local\{95E50AE5-193D-45AB-882C-EF03D6472765} c:\users\Nancy\AppData\Local\{96F2A133-5B19-4979-AF8B-DFABCE0B7F78} c:\users\Nancy\AppData\Local\{97D375D6-35F7-4EE0-B6D2-3359F15F30CB} c:\users\Nancy\AppData\Local\{992D8976-D0B3-41A2-AC72-94C5005089C0} c:\users\Nancy\AppData\Local\{A332EBF1-FFFE-4E33-B5FF-615DAF4C4F6C} c:\users\Nancy\AppData\Local\{ABE64375-0416-45A0-B69F-7938DB5B6D16} c:\users\Nancy\AppData\Local\{AED600EE-A22F-4B20-B275-15BDAB4F6C8E} c:\users\Nancy\AppData\Local\{AF964F8F-2B7C-4A25-BB67-DAF3C9F62AF5} c:\users\Nancy\AppData\Local\{B491E160-7296-45AD-BF4E-B52BEE091015} c:\users\Nancy\AppData\Local\{B8993139-1FF1-4AD2-A902-35D445465D45} c:\users\Nancy\AppData\Local\{C8A7EC52-DF0E-44E7-8DFE-8AF70F70C21D} c:\users\Nancy\AppData\Local\{C99141CF-1998-4D5D-98EE-3D321D8FBFAB} c:\users\Nancy\AppData\Local\{CE243EB9-B936-4FA7-8E4A-BC5EE678CBF3} c:\users\Nancy\AppData\Local\{D52379C4-6D54-49C3-99DD-BB01A472835C} c:\users\Nancy\AppData\Local\{D95AA3A4-F1D5-4578-8A9F-23CAEAA3B0D4} c:\users\Nancy\AppData\Local\{E561CC4B-00EE-475A-A7F6-8374E7288BBD} c:\users\Nancy\AppData\Local\{E610BA14-1123-47F0-9D9B-DE5D315792B6} c:\users\Nancy\AppData\Local\{EBA9D5F0-FE17-4B12-86AE-1939BED5812A} c:\users\Nancy\AppData\Local\{F101C60C-0A91-4FDE-9771-38838673E9BA} c:\users\Nancy\AppData\Local\{F15279E2-7B52-4839-869A-68902F5918B9} c:\users\Nancy\AppData\Local\{FA9AA1D7-87BB-4A81-B016-80FE0CDCC336} c:\users\Nancy\AppData\Local\{FC8F4A5A-3751-494D-8C04-66A3EAFFEB36} c:\users\Nancy\AppData\Local\Conduit c:\users\Nancy\AppData\Local\Conduit\CT2832595\InnoGames_InternationalAutoUpdateHelper.exe c:\windows\system32\ConduitEngine.tmp . . (((((((((((((((((((( Bestanden Gemaakt van 2011-05-20 to 2011-06-20 )))))))))))))))))))))))))))))) . . 2011-06-20 21:00 . 2011-06-20 21:01 -------- d-----w- c:\users\Nancy\AppData\Local\temp 2011-06-20 21:00 . 2011-06-20 21:00 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-06-18 18:06 . 2011-06-18 18:06 -------- d-----w- c:\users\Nancy\AppData\Roaming\Malwarebytes 2011-06-18 18:05 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\programdata\Malwarebytes 2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-06-18 18:05 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-06-18 16:48 . 2011-06-18 16:48 -------- d-----w- c:\users\Nancy\AppData\Roaming\Reviversoft 2011-06-18 16:29 . 2011-05-17 12:51 16704 ----a-w- c:\windows\system32\roboot.exe 2011-06-18 16:02 . 2011-06-18 16:02 388096 ----a-r- c:\users\Nancy\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2011-06-18 16:02 . 2011-06-18 16:02 -------- d-----w- c:\program files\Trend Micro 2011-06-18 15:06 . 2011-05-09 20:46 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83DCB7F6-5579-4AE1-A3E3-C30D5DBE326C}\mpengine.dll 2011-06-18 14:54 . 2011-06-19 09:20 126584 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2011-06-18 14:47 . 2011-06-19 13:28 -------- d-----w- c:\windows\system32\drivers\NAV 2011-06-18 14:46 . 2011-06-18 14:47 -------- d-----w- c:\program files\Norton AntiVirus 2011-06-18 14:44 . 2011-06-18 14:44 -------- d-----w- c:\program files\NortonInstaller 2011-06-18 14:20 . 2011-06-18 14:20 -------- d-----w- c:\program files\AVG 2011-06-16 07:59 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2011-06-16 07:59 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll 2011-06-16 07:59 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll 2011-06-15 21:34 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys 2011-06-15 21:33 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys 2011-06-15 21:33 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys 2011-06-15 21:33 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys 2011-06-15 21:33 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll 2011-06-15 21:32 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll 2011-06-15 21:32 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys 2011-06-15 21:32 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys 2011-06-15 21:32 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2011-06-15 21:32 . 2011-05-02 12:02 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat 2011-06-07 19:35 . 2011-06-07 19:35 -------- d-----w- c:\program files\ConduitEngine 2011-06-02 21:38 . 2011-06-02 21:38 -------- d-----w- c:\program files\Navigram 2011-05-26 20:57 . 2011-05-26 21:01 -------- d-----w- c:\users\Nancy\AppData\Roaming\TeamViewer 2011-05-26 20:56 . 2011-05-26 20:56 -------- d-----w- c:\program files\TeamViewer 2011-05-24 12:57 . 2011-06-15 20:19 -------- d-----w- c:\programdata\Skype Extras 2011-05-24 12:56 . 2011-05-24 12:56 -------- d-----w- c:\program files\Common Files\Skype . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2011-03-09 247728] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-28 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-28 154136] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-28 137752] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-06-30 159744] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712] "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-09-30 181544] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-27 202032] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552] "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656] . c:\users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Schermopname en Snel starten.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate1ca05a05a2d3ab0;Google Updateservice (gupdate1ca05a05a2d3ab0);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104] R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560] R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x] R3 DCamUSBNW800;CIF USB Camera (2110);c:\windows\system32\DRIVERS\pcam800.sys [2002-07-27 210792] R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104] R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1206000.01D\SYMDS.SYS [2011-01-27 340088] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1206000.01D\SYMEFA.SYS [2011-03-15 744568] S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20110616.003\BHDrvx86.sys [2011-06-15 810616] S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20110615.001\IDSvix86.sys [2011-06-10 367736] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1206000.01D\Ironx86.SYS [2011-01-27 136312] S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NAV\1206000.01D\SYMTDIV.SYS [2011-03-22 331384] S2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\18.6.0.29\ccSvcHst.exe [2011-04-17 130008] S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-04-15 2280312] S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-03-09 92592] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-06-18 105592] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr . Inhoud van de 'Gedeelde Taken' map . 2011-06-20 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-15 23:01] . 2011-06-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02] . 2011-06-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.nl/ IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 Trusted Zone: navigram.com\www TCP: DhcpNameServer = 194.134.5.5 194.134.0.97 . - - - - ORPHANS VERWIJDERD - - - - . AddRemove-InnoGames_International Toolbar - c:\program files\InnoGames_International\uninstall.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2011-06-20 23:01 Windows 6.0.6002 Service Pack 2 NTFS . scannen van verborgen processen ... . scannen van verborgen autostart items ... . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NAV] "ImagePath"="\"c:\program files\Norton AntiVirus\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\18.6.0.29\diMaster.dll\" /prefetch:1" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\S-1-5-21-1799926568-97698467-2023138869-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2594D239-90E4-6F0A-46B8-4DB5907FD91E}*] "oaigdonmkdndpahonfnedjgjaabbbm"=hex:6a,61,64,68,62,69,66,61,63,63,68,6f,69,66, 6a,66,6b,6e,65,6b,00,f7 "pacifjomjapaepmhaimimddiahmfacmn"=hex:6a,61,67,66,68,68,62,70,67,63,66,70,6c, 61,64,6a,6a,6f,68,6c,00,f7 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Voltooingstijd: 2011-06-20 23:11:59 ComboFix-quarantined-files.txt 2011-06-20 21:11 ComboFix2.txt 2011-06-19 13:21 ComboFix3.txt 2011-06-18 20:38 . Pre-Run: 20.479.864.832 bytes beschikbaar Post-Run: 20.164.423.680 bytes beschikbaar . - - End Of File - - DAAD397C662A81D78BDA91562A3ABF47

nee ik heb echt het bestandje in de rode cobofix snelkoppeling gesleept Maar ik zal het nog eens proberen.

hier een nieuwe log ComboFix 11-06-17.04 - Nancy 19-06-2011 14:57:04.2.1 - x86 Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.31.1043.18.2037.961 [GMT 2:00] Gestart vanuit: c:\users\Nancy\Desktop\ComboFix.exe gebruikte Opdracht switches :: c:\users\Nancy\Desktop\CFScript.txt. - Snelkoppeling.lnk AV: Norton AntiVirus *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855} SP: Norton AntiVirus *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((( Bestanden Gemaakt van 2011-05-19 to 2011-06-19 )))))))))))))))))))))))))))))) . . 2011-06-19 13:14 . 2011-06-19 13:15 -------- d-----w- c:\users\Nancy\AppData\Local\temp 2011-06-19 13:14 . 2011-06-19 13:14 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-06-19 12:50 . 2011-06-19 12:52 -------- d-----w- C:\32788R22FWJFW 2011-06-18 18:06 . 2011-06-18 18:06 -------- d-----w- c:\users\Nancy\AppData\Roaming\Malwarebytes 2011-06-18 18:05 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\programdata\Malwarebytes 2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-06-18 18:05 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-06-18 16:48 . 2011-06-18 16:48 -------- d-----w- c:\users\Nancy\AppData\Roaming\Reviversoft 2011-06-18 16:29 . 2011-05-17 12:51 16704 ----a-w- c:\windows\system32\roboot.exe 2011-06-18 16:02 . 2011-06-18 16:02 388096 ----a-r- c:\users\Nancy\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2011-06-18 16:02 . 2011-06-18 16:02 -------- d-----w- c:\program files\Trend Micro 2011-06-18 15:06 . 2011-05-09 20:46 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83DCB7F6-5579-4AE1-A3E3-C30D5DBE326C}\mpengine.dll 2011-06-18 14:54 . 2011-06-19 09:20 126584 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2011-06-18 14:47 . 2011-06-18 20:22 -------- d-----w- c:\windows\system32\drivers\NAV 2011-06-18 14:46 . 2011-06-18 14:47 -------- d-----w- c:\program files\Norton AntiVirus 2011-06-18 14:44 . 2011-06-18 14:44 -------- d-----w- c:\program files\NortonInstaller 2011-06-18 14:20 . 2011-06-18 14:20 -------- d-----w- c:\program files\AVG 2011-06-18 13:51 . 2011-06-18 13:51 -------- d-----w- c:\users\Nancy\AppData\Local\{E561CC4B-00EE-475A-A7F6-8374E7288BBD} 2011-06-18 11:26 . 2011-06-18 11:26 -------- d-----w- c:\users\Nancy\AppData\Local\{585AAEA6-CDA6-48D1-AA7A-939BFE92542B} 2011-06-18 11:01 . 2011-06-18 11:01 -------- d-----w- c:\users\Nancy\AppData\Local\{4BABDD26-206E-4298-998C-F077AAE04A58} 2011-06-17 07:32 . 2011-06-17 07:32 -------- d-----w- c:\users\Nancy\AppData\Local\{2BF7FE24-A06A-420B-9649-EB418974AAD0} 2011-06-16 19:19 . 2011-06-16 19:19 -------- d-----w- c:\users\Nancy\AppData\Local\{F15279E2-7B52-4839-869A-68902F5918B9} 2011-06-16 07:59 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2011-06-16 07:59 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll 2011-06-16 07:59 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll 2011-06-16 07:18 . 2011-06-16 07:19 -------- d-----w- c:\users\Nancy\AppData\Local\{4DE5EE15-2C05-4B22-9628-8C99B70B4C0C} 2011-06-15 21:34 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys 2011-06-15 21:33 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys 2011-06-15 21:33 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys 2011-06-15 21:33 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys 2011-06-15 21:33 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll 2011-06-15 21:32 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll 2011-06-15 21:32 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys 2011-06-15 21:32 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys 2011-06-15 21:32 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2011-06-15 21:32 . 2011-05-02 12:02 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat 2011-06-15 15:27 . 2011-06-15 15:27 -------- d-----w- c:\users\Nancy\AppData\Local\{2F8574D1-E0CA-4E9E-A57E-3736C21462EB} 2011-06-14 22:15 . 2011-06-14 22:15 -------- d-----w- c:\users\Nancy\AppData\Local\{2E3D7290-AD94-4171-A7A8-D2BCEC78021A} 2011-06-14 10:15 . 2011-06-14 10:15 -------- d-----w- c:\users\Nancy\AppData\Local\{95E50AE5-193D-45AB-882C-EF03D6472765} 2011-06-13 22:14 . 2011-06-13 22:14 -------- d-----w- c:\users\Nancy\AppData\Local\{AED600EE-A22F-4B20-B275-15BDAB4F6C8E} 2011-06-13 10:13 . 2011-06-13 10:14 -------- d-----w- c:\users\Nancy\AppData\Local\{10321860-2BDF-4E78-BDB3-5BCD07AD629D} 2011-06-12 22:13 . 2011-06-12 22:13 -------- d-----w- c:\users\Nancy\AppData\Local\{96F2A133-5B19-4979-AF8B-DFABCE0B7F78} 2011-06-12 09:17 . 2011-06-12 09:17 -------- d-----w- c:\users\Nancy\AppData\Local\{0B37F928-84AD-4098-9C93-ABB7779AA081} 2011-06-11 11:44 . 2011-06-11 11:45 -------- d-----w- c:\users\Nancy\AppData\Local\{75BA0DB9-3BB4-4655-9649-A659B8E1EC96} 2011-06-10 23:44 . 2011-06-10 23:44 -------- d-----w- c:\users\Nancy\AppData\Local\{D95AA3A4-F1D5-4578-8A9F-23CAEAA3B0D4} 2011-06-10 07:03 . 2011-06-10 07:03 -------- d-----w- c:\users\Nancy\AppData\Local\{746AFE7F-06CA-4AAE-8892-3E630E900FD0} 2011-06-09 18:39 . 2011-06-09 18:39 -------- d-----w- c:\users\Nancy\AppData\Local\{92572B97-72EF-4417-A512-13BB18D53462} 2011-06-09 06:38 . 2011-06-09 06:38 -------- d-----w- c:\users\Nancy\AppData\Local\{CE243EB9-B936-4FA7-8E4A-BC5EE678CBF3} 2011-06-08 18:37 . 2011-06-08 18:38 -------- d-----w- c:\users\Nancy\AppData\Local\{FA9AA1D7-87BB-4A81-B016-80FE0CDCC336} 2011-06-08 06:37 . 2011-06-08 06:37 -------- d-----w- c:\users\Nancy\AppData\Local\{4E0A34E5-C147-4B9F-ACF5-4C604628D904} 2011-06-07 19:36 . 2011-06-07 19:36 -------- d-----w- c:\program files\Conduit 2011-06-07 19:35 . 2011-06-07 19:35 0 ----a-w- c:\windows\system32\ConduitEngine.tmp 2011-06-07 19:35 . 2011-06-07 19:35 -------- d-----w- c:\users\Nancy\AppData\Local\Conduit 2011-06-07 19:35 . 2011-06-07 19:35 -------- d-----w- c:\program files\InnoGames_International 2011-06-07 10:52 . 2011-06-07 10:53 -------- d-----w- c:\users\Nancy\AppData\Local\{C8A7EC52-DF0E-44E7-8DFE-8AF70F70C21D} 2011-06-06 18:29 . 2011-06-06 18:29 -------- d-----w- c:\users\Nancy\AppData\Local\{2BBF3D80-17C0-4CA6-ADB0-D974AE317FDB} 2011-06-06 06:28 . 2011-06-06 06:28 -------- d-----w- c:\users\Nancy\AppData\Local\{7BCB44D8-D4FB-402A-A6BA-9774902EAAB3} 2011-06-05 11:26 . 2011-06-05 11:26 -------- d-----w- c:\users\Nancy\AppData\Local\{992D8976-D0B3-41A2-AC72-94C5005089C0} 2011-06-04 23:25 . 2011-06-04 23:25 -------- d-----w- c:\users\Nancy\AppData\Local\{89040DCA-974D-4F14-A85D-3C90DC375D20} 2011-06-04 10:56 . 2011-06-04 10:56 -------- d-----w- c:\users\Nancy\AppData\Local\{89AD610B-15F9-4286-8484-F9A94803146D} 2011-06-03 22:55 . 2011-06-03 22:55 -------- d-----w- c:\users\Nancy\AppData\Local\{2E311ACA-3649-450A-92AC-8D0D230D7F51} 2011-06-03 10:11 . 2011-06-03 10:12 -------- d-----w- c:\users\Nancy\AppData\Local\{6A60A271-6D8E-4C47-B521-712850B3EA75} 2011-06-02 21:38 . 2011-06-02 21:38 -------- d-----w- c:\program files\Navigram 2011-06-02 21:01 . 2011-06-02 21:02 -------- d-----w- c:\users\Nancy\AppData\Local\{2366CA52-A42F-4C02-8B66-6E7413266579} 2011-06-02 09:01 . 2011-06-02 09:01 -------- d-----w- c:\users\Nancy\AppData\Local\{11D7D134-D62D-4565-86C5-3C3FA205F9B7} 2011-06-01 21:00 . 2011-06-01 21:00 -------- d-----w- c:\users\Nancy\AppData\Local\{C99141CF-1998-4D5D-98EE-3D321D8FBFAB} 2011-06-01 15:51 . 2011-06-01 15:52 -------- d-----w- c:\users\Nancy\AppData\Local\{A332EBF1-FFFE-4E33-B5FF-615DAF4C4F6C} 2011-05-31 22:03 . 2011-05-31 22:03 -------- d-----w- c:\users\Nancy\AppData\Local\{FC8F4A5A-3751-494D-8C04-66A3EAFFEB36} 2011-05-31 06:17 . 2011-05-31 06:17 -------- d-----w- c:\users\Nancy\AppData\Local\{ABE64375-0416-45A0-B69F-7938DB5B6D16} 2011-05-30 16:48 . 2011-05-30 16:48 -------- d-----w- c:\users\Nancy\AppData\Local\{24AA0B77-3005-4350-A855-BFEAFEF6F74A} 2011-05-29 21:54 . 2011-05-29 21:54 -------- d-----w- c:\users\Nancy\AppData\Local\{97D375D6-35F7-4EE0-B6D2-3359F15F30CB} 2011-05-29 09:53 . 2011-05-29 09:53 -------- d-----w- c:\users\Nancy\AppData\Local\{69CFC663-C1D2-4177-8AEF-03E14B316570} 2011-05-28 11:26 . 2011-05-28 11:27 -------- d-----w- c:\users\Nancy\AppData\Local\{E610BA14-1123-47F0-9D9B-DE5D315792B6} 2011-05-27 23:26 . 2011-05-27 23:26 -------- d-----w- c:\users\Nancy\AppData\Local\{D52379C4-6D54-49C3-99DD-BB01A472835C} 2011-05-27 06:53 . 2011-05-27 06:53 -------- d-----w- c:\users\Nancy\AppData\Local\{0F752173-ED2D-4B7F-A37B-B8AEC2DCBCCD} 2011-05-26 20:57 . 2011-05-26 21:01 -------- d-----w- c:\users\Nancy\AppData\Roaming\TeamViewer 2011-05-26 20:56 . 2011-05-26 20:56 -------- d-----w- c:\program files\TeamViewer 2011-05-26 18:52 . 2011-05-26 18:52 -------- d-----w- c:\users\Nancy\AppData\Local\{B491E160-7296-45AD-BF4E-B52BEE091015} 2011-05-26 06:52 . 2011-05-26 06:52 -------- d-----w- c:\users\Nancy\AppData\Local\{4D6A9A06-0957-4D52-92CB-8E69DDBD4CB4} 2011-05-25 15:13 . 2011-05-25 15:13 -------- d-----w- c:\users\Nancy\AppData\Local\{66E4BAF8-6C76-442C-90D8-7248F48B4CDD} 2011-05-24 18:26 . 2011-05-24 18:26 -------- d-----w- c:\users\Nancy\AppData\Local\{EBA9D5F0-FE17-4B12-86AE-1939BED5812A} 2011-05-24 12:57 . 2011-06-15 20:19 -------- d-----w- c:\programdata\Skype Extras 2011-05-24 12:56 . 2011-05-24 12:56 -------- d-----w- c:\program files\Common Files\Skype 2011-05-24 06:25 . 2011-05-24 06:25 -------- d-----w- c:\users\Nancy\AppData\Local\{AF964F8F-2B7C-4A25-BB67-DAF3C9F62AF5} 2011-05-23 16:43 . 2011-05-23 16:43 -------- d-----w- c:\users\Nancy\AppData\Local\{B8993139-1FF1-4AD2-A902-35D445465D45} 2011-05-22 22:51 . 2011-05-22 22:51 -------- d-----w- c:\users\Nancy\AppData\Local\{527569DB-3B2F-4FE7-8EE5-9CA8502B136B} 2011-05-22 09:54 . 2011-05-22 09:54 -------- d-----w- c:\users\Nancy\AppData\Local\{F101C60C-0A91-4FDE-9771-38838673E9BA} 2011-05-21 12:08 . 2011-05-21 12:08 -------- d-----w- c:\users\Nancy\AppData\Local\{8AF9163F-B6CC-4B75-8002-65E658370B13} 2011-05-20 21:35 . 2011-05-20 21:35 -------- d-----w- c:\users\Nancy\AppData\Local\{45692F7C-B55D-4749-B797-45233B117F34} . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2011-03-09 247728] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-28 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-28 154136] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-28 137752] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-06-30 159744] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712] "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-09-30 181544] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-27 202032] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552] "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656] . c:\users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Schermopname en Snel starten.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate1ca05a05a2d3ab0;Google Updateservice (gupdate1ca05a05a2d3ab0);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104] R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560] R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x] R3 DCamUSBNW800;CIF USB Camera (2110);c:\windows\system32\DRIVERS\pcam800.sys [2002-07-27 210792] R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104] R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1206000.01D\SYMDS.SYS [2011-01-27 340088] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1206000.01D\SYMEFA.SYS [2011-03-15 744568] S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20110616.003\BHDrvx86.sys [2011-06-15 810616] S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20110615.001\IDSvix86.sys [2011-06-10 367736] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1206000.01D\Ironx86.SYS [2011-01-27 136312] S2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\18.6.0.29\ccSvcHst.exe [2011-04-17 130008] S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-04-15 2280312] S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-03-09 92592] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-06-18 105592] S3 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\NAV\1201000.025\SYMTDIV.SYS [2010-07-13 331312] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr . Inhoud van de 'Gedeelde Taken' map . 2011-06-19 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-15 23:01] . 2011-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02] . 2011-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.nl/ IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 Trusted Zone: navigram.com\www TCP: DhcpNameServer = 194.134.5.5 194.134.0.97 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-06-19 15:15 Windows 6.0.6002 Service Pack 2 NTFS . scannen van verborgen processen ... . scannen van verborgen autostart items ... . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NAV] "ImagePath"="\"c:\program files\Norton AntiVirus\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\18.6.0.29\diMaster.dll\" /prefetch:1" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\S-1-5-21-1799926568-97698467-2023138869-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2594D239-90E4-6F0A-46B8-4DB5907FD91E}*] "oaigdonmkdndpahonfnedjgjaabbbm"=hex:6a,61,64,68,62,69,66,61,63,63,68,6f,69,66, 6a,66,6b,6e,65,6b,00,f7 "pacifjomjapaepmhaimimddiahmfacmn"=hex:6a,61,67,66,68,68,62,70,67,63,66,70,6c, 61,64,6a,6a,6f,68,6c,00,f7 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Voltooingstijd: 2011-06-19 15:21:23 ComboFix-quarantined-files.txt 2011-06-19 13:21 ComboFix2.txt 2011-06-18 20:38 . Pre-Run: 11.141.681.152 bytes beschikbaar Post-Run: 13.020.696.576 bytes beschikbaar . - - End Of File - - 2D34884ECB0EBA98E1B01B64FF5E5D39

ok dank je hij loopt weer.

gisteren vertelde ik dat combofix zelf starte en dat ik niet de gelegenheid kreeg om het op mijn bureaublad te plaatsen. Ik heb op uitvoeren gedrukt. Moet ik het op nieuw downloaden?

Hier is het logje bedankt ik ben al blij ik heb mijn pictogrammen op het bureaublad weer terug. ComboFix 11-06-17.04 - Nancy 18-06-2011 21:55:42.1.1 - x86 Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.31.1043.18.2037.1083 [GMT 2:00] Gestart vanuit: c:\users\Nancy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WUXYWDTS\ComboFix.exe AV: Norton AntiVirus *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855} SP: Norton AntiVirus *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\system32\KBL.LOG . . (((((((((((((((((((( Bestanden Gemaakt van 2011-05-18 to 2011-06-18 )))))))))))))))))))))))))))))) . . 2011-06-18 20:16 . 2011-06-18 20:16 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-06-18 18:06 . 2011-06-18 18:06 -------- d-----w- c:\users\Nancy\AppData\Roaming\Malwarebytes 2011-06-18 18:05 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\programdata\Malwarebytes 2011-06-18 18:05 . 2011-06-18 18:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-06-18 18:05 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-06-18 16:48 . 2011-06-18 16:48 -------- d-----w- c:\users\Nancy\AppData\Roaming\Reviversoft 2011-06-18 16:29 . 2011-05-17 12:51 16704 ----a-w- c:\windows\system32\roboot.exe 2011-06-18 16:02 . 2011-06-18 16:02 388096 ----a-r- c:\users\Nancy\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2011-06-18 16:02 . 2011-06-18 16:02 -------- d-----w- c:\program files\Trend Micro 2011-06-18 15:06 . 2011-05-09 20:46 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83DCB7F6-5579-4AE1-A3E3-C30D5DBE326C}\mpengine.dll 2011-06-18 14:54 . 2011-06-18 14:54 126512 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2011-06-18 14:47 . 2011-06-18 14:47 -------- d-----w- c:\windows\system32\drivers\NAV 2011-06-18 14:46 . 2011-06-18 14:47 -------- d-----w- c:\program files\Norton AntiVirus 2011-06-18 14:44 . 2011-06-18 14:44 -------- d-----w- c:\program files\NortonInstaller 2011-06-18 14:20 . 2011-06-18 14:20 -------- d-----w- c:\program files\AVG 2011-06-18 13:51 . 2011-06-18 13:51 -------- d--h--w- c:\users\Nancy\AppData\Local\{E561CC4B-00EE-475A-A7F6-8374E7288BBD} 2011-06-18 11:26 . 2011-06-18 11:26 -------- d--h--w- c:\users\Nancy\AppData\Local\{585AAEA6-CDA6-48D1-AA7A-939BFE92542B} 2011-06-18 11:01 . 2011-06-18 11:01 -------- d--h--w- c:\users\Nancy\AppData\Local\{4BABDD26-206E-4298-998C-F077AAE04A58} 2011-06-17 07:32 . 2011-06-17 07:32 -------- d--h--w- c:\users\Nancy\AppData\Local\{2BF7FE24-A06A-420B-9649-EB418974AAD0} 2011-06-16 19:19 . 2011-06-16 19:19 -------- d--h--w- c:\users\Nancy\AppData\Local\{F15279E2-7B52-4839-869A-68902F5918B9} 2011-06-16 07:59 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2011-06-16 07:59 . 2011-04-25 15:29 141104 ----a-w- c:\program files\Internet Explorer\sqmapi.dll 2011-06-16 07:59 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\system32\jscript9.dll 2011-06-16 07:18 . 2011-06-16 07:19 -------- d--h--w- c:\users\Nancy\AppData\Local\{4DE5EE15-2C05-4B22-9628-8C99B70B4C0C} 2011-06-15 21:34 . 2011-04-14 14:59 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys 2011-06-15 21:33 . 2011-04-21 13:58 273408 ----a-w- c:\windows\system32\drivers\afd.sys 2011-06-15 21:33 . 2011-04-29 13:25 146432 ----a-w- c:\windows\system32\drivers\srv2.sys 2011-06-15 21:33 . 2011-04-29 13:25 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys 2011-06-15 21:33 . 2010-12-20 16:35 563712 ----a-w- c:\windows\system32\oleaut32.dll 2011-06-15 21:32 . 2011-05-02 17:16 739328 ----a-w- c:\windows\system32\inetcomm.dll 2011-06-15 21:32 . 2011-04-29 13:24 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys 2011-06-15 21:32 . 2011-04-29 13:24 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys 2011-06-15 21:32 . 2011-04-29 13:24 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2011-06-15 21:32 . 2011-05-02 12:02 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat 2011-06-15 15:27 . 2011-06-15 15:27 -------- d--h--w- c:\users\Nancy\AppData\Local\{2F8574D1-E0CA-4E9E-A57E-3736C21462EB} 2011-06-14 22:15 . 2011-06-14 22:15 -------- d--h--w- c:\users\Nancy\AppData\Local\{2E3D7290-AD94-4171-A7A8-D2BCEC78021A} 2011-06-14 10:15 . 2011-06-14 10:15 -------- d--h--w- c:\users\Nancy\AppData\Local\{95E50AE5-193D-45AB-882C-EF03D6472765} 2011-06-13 22:14 . 2011-06-13 22:14 -------- d--h--w- c:\users\Nancy\AppData\Local\{AED600EE-A22F-4B20-B275-15BDAB4F6C8E} 2011-06-13 10:13 . 2011-06-13 10:14 -------- d--h--w- c:\users\Nancy\AppData\Local\{10321860-2BDF-4E78-BDB3-5BCD07AD629D} 2011-06-12 22:13 . 2011-06-12 22:13 -------- d--h--w- c:\users\Nancy\AppData\Local\{96F2A133-5B19-4979-AF8B-DFABCE0B7F78} 2011-06-12 09:17 . 2011-06-12 09:17 -------- d--h--w- c:\users\Nancy\AppData\Local\{0B37F928-84AD-4098-9C93-ABB7779AA081} 2011-06-11 11:44 . 2011-06-11 11:45 -------- d--h--w- c:\users\Nancy\AppData\Local\{75BA0DB9-3BB4-4655-9649-A659B8E1EC96} 2011-06-10 23:44 . 2011-06-10 23:44 -------- d--h--w- c:\users\Nancy\AppData\Local\{D95AA3A4-F1D5-4578-8A9F-23CAEAA3B0D4} 2011-06-10 07:03 . 2011-06-10 07:03 -------- d--h--w- c:\users\Nancy\AppData\Local\{746AFE7F-06CA-4AAE-8892-3E630E900FD0} 2011-06-09 18:39 . 2011-06-09 18:39 -------- d--h--w- c:\users\Nancy\AppData\Local\{92572B97-72EF-4417-A512-13BB18D53462} 2011-06-09 06:38 . 2011-06-09 06:38 -------- d--h--w- c:\users\Nancy\AppData\Local\{CE243EB9-B936-4FA7-8E4A-BC5EE678CBF3} 2011-06-08 18:37 . 2011-06-08 18:38 -------- d--h--w- c:\users\Nancy\AppData\Local\{FA9AA1D7-87BB-4A81-B016-80FE0CDCC336} 2011-06-08 06:37 . 2011-06-08 06:37 -------- d--h--w- c:\users\Nancy\AppData\Local\{4E0A34E5-C147-4B9F-ACF5-4C604628D904} 2011-06-07 19:36 . 2011-06-07 19:36 -------- d-----w- c:\program files\Conduit 2011-06-07 19:35 . 2011-06-07 19:35 0 ----a-w- c:\windows\system32\ConduitEngine.tmp 2011-06-07 19:35 . 2011-06-07 19:35 -------- d--h--w- c:\users\Nancy\AppData\Local\Conduit 2011-06-07 19:35 . 2011-06-07 19:35 -------- d-----w- c:\program files\InnoGames_International 2011-06-07 10:52 . 2011-06-07 10:53 -------- d--h--w- c:\users\Nancy\AppData\Local\{C8A7EC52-DF0E-44E7-8DFE-8AF70F70C21D} 2011-06-06 18:29 . 2011-06-06 18:29 -------- d--h--w- c:\users\Nancy\AppData\Local\{2BBF3D80-17C0-4CA6-ADB0-D974AE317FDB} 2011-06-06 06:28 . 2011-06-06 06:28 -------- d--h--w- c:\users\Nancy\AppData\Local\{7BCB44D8-D4FB-402A-A6BA-9774902EAAB3} 2011-06-05 11:26 . 2011-06-05 11:26 -------- d--h--w- c:\users\Nancy\AppData\Local\{992D8976-D0B3-41A2-AC72-94C5005089C0} 2011-06-04 23:25 . 2011-06-04 23:25 -------- d--h--w- c:\users\Nancy\AppData\Local\{89040DCA-974D-4F14-A85D-3C90DC375D20} 2011-06-04 10:56 . 2011-06-04 10:56 -------- d--h--w- c:\users\Nancy\AppData\Local\{89AD610B-15F9-4286-8484-F9A94803146D} 2011-06-03 22:55 . 2011-06-03 22:55 -------- d--h--w- c:\users\Nancy\AppData\Local\{2E311ACA-3649-450A-92AC-8D0D230D7F51} 2011-06-03 10:11 . 2011-06-03 10:12 -------- d--h--w- c:\users\Nancy\AppData\Local\{6A60A271-6D8E-4C47-B521-712850B3EA75} 2011-06-02 21:38 . 2011-06-02 21:38 -------- d-----w- c:\program files\Navigram 2011-06-02 21:01 . 2011-06-02 21:02 -------- d--h--w- c:\users\Nancy\AppData\Local\{2366CA52-A42F-4C02-8B66-6E7413266579} 2011-06-02 09:01 . 2011-06-02 09:01 -------- d--h--w- c:\users\Nancy\AppData\Local\{11D7D134-D62D-4565-86C5-3C3FA205F9B7} 2011-06-01 21:00 . 2011-06-01 21:00 -------- d--h--w- c:\users\Nancy\AppData\Local\{C99141CF-1998-4D5D-98EE-3D321D8FBFAB} 2011-06-01 15:51 . 2011-06-01 15:52 -------- d--h--w- c:\users\Nancy\AppData\Local\{A332EBF1-FFFE-4E33-B5FF-615DAF4C4F6C} 2011-05-31 22:03 . 2011-05-31 22:03 -------- d--h--w- c:\users\Nancy\AppData\Local\{FC8F4A5A-3751-494D-8C04-66A3EAFFEB36} 2011-05-31 06:17 . 2011-05-31 06:17 -------- d--h--w- c:\users\Nancy\AppData\Local\{ABE64375-0416-45A0-B69F-7938DB5B6D16} 2011-05-30 16:48 . 2011-05-30 16:48 -------- d--h--w- c:\users\Nancy\AppData\Local\{24AA0B77-3005-4350-A855-BFEAFEF6F74A} 2011-05-29 21:54 . 2011-05-29 21:54 -------- d--h--w- c:\users\Nancy\AppData\Local\{97D375D6-35F7-4EE0-B6D2-3359F15F30CB} 2011-05-29 09:53 . 2011-05-29 09:53 -------- d--h--w- c:\users\Nancy\AppData\Local\{69CFC663-C1D2-4177-8AEF-03E14B316570} 2011-05-28 11:26 . 2011-05-28 11:27 -------- d--h--w- c:\users\Nancy\AppData\Local\{E610BA14-1123-47F0-9D9B-DE5D315792B6} 2011-05-27 23:26 . 2011-05-27 23:26 -------- d--h--w- c:\users\Nancy\AppData\Local\{D52379C4-6D54-49C3-99DD-BB01A472835C} 2011-05-27 06:53 . 2011-05-27 06:53 -------- d--h--w- c:\users\Nancy\AppData\Local\{0F752173-ED2D-4B7F-A37B-B8AEC2DCBCCD} 2011-05-26 20:57 . 2011-05-26 21:01 -------- d--h--w- c:\users\Nancy\AppData\Roaming\TeamViewer 2011-05-26 20:56 . 2011-05-26 20:56 -------- d-----w- c:\program files\TeamViewer 2011-05-26 18:52 . 2011-05-26 18:52 -------- d--h--w- c:\users\Nancy\AppData\Local\{B491E160-7296-45AD-BF4E-B52BEE091015} 2011-05-26 06:52 . 2011-05-26 06:52 -------- d--h--w- c:\users\Nancy\AppData\Local\{4D6A9A06-0957-4D52-92CB-8E69DDBD4CB4} 2011-05-25 15:13 . 2011-05-25 15:13 -------- d--h--w- c:\users\Nancy\AppData\Local\{66E4BAF8-6C76-442C-90D8-7248F48B4CDD} 2011-05-24 18:26 . 2011-05-24 18:26 -------- d--h--w- c:\users\Nancy\AppData\Local\{EBA9D5F0-FE17-4B12-86AE-1939BED5812A} 2011-05-24 12:57 . 2011-06-15 20:19 -------- d--h--w- c:\programdata\Skype Extras 2011-05-24 12:56 . 2011-05-24 12:56 -------- d-----w- c:\program files\Common Files\Skype 2011-05-24 06:25 . 2011-05-24 06:25 -------- d--h--w- c:\users\Nancy\AppData\Local\{AF964F8F-2B7C-4A25-BB67-DAF3C9F62AF5} 2011-05-23 16:43 . 2011-05-23 16:43 -------- d--h--w- c:\users\Nancy\AppData\Local\{B8993139-1FF1-4AD2-A902-35D445465D45} 2011-05-22 22:51 . 2011-05-22 22:51 -------- d--h--w- c:\users\Nancy\AppData\Local\{527569DB-3B2F-4FE7-8EE5-9CA8502B136B} 2011-05-22 09:54 . 2011-05-22 09:54 -------- d--h--w- c:\users\Nancy\AppData\Local\{F101C60C-0A91-4FDE-9771-38838673E9BA} 2011-05-21 12:08 . 2011-05-21 12:08 -------- d--h--w- c:\users\Nancy\AppData\Local\{8AF9163F-B6CC-4B75-8002-65E658370B13} 2011-05-20 21:35 . 2011-05-20 21:35 -------- d--h--w- c:\users\Nancy\AppData\Local\{45692F7C-B55D-4749-B797-45233B117F34} 2011-05-20 09:34 . 2011-05-20 09:34 -------- d--h--w- c:\users\Nancy\AppData\Local\{0F03B390-2011-47B2-9336-2FDA2B4A4360} . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2011-03-09 247728] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-28 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-28 154136] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-28 137752] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-06-30 159744] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712] "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-09-30 181544] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-27 202032] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552] "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656] . c:\users\Nancy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Schermopname en Snel starten.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate1ca05a05a2d3ab0;Google Updateservice (gupdate1ca05a05a2d3ab0);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104] R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560] R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x] R3 DCamUSBNW800;CIF USB Camera (2110);c:\windows\system32\DRIVERS\pcam800.sys [2002-07-27 210792] R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 133104] R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1201000.025\SYMDS.SYS [2010-06-13 339504] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1201000.025\SYMEFA.SYS [2010-07-29 666672] S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx86.sys [2010-08-09 692272] S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVix86.sys [2010-06-27 344112] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1201000.025\Ironx86.SYS [2010-06-27 134704] S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\NAV\1201000.025\SYMTDIV.SYS [2010-07-13 331312] S2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe [2010-07-23 126904] S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-04-15 2280312] S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-03-09 92592] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-06-18 105592] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr . Inhoud van de 'Gedeelde Taken' map . 2011-06-18 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-15 23:01] . 2011-06-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02] . 2011-06-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-07-15 23:02] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.nl/ IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 Trusted Zone: navigram.com\www TCP: DhcpNameServer = 194.134.5.5 194.134.0.97 . - - - - ORPHANS VERWIJDERD - - - - . WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{942CD1D4-9CC1-4D31-876A-EA8F489F7A59} - (no file) HKCU-Run-MsnMsgr - ~c:\program files\Windows Live\Messenger\msnmsgr.exe HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe AddRemove-conduitEngine - c:\program files\ConduitEngine\ConduitEngineUninstall.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2011-06-18 22:17 Windows 6.0.6002 Service Pack 2 NTFS . scannen van verborgen processen ... . scannen van verborgen autostart items ... . HKCU\Software\Microsoft\Windows\CurrentVersion\Run MsnMsgr = ~"c:\program files\Windows Live\Messenger\msnmsgr.exe" /background? . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NAV] "ImagePath"="\"c:\program files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\18.1.0.37\diMaster.dll\" /prefetch:1" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\S-1-5-21-1799926568-97698467-2023138869-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2594D239-90E4-6F0A-46B8-4DB5907FD91E}*] "oaigdonmkdndpahonfnedjgjaabbbm"=hex:6a,61,64,68,62,69,66,61,63,63,68,6f,69,66, 6a,66,6b,6e,65,6b,00,f7 "pacifjomjapaepmhaimimddiahmfacmn"=hex:6a,61,67,66,68,68,62,70,67,63,66,70,6c, 61,64,6a,6a,6f,68,6c,00,f7 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Voltooingstijd: 2011-06-18 22:38:13 ComboFix-quarantined-files.txt 2011-06-18 20:38 . Pre-Run: 12.380.205.056 bytes beschikbaar Post-Run: 13.522.911.232 bytes beschikbaar . - - End Of File - - 02DAFD3B262DFCA873C929D7E30C2AD7

ik kon niet wachten dus ben het toch gaan downloaden ik heb op uitvoeren geklikt en daarna ging hij gelijk scannen ik kon het niet op het buroblad plaatsen en nu doorloopt hij de autoscan.

Ok ik ga weer aan de slag echt top dat je me wilt helpen ---------- Post toegevoegd om 21:38 ---------- Vorige post was om 21:29 ---------- Mijn computer geeft aan dat het niet vaak gedownload wordt en mogelijk schadelijk is voor de computer

nee die heb ik niet meer alleen rechts onderin kreeg ik met opnieuw opstarten een pictogrammetje met de melding geblokkeerde opstart programma's

Gevonden....... Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 20:53:35, on 18-6-2011 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v9.00 (9.00.8112.16421) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Windows\WindowsMobile\wmdSync.exe C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\Apoint2K\ApMsgFwd.exe C:\Program Files\Apoint2K\Apntex.exe C:\Windows\system32\conime.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\Macromed\Flash\FlashUtil10p_ActiveX.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Compaq | MSN R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\IPSBHO.DLL O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe" O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O16 - DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} (Navigram Control) - http://www.navigram.com/engine/v911/Navigram.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe O23 - Service: Google Updateservice (gupdate1ca05a05a2d3ab0) (gupdate1ca05a05a2d3ab0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 10013 bytes

Als ik een nieuwe scan maak met Hijackthis opent hij geen kladblok meer zodat ik het kan kopiëren. Ik weet niet hoe ik het nu op het forum moet plaatsen groetjes Nancy ---------- Post toegevoegd om 20:49 ---------- Vorige post was om 20:48 ---------- Ja zeker ik zag het staan ik ben heel blij dat ze verwijderd zijn. Ik dacht echt dat mijn laptop overleden was. Hij blaast namelijk de laaste tijd erg hard.

Deze werkt ook niet Maar volgens mij heb ik de juiste kunnen vinden. ---------- Post toegevoegd om 20:26 ---------- Vorige post was om 20:24 ---------- sorry hij doet het wel alles is een beetje anders op mijn laptop. ---------- Post toegevoegd om 20:39 ---------- Vorige post was om 20:26 ---------- Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Databaseversie: 6888 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 18-6-2011 20:28:16 mbam-log-2011-06-18 (20-28-16).txt Scantype: Snelle scan Objecten gescand: 161463 Verstreken tijd: 14 minuut/minuten, 13 seconde(n) Geheugenprocessen geïnfecteerd: 0 Geheugenmodulen geïnfecteerd: 0 Registersleutels geïnfecteerd: 0 Registerwaarden geïnfecteerd: 0 Registerdata geïnfecteerd: 0 Mappen geïnfecteerd: 0 Bestanden geïnfecteerd: 3 Geheugenprocessen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Geheugenmodulen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registersleutels geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registerwaarden geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registerdata geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Mappen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Bestanden geïnfecteerd: c:\Users\Nancy\AppData\Local\Temp\install_flash_player.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully. c:\users\nancy\appdata\local\temp\tmp78a4.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. c:\Users\Nancy\AppData\Local\Temp\adobe_flash_player.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.