maffenhendrik

Gisteravond heb ik mijn pc weggebracht voor herstellen. Mijn pc is alleen nog te benaderen via cd/dvd of via commando's. Omdat ik 5 dagen geen reactie had gehad ging het mij te lang duren, mijn excuses. Graag wil ik allen die hebben bijgedragen aan een herstel hartelijk daarvoor bedanken.

|k zie dat er niemand meer hulp kan bieden?

Inmiddels loopt de test 4,5 uur (ik laat hem rustig doorlopen tot morgenvroeg|) Tot op heden geen enkele error. Het is nu 11:30 uur en inmiddels ruim 23 uur gedraaid en geen enkele error. Ik snap er niets meer van, dat hij geen enkele error aangeeft en toch iedere keer een blauw scherm met geheugendump vertoont?

Started Long Test 8/23/2012 0:11.37 DST Completed without Error Short DST Passed 8/23/2012 1:27.12 Long Test Passed 8/23/2012 1:27.12

ik kan nu mijn pc niet meer opstarten in foutopsporings modus of in veilige modus. mocht het een defect in het RAM zijn is het mogelijk het één en ander te branden op een schijfje en dan via dit schijfje te laten opstarten? Als het een defect in de schijf is , dan is het einde verhaal?

Hoop dat onderstaande groot genoeg is.Kan PSPpro X4 (fotobewerkingsprogramma)ook niet niet opstarten (loopt pc vast)

Dat klopt , elke keer wanneer ik de pc normaal opstart krijg ik een blauw scherm. Echter in het overzicht van blue screen view zie ik er steeds maar 1 regel (dump file) staan. zo ook in de laatste crash time: 16-8-2012 19:58 bug check string: PAGE_FAULT_IN_NONPAGED_AREA bug check code: 0x10000050 Parameter 1: 09feadc08 Parameter 2: 0x00000000 Parameter 3: 0x8697fbb7 Parameter 4: 0x00000000 Achter caused bij driver staat hier echter niets vermeld.

bug check string - PAGE_FAULT_IN_NONPAGED_AREA bug check code - 0x10000050 caused by driver - win32k.sys de 4 parameters 0xe191b01c 0x00000000 0xbf82ebe1 0x00000001

Wanneer ComboFix de pc afsluit en weer opstart krijg ik weer een geheugendump. Start ik vervolgens op in foutopsporingsmodus dan kan ik wel weer verder. =============================================================== ComboFix 12-08-14.05 - Harrie 15-08-2012 13:35:18.6.2 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1022.428 [GMT 2:00] Gestart vanuit: c:\documents and settings\Harrie\Bureaublad\ComboFix.exe gebruikte Opdracht switches :: c:\documents and settings\Harrie\Bureaublad\CFScript.txt AV: AVG Internet Security 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: AVG Internet Security 2012 *Enabled* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . FILE :: "c:\windows\system32\drivers\ofvhvac.sys" . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\Marijke\Application Data\Babylon c:\documents and settings\Marijke\Application Data\Babylon\Content\icons\6RHZSDV3KE_glossary_icon.ico c:\documents and settings\Marijke\Application Data\Babylon\Content\icons\BTMJWKZGYE_glossary_icon.ico c:\documents and settings\Marijke\Application Data\Babylon\Content\icons\HCZ7J3Q8UA_glossary_icon.ico c:\documents and settings\Marijke\Local Settings\Application Data\Babylon . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_cvxxed . . (((((((((((((((((((( Bestanden Gemaakt van 2012-07-15 to 2012-08-15 )))))))))))))))))))))))))))))) . . 2012-08-14 14:59 . 2012-06-02 13:18 214256 ----a-w- c:\windows\system32\muweb.dll 2012-08-13 17:02 . 2012-08-13 17:02 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee 2012-08-12 15:53 . 2012-08-15 11:26 -------- d-sh--w- c:\documents and settings\Harrie\Onlangs geopend 2012-08-12 15:31 . 2012-08-12 15:31 -------- d-----w- c:\documents and settings\Harrie\Application Data\AVG2012 2012-08-12 15:29 . 2012-08-12 15:29 -------- d-----w- c:\documents and settings\Harrie\Local Settings\Application Data\AVG Secure Search 2012-08-12 15:29 . 2012-08-12 18:34 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Secure Search 2012-08-12 15:29 . 2012-08-12 15:29 -------- d-----w- c:\documents and settings\Harrie\Application Data\AVG Secure Search 2012-08-12 15:29 . 2012-08-12 15:29 27496 ----a-w- c:\windows\system32\drivers\avgtpx86.sys 2012-08-12 15:28 . 2012-08-12 15:29 -------- d-----w- c:\program files\Common Files\AVG Secure Search 2012-08-12 15:28 . 2012-08-12 15:29 -------- d-----w- c:\program files\AVG Secure Search 2012-08-12 15:25 . 2012-08-15 08:32 -------- d-----w- c:\windows\system32\drivers\AVG 2012-08-12 15:25 . 2012-08-12 15:56 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2012 2012-08-12 15:10 . 2012-08-15 08:33 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData 2012-08-12 15:10 . 2012-08-12 15:10 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files 2012-08-12 08:40 . 2012-08-12 08:40 -------- d-----w- c:\program files\Speccy 2012-08-11 21:24 . 2012-08-11 21:24 -------- d-----w- c:\documents and settings\Harrie\Application Data\SpeedyPC Software 2012-08-11 21:24 . 2012-08-11 21:24 -------- d-----w- c:\documents and settings\Harrie\Application Data\DriverCure 2012-08-11 21:23 . 2012-08-11 21:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SpeedyPC Software 2012-08-11 19:39 . 2012-08-11 19:39 -------- d-----w- c:\program files\Microsoft Silverlight 2012-08-11 18:07 . 2012-08-11 18:07 -------- d-----w- c:\documents and settings\Harrie\Local Settings\Application Data\CRE 2012-08-10 15:04 . 2012-04-22 11:51 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys 2012-08-10 15:04 . 2012-08-10 15:04 -------- d-----w- c:\program files\PC Connectivity Solution 2012-08-09 16:06 . 2012-08-09 16:06 -------- d-sh--w- c:\documents and settings\Administrator\Onlangs geopend 2012-08-09 16:06 . 2012-08-09 16:06 -------- d-----w- c:\documents and settings\Marijke\Application Data\BabylonToolbar 2012-08-09 16:05 . 2012-08-09 16:05 -------- d-----w- c:\program files\FileZilla FTP Client 2012-08-09 16:05 . 2012-08-09 16:05 -------- d-----w- c:\program files\GIMP-2.0 2012-08-09 16:05 . 2012-08-10 15:32 -------- d-----w- c:\program files\McAfee Security Scan 2012-08-09 16:05 . 2012-08-09 16:05 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan 2012-08-09 16:04 . 2012-08-09 16:04 -------- d-----w- c:\program files\Microsoft Digital Image 2006 2012-08-09 16:04 . 2012-08-09 16:04 -------- d-----w- c:\program files\Winamp Toolbar 2012-08-09 16:04 . 2012-08-09 16:04 -------- d-----w- c:\documents and settings\Harrie\Local Settings\Application Data\Winamp Toolbar 2012-08-09 16:04 . 2012-08-09 16:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Winamp Toolbar 2012-08-09 16:03 . 2012-08-09 16:03 -------- d-----w- c:\documents and settings\Harrie\Application Data\Winamp 2012-08-09 16:03 . 2012-08-09 16:03 -------- d-----w- c:\program files\Winamp Detect 2012-08-09 16:03 . 2012-08-09 16:03 -------- d-----w- c:\program files\ReaSoft 2012-08-09 16:03 . 2012-08-09 16:03 -------- d-----w- c:\documents and settings\Harrie\Application Data\ReaSoft 2012-08-09 16:03 . 2012-08-09 16:03 -------- d-----w- c:\program files\Postbox Express 2012-08-09 16:03 . 2012-08-09 16:03 -------- d-----w- c:\program files\Postbox 2012-08-09 16:02 . 2012-08-09 16:02 -------- d-----w- c:\program files\Samsung 2012-08-09 16:02 . 2012-08-09 16:02 -------- d-----w- c:\program files\Shape Collage 2012-08-09 15:26 . 2012-08-09 15:26 -------- d-----w- c:\windows\system32\wbem\Repository 2012-08-07 20:39 . 2005-04-22 09:14 95232 ----a-w- c:\program files\Common Files\Microsoft Shared\Picture It!\RmvSuite.exe 2012-07-30 17:14 . 2012-07-30 17:14 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-02 17:53 . 2012-04-06 19:07 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-08-02 17:53 . 2011-05-24 13:26 70344 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-07-03 11:46 . 2008-07-31 21:09 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-06-30 13:15 . 2010-03-23 14:54 348160 ----a-w- c:\windows\system32\msvcr71.dll 2012-06-30 13:15 . 2010-03-23 14:54 499712 ----a-w- c:\windows\system32\msvcp71.dll 2012-06-13 13:55 . 2008-06-28 21:28 1866240 ----a-w- c:\windows\system32\win32k.sys 2012-06-05 15:49 . 2008-06-30 11:09 1372672 ----a-w- c:\windows\system32\msxml6.dll 2012-06-05 15:49 . 2004-08-04 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll 2012-06-04 04:32 . 2008-06-28 21:28 152576 ----a-w- c:\windows\system32\schannel.dll 2012-06-02 13:19 . 2008-06-28 21:13 18456 ----a-w- c:\windows\system32\wuaueng.dll.mui 2012-06-02 13:19 . 2008-06-28 21:01 329240 ----a-w- c:\windows\system32\wucltui.dll 2012-06-02 13:19 . 2008-06-28 21:01 210968 ----a-w- c:\windows\system32\wuweb.dll 2012-06-02 13:19 . 2008-06-28 21:01 219160 ----a-w- c:\windows\system32\wuaucpl.cpl 2012-06-02 13:19 . 2008-06-28 21:13 45080 ----a-w- c:\windows\system32\wups2.dll 2012-06-02 13:19 . 2008-06-28 21:01 53784 ----a-w- c:\windows\system32\wuauclt.exe 2012-06-02 13:19 . 2008-06-28 21:01 35864 ----a-w- c:\windows\system32\wups.dll 2012-06-02 13:19 . 2004-08-04 12:00 97304 ----a-w- c:\windows\system32\cdm.dll 2012-06-02 13:19 . 2008-09-03 14:04 15896 ----a-w- c:\windows\system32\wuapi.dll.mui 2012-06-02 13:19 . 2008-06-28 21:13 15896 ----a-w- c:\windows\system32\wuaucpl.cpl.mui 2012-06-02 13:19 . 2008-06-28 21:01 577048 ----a-w- c:\windows\system32\wuapi.dll 2012-06-02 13:19 . 2008-06-28 21:13 24088 ----a-w- c:\windows\system32\wucltui.dll.mui 2012-06-02 13:19 . 2008-06-28 21:01 1933848 ----a-w- c:\windows\system32\wuaueng.dll 2012-06-02 13:19 . 2008-06-28 21:15 18160 ----a-w- c:\windows\system32\mucltui.dll.mui 2012-06-02 13:18 . 2008-06-28 21:15 275696 ----a-w- c:\windows\system32\mucltui.dll 2012-05-31 13:22 . 2004-08-04 12:00 602624 ----a-w- c:\windows\system32\crypt32.dll 2010-10-25 08:01 . 2010-10-25 08:01 2951802 ----a-w- c:\program files\EClea2_0.exe 2002-02-26 16:34 . 2002-09-03 12:19 2000896 -c--a-w- c:\program files\DS_PlugIn.8bf 2007-11-06 23:19 . 2010-10-19 22:40 568832 -c--a-w- c:\program files\opera\program\plugins\msvcp90.dll 2007-11-06 23:19 . 2010-10-19 22:40 655872 -c--a-w- c:\program files\opera\program\plugins\msvcr90.dll 2012-07-10 20:23 . 2011-10-09 18:30 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys [7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\SoftwareDistributionold\Download\2f7964faba1b02d922ef1bc199202cbc\atapi.sys [7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\atapi.sys [-] 2008-04-13 18:40 . F6584BD8E76EFE3FA37397D90F982265 . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys [7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys . . ((((((((((((((((((((((((((((( SnapShot@2012-08-14_19.44.42 ))))))))))))))))))))))))))))))))))))))))) . + 2012-08-15 12:04 . 2012-08-15 12:04 16384 c:\windows\Temp\Perflib_Perfdata_83c.dat . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2012-08-12 15:28 2045024 ----a-w- c:\program files\AVG Secure Search\12.2.0.5\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\12.2.0.5\AVG Secure Search_toolbar.dll" [2012-08-12 2045024] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 204288] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-05-24 39408] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2005-08-18 14820864] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-04-18 421888] "PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 406016] "nwiz"="nwiz.exe" [2006-10-22 1622016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NSU_agent"="c:\program files\Nokia\Nokia Software Updater\nsu3ui_agent.exe" [2011-08-11 169264] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-14 221184] "HostManager"="c:\program files\Common Files\AOL\1271854961\ee\AOLSoftware.exe" [2010-02-10 41800] "CmUCRRun"="c:\windows\system32\CmUCReye.exe" [2006-07-12 237568] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280] "AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2011-02-23 611712] "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592] "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008] "vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-08-12 1162848] "ROC_roc_ssl_v12"="c:\program files\AVG Secure Search\ROC_roc_ssl_v12.exe" [2012-08-12 1020512] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] . c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\ McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.229\SSScheduler.exe [2011-9-20 272528] . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^Documents and Settings^Harrie^Menu Start^Programma's^Opstarten^OpenOffice.org 3.3 .lnk] backup=c:\windows\pss\OpenOffice.org 3.3 .lnkStartup . [HKLM\~\startupfolder\C:^Documents and Settings^Harrie^Menu Start^Programma's^Opstarten^Verjaardagskalender Zonnekindpoppen.lnk] backup=c:\windows\pss\Verjaardagskalender Zonnekindpoppen.lnkStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\4shared Desktop] 2011-12-09 12:00 4613624 ----a-w- c:\program files\4shared Desktop\desktop.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\4shared Update] 2011-12-09 12:00 608760 ----a-w- c:\program files\4shared Desktop\checkUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeBridge] 2008-08-28 17:34 13145448 ----a-w- c:\program files\Adobe\Adobe Bridge CS4\Bridge.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] 2008-04-14 17:03 110592 ----a-w- c:\windows\system32\bthprops.cpl . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter] 2010-03-24 17:50 2516296 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx] 2010-04-02 08:18 1185112 ----a-w- c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Family Tree Builder Update] 2011-12-21 15:26 229376 -c--a-w- c:\program files\MyHeritage\Bin\FTBCheckUpdates.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HyvesDesktop.exe] 2010-11-17 09:34 137216 ----a-w- c:\program files\Hyves Desktop\bin\HyvesDesktop.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2012-06-07 17:33 421776 ----a-w- c:\program files\iTunes\iTunesHelper.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] 2012-06-30 13:15 296096 ----a-w- c:\program files\Real\RealPlayer\Update\realsched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe] 2011-04-22 12:21 247728 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] 2011-03-22 18:37 74752 ----a-w- c:\program files\Winamp\winampa.exe . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"=c:\windows\system32\ctfmon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Documents and Settings\\Harrie\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"= "c:\\Documents and Settings\\Harrie\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"= "c:\\Program Files\\deepinvent\\MailStore Home\\MailStoreLocal.exe"= "c:\\Program Files\\Common Files\\aol\\1271854961\\ee\\aolsoftware.exe"= "c:\\Program Files\\Common Files\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"= "c:\\Program Files\\Common Files\\aol\\Loader\\aolload.exe"= "c:\\Program Files\\Common Files\\aol\\System Information\\sinf.exe"= "c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"= "c:\\Program Files\\Windows iLivid Toolbar\\Datamngr\\ToolBar\\dtUser.exe"= "c:\\Documents and Settings\\Ruud\\Application Data\\Dropbox\\bin\\Dropbox.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"= "c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"= "c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"= "c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:Remote Desktop "85:TCP"= 85:TCP:BroadWave Web Server "5353:TCP"= 5353:TCP:Adobe CSI CS4 "4100:UDP"= 4100:UDP:uPNP Router Control Port "86:TCP"= 86:TCP:BroadCam Video Streaming Server Web Server "1935:TCP"= 1935:TCP:BroadCam Video Streaming Server Flash Video Server "65533:TCP"= 65533:TCP:Services "52344:TCP"= 52344:TCP:Services . R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [19-4-2012 4:50 24896] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [31-1-2012 4:46 31952] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [22-2-2012 5:25 235216] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [19-3-2012 5:17 301248] R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [12-8-2012 17:29 27496] R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14-5-2009 15:47 107256] R2 ASTSRV;Nalpeiron Licensing Service;c:\windows\system32\ASTSRV.EXE [26-12-2010 13:58 57344] R2 avgfws;AVG Firewall;c:\program files\AVG\AVG2012\avgfws.exe [13-6-2012 3:48 2321560] R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [4-7-2012 17:25 5160568] R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [14-2-2012 4:53 193288] R2 Dokan;Dokan;c:\windows\system32\drivers\dokan.sys [11-2-2012 22:52 91904] R2 DokanMounter;DokanMounter;c:\program files\SpeedyDrive\mounter.exe [11-2-2012 22:52 25088] R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [22-4-2011 14:21 92592] R2 vToolbarUpdater12.2.0;vToolbarUpdater12.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.0\ToolbarUpdater.exe [12-8-2012 17:29 927840] R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [12-1-2012 19:52 30944] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [23-12-2011 13:32 139856] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [23-12-2011 13:32 24144] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [23-12-2011 13:32 17232] R3 xcpip;Stuurprogramma voor TCP/IP-protocol;c:\windows\system32\drivers\xcpip.sys --> c:\windows\system32\drivers\xcpip.sys [?] R3 xpsec;IPSEC-stuurprogramma;c:\windows\system32\drivers\xpsec.sys --> c:\windows\system32\drivers\xpsec.sys [?] S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10-7-2008 18:08 721904] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [30-6-2010 13:19 136176] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [6-4-2012 21:07 250056] S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [12-1-2012 19:52 30944] S3 CMISTOR;CMIUCR.SYS CM320/CM220 Card Reader Driver;c:\windows\system32\drivers\cmiucr.SYS [5-1-2007 18:21 93056] S3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [30-6-2010 13:19 136176] S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [31-7-2008 23:09 22344] S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.229\McCHSvc.exe [20-9-2011 22:15 237008] S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [6-5-2012 17:49 113120] S3 nwd5aas.sys;nwd5aas.sys;\??\c:\windows\system32\drivers\nwd5aas.sys --> c:\windows\system32\drivers\nwd5aas.sys [?] S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [12-3-2010 23:39 86824] S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [12-3-2010 23:39 15016] S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [12-3-2010 23:39 114600] S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [12-3-2010 23:39 108328] S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [12-3-2010 23:39 104616] S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [12-3-2010 23:39 109736] S4 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14-5-2009 15:47 731840] S4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [31-7-2008 23:09 655944] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Inhoud van de 'Gedeelde Taken' map . 2012-08-15 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 17:53] . 2012-06-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57] . 2012-08-10 c:\windows\Tasks\Easy Onderhoud.job - c:\program files\TuneUp Utilities 2008\OneClick.exe [2008-02-04 07:39] . 2011-11-02 c:\windows\Tasks\expressburnShakeIcon.job - c:\program files\NCH Software\ExpressBurn\expressburn.exe [2011-10-23 20:47] . 2012-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-30 11:19] . 2012-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-30 11:19] . 2012-08-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1770027372-725345543-1004Core.job - c:\documents and settings\Harrie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-22 08:24] . 2012-08-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1770027372-725345543-1004UA.job - c:\documents and settings\Harrie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-22 08:24] . 2012-07-24 c:\windows\Tasks\mixpadShakeIcon.job - c:\program files\NCH Swift Sound\MixPad\mixpad.exe [2011-04-06 12:31] . 2012-01-01 c:\windows\Tasks\photostageShakeIcon.job - c:\program files\NCH Software\PhotoStage\photostage.exe [2011-02-16 08:43] . 2011-12-24 c:\windows\Tasks\pixillionShakeIcon.job - c:\program files\NCH Software\Pixillion\pixillion.exe [2011-06-13 20:57] . 2012-02-07 c:\windows\Tasks\prismShakeIcon.job - c:\program files\NCH Software\Prism\prism.exe [2011-04-06 12:17] . 2012-08-15 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-776561741-1770027372-725345543-1004.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-06-21 10:00] . 2012-08-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-776561741-1770027372-725345543-1004.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-06-21 10:00] . 2012-08-14 c:\windows\Tasks\SyncBack backupMijndokumenten.job - c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2008-12-07 11:00] . 2012-08-15 c:\windows\Tasks\User_Feed_Synchronization-{C2FD9CBF-E149-4384-AFD2-474518755E3E}.job - c:\windows\system32\msfeedssync.exe [2007-08-13 02:31] . 2011-03-19 c:\windows\Tasks\videopadShakeIcon.job - c:\program files\NCH Software\VideoPad\videopad.exe [2011-03-16 12:53] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.com/ IE: &Download All using 4shared Desktop - c:\program files\4shared Desktop\Desktop.32/D_ALL_LINK IE: &Download using 4shared Desktop - c:\program files\4shared Desktop\Desktop.32/D_ONE_LINK IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Download met Mipony - file://c:\program files\MiPony\Browser\IEContext.htm IE: Free YouTube to Mp3 Converter - c:\documents and settings\Harrie\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm TCP: DhcpNameServer = 194.134.5.5 194.134.0.97 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.0\ViProtocol.dll FF - ProfilePath - c:\documents and settings\Harrie\Application Data\Mozilla\Firefox\Profiles\rqv5syvk.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.winamp.com/search/search?query={searchterms}&invocationtype=tb50-ff-winamp-chromesbox-en-us&tb_uuid=20110329141600890&tb_oid=15-12-2010&tb_mrud=03-04-2011&query= FF - prefs.js: browser.startup.homepage - hxxp://search.etype.com/?smart=1 FF - prefs.js: keyword.url - hxxp://search.etype.com/?smart=1&query= FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: content.max.tokenizing.time - 200000 FF - user.js: content.notify.interval - 100000 FF - user.js: content.switch.threshold - 650000 FF - user.js: nglayout.initialpaint.delay - 300 . - - - - ORPHANS VERWIJDERD - - - - . WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2012-08-15 14:05 Windows 5.1.2600 Service Pack 3 NTFS . scannen van verborgen processen ... . scannen van verborgen autostart items ... . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,34,9b,eb,66,29,84,e5,48,bc,72,33,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,34,9b,eb,66,29,84,e5,48,bc,72,33,\ . [HKEY_USERS\S-1-5-21-776561741-1770027372-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{379B6AB7-0432-49DE-7392-2AFD86EB5275}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "ianpmkgmmdhiadjibi"=hex:6a,61,6a,65,6f,64,62,6c,6c,65,6b,6a,6c,64,6b,69,62,65, 6f,6a,00,00 "hahaoeobmdlfmhhj"=hex:6a,61,6d,65,66,68,6b,62,62,6d,6d,6a,62,6a,70,61,64,67, 6f,66,00,dd . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{2b5d67da-bd57-43c5-96c3-12aa7e42fcd0}] @Denied: (Full) (Everyone) "Model"=dword:0000010a "Therad"=dword:0000001e "MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26, 38,95,44,29,53,01,52,53,ee,8c,54,e6,4f,ed,aa,17,b0,0f,3f,83,e0,8b,c5,07,bb,\ . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}] @Denied: (Full) (Everyone) "scansk"=hex(0):30,9d,a2,76,9e,d7,eb,f5,7b,b1,3e,de,31,7b,f3,68,18,1c,b9,f2,48, 49,db,39,fa,ee,26,c1,ac,bd,ee,ae,1d,98,4a,08,52,5c,75,fd,00,00,00,00,00,00,\ . [HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info] @Denied: (2) (LocalSystem) "AppDataDir"="c:\\Documents and Settings\\All Users\\Application Data\\ESET\\ESET Smart Security\\" "DataDir"="ESET\\ESET Smart Security\\" "EditionName"=" " "InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\" "LanguageId"=dword:00000413 "PackageTag"=dword:6090e758 "ProductBase"=dword:00000001 "ProductCode"="{B05C29C5-C9A4-45C4-A8E9-F8385E3D5B45}" "ProductName"="ESET Smart Security" "ProductType"="ess" "ProductVersion"="4.0.437.0" "UniqueId"="00B304BC4BC4B6BB" "ScannerBuild"=dword:00001329 "ScannerVersionId"=dword:00000feb "ScannerVersion"="Open window for status." "FixId"=dword:00000009 "ei2"=hex(:36,83,0a,0f,5f,19,36,8e "ei1"=hex(:00,13,d3,b6,a7,44,00,00 "ei3"=hex(:91,0c,e0,4d,00,00,00,00 "ei4"=dword:00000005 . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–}|ÿÿÿÿÀ•}|ù•9~*] "3140710900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" . --------------------- DLLs Geladen Onder Lopende Processen --------------------- . - - - - - - - > 'explorer.exe'(2464) c:\progra~1\WINDOW~2\wmpband.dll c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_dut.nlr c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr c:\program files\WS_FTP Pro\nsftpch.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Andere Aktieve Processen ------------------------ . c:\windows\RTHDCPL.EXE c:\windows\system32\rundll32.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe c:\program files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe c:\program files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe c:\program files\Canon\IJPLM\IJPLMSVC.EXE c:\program files\Java\jre6\bin\jqs.exe c:\program files\AVG\AVG2012\avgnsx.exe c:\program files\AVG\AVG2012\avgemcx.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\AVG\AVG2012\avgrsx.exe c:\program files\AVG\AVG2012\avgcsrvx.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\nvsvc32.exe c:\windows\system32\PSIService.exe c:\program files\Common Files\Protexis\License Service\PsiService_2.exe c:\program files\CyberLink\Shared Files\RichVideo.exe c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files\AVG\AVG2012\avgcsrvx.exe c:\program files\AVG\AVG2012\avgui.exe . ************************************************************************** . Voltooingstijd: 2012-08-15 14:12:32 - machine werd herstart ComboFix-quarantined-files.txt 2012-08-15 12:12 ComboFix2.txt 2012-08-15 09:05 ComboFix3.txt 2008-07-27 13:39 . Pre-Run: 11.950.751.744 bytes beschikbaar Post-Run: 11.942.735.872 bytes beschikbaar . - - End Of File - - 09F8E4B40202C030421634DE1601ABE6

ComboFix 12-08-14.05 - Harrie 15-08-2012 10:37:53.5.2 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1022.287 [GMT 2:00] Gestart vanuit: c:\documents and settings\Harrie\Bureaublad\ComboFix.exe AV: AVG Internet Security 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: AVG Internet Security 2012 *Enabled* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_SSHNAS -------\Service_xcpip -------\Service_xpsec -------\Service_xcpip -------\Service_xpsec . . (((((((((((((((((((( Bestanden Gemaakt van 2012-07-15 to 2012-08-15 )))))))))))))))))))))))))))))) . . 2012-08-14 14:59 . 2012-06-02 13:18 214256 ----a-w- c:\windows\system32\muweb.dll 2012-08-13 17:02 . 2012-08-13 17:02 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee 2012-08-12 15:53 . 2012-08-15 08:30 -------- d-sh--w- c:\documents and settings\Harrie\Onlangs geopend 2012-08-12 15:31 . 2012-08-12 15:31 -------- d-----w- c:\documents and settings\Harrie\Application Data\AVG2012 2012-08-12 15:29 . 2012-08-12 15:29 -------- d-----w- c:\documents and settings\Harrie\Local Settings\Application Data\AVG Secure Search 2012-08-12 15:29 . 2012-08-12 18:34 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Secure Search 2012-08-12 15:29 . 2012-08-12 15:29 -------- d-----w- c:\documents and settings\Harrie\Application Data\AVG Secure Search 2012-08-12 15:29 . 2012-08-12 15:29 27496 ----a-w- c:\windows\system32\drivers\avgtpx86.sys 2012-08-12 15:28 . 2012-08-12 15:29 -------- d-----w- c:\program files\Common Files\AVG Secure Search 2012-08-12 15:28 . 2012-08-12 15:29 -------- d-----w- c:\program files\AVG Secure Search 2012-08-12 15:25 . 2012-08-15 08:32 -------- d-----w- c:\windows\system32\drivers\AVG 2012-08-12 15:25 . 2012-08-12 15:56 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2012 2012-08-12 15:10 . 2012-08-15 08:33 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData 2012-08-12 15:10 . 2012-08-12 15:10 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files 2012-08-12 08:40 . 2012-08-12 08:40 -------- d-----w- c:\program files\Speccy 2012-08-11 21:24 . 2012-08-11 21:24 -------- d-----w- c:\documents and settings\Harrie\Application Data\SpeedyPC Software 2012-08-11 21:24 . 2012-08-11 21:24 -------- d-----w- c:\documents and settings\Harrie\Application Data\DriverCure 2012-08-11 21:23 . 2012-08-11 21:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SpeedyPC Software 2012-08-11 19:39 . 2012-08-11 19:39 -------- d-----w- c:\program files\Microsoft Silverlight 2012-08-11 18:07 . 2012-08-11 18:07 -------- d-----w- c:\documents and settings\Harrie\Local Settings\Application Data\CRE 2012-08-10 15:04 . 2012-04-22 11:51 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys 2012-08-10 15:04 . 2012-08-10 15:04 -------- d-----w- c:\program files\PC Connectivity Solution 2012-08-09 16:06 . 2012-08-09 16:06 -------- d-sh--w- c:\documents and settings\Administrator\Onlangs geopend 2012-08-09 16:06 . 2012-08-09 16:06 -------- d-----w- c:\documents and settings\Marijke\Local Settings\Application Data\Babylon 2012-08-09 16:06 . 2012-08-09 16:06 -------- d-----w- c:\documents and settings\Marijke\Application Data\Babylon 2012-08-09 16:05 . 2012-08-09 16:05 -------- d-----w- c:\program files\FileZilla FTP Client 2012-08-09 16:05 . 2012-08-09 16:05 -------- d-----w- c:\program files\GIMP-2.0 2012-08-09 16:05 . 2012-08-10 15:32 -------- d-----w- c:\program files\McAfee Security Scan 2012-08-09 16:05 . 2012-08-09 16:05 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan 2012-08-09 16:04 . 2012-08-09 16:04 -------- d-----w- c:\program files\Microsoft Digital Image 2006 2012-08-09 16:04 . 2012-08-09 16:04 -------- d-----w- c:\program files\Winamp Toolbar 2012-08-09 16:04 . 2012-08-09 16:04 -------- d-----w- c:\documents and settings\Harrie\Local Settings\Application Data\Winamp Toolbar 2012-08-09 16:04 . 2012-08-09 16:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Winamp Toolbar 2012-08-09 16:03 . 2012-08-09 16:03 -------- d-----w- c:\documents and settings\Harrie\Application Data\Winamp 2012-08-09 16:03 . 2012-08-09 16:03 -------- d-----w- c:\program files\Winamp Detect 2012-08-09 16:03 . 2012-08-09 16:03 -------- d-----w- c:\program files\ReaSoft 2012-08-09 16:03 . 2012-08-09 16:03 -------- d-----w- c:\documents and settings\Harrie\Application Data\ReaSoft 2012-08-09 16:03 . 2012-08-09 16:03 -------- d-----w- c:\program files\Postbox Express 2012-08-09 16:03 . 2012-08-09 16:03 -------- d-----w- c:\program files\Postbox 2012-08-09 16:02 . 2012-08-09 16:02 -------- d-----w- c:\program files\Samsung 2012-08-09 16:02 . 2012-08-09 16:02 -------- d-----w- c:\program files\Shape Collage 2012-08-09 15:26 . 2012-08-09 15:26 -------- d-----w- c:\windows\system32\wbem\Repository 2012-08-07 20:39 . 2005-04-22 09:14 95232 ----a-w- c:\program files\Common Files\Microsoft Shared\Picture It!\RmvSuite.exe 2012-07-30 17:14 . 2012-07-30 17:14 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-02 17:53 . 2012-04-06 19:07 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-08-02 17:53 . 2011-05-24 13:26 70344 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-07-03 11:46 . 2008-07-31 21:09 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-06-30 13:15 . 2010-03-23 14:54 348160 ----a-w- c:\windows\system32\msvcr71.dll 2012-06-30 13:15 . 2010-03-23 14:54 499712 ----a-w- c:\windows\system32\msvcp71.dll 2012-06-13 13:55 . 2008-06-28 21:28 1866240 ----a-w- c:\windows\system32\win32k.sys 2012-06-05 15:49 . 2008-06-30 11:09 1372672 ----a-w- c:\windows\system32\msxml6.dll 2012-06-05 15:49 . 2004-08-04 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll 2012-06-04 04:32 . 2008-06-28 21:28 152576 ----a-w- c:\windows\system32\schannel.dll 2012-06-02 13:19 . 2008-06-28 21:13 18456 ----a-w- c:\windows\system32\wuaueng.dll.mui 2012-06-02 13:19 . 2008-06-28 21:01 329240 ----a-w- c:\windows\system32\wucltui.dll 2012-06-02 13:19 . 2008-06-28 21:01 210968 ----a-w- c:\windows\system32\wuweb.dll 2012-06-02 13:19 . 2008-06-28 21:01 219160 ----a-w- c:\windows\system32\wuaucpl.cpl 2012-06-02 13:19 . 2008-06-28 21:13 45080 ----a-w- c:\windows\system32\wups2.dll 2012-06-02 13:19 . 2008-06-28 21:01 53784 ----a-w- c:\windows\system32\wuauclt.exe 2012-06-02 13:19 . 2008-06-28 21:01 35864 ----a-w- c:\windows\system32\wups.dll 2012-06-02 13:19 . 2004-08-04 12:00 97304 ----a-w- c:\windows\system32\cdm.dll 2012-06-02 13:19 . 2008-09-03 14:04 15896 ----a-w- c:\windows\system32\wuapi.dll.mui 2012-06-02 13:19 . 2008-06-28 21:13 15896 ----a-w- c:\windows\system32\wuaucpl.cpl.mui 2012-06-02 13:19 . 2008-06-28 21:01 577048 ----a-w- c:\windows\system32\wuapi.dll 2012-06-02 13:19 . 2008-06-28 21:13 24088 ----a-w- c:\windows\system32\wucltui.dll.mui 2012-06-02 13:19 . 2008-06-28 21:01 1933848 ----a-w- c:\windows\system32\wuaueng.dll 2012-06-02 13:19 . 2008-06-28 21:15 18160 ----a-w- c:\windows\system32\mucltui.dll.mui 2012-06-02 13:18 . 2008-06-28 21:15 275696 ----a-w- c:\windows\system32\mucltui.dll 2012-05-31 13:22 . 2004-08-04 12:00 602624 ----a-w- c:\windows\system32\crypt32.dll 2010-10-25 08:01 . 2010-10-25 08:01 2951802 ----a-w- c:\program files\EClea2_0.exe 2002-02-26 16:34 . 2002-09-03 12:19 2000896 -c--a-w- c:\program files\DS_PlugIn.8bf 2007-11-06 23:19 . 2010-10-19 22:40 568832 -c--a-w- c:\program files\opera\program\plugins\msvcp90.dll 2007-11-06 23:19 . 2010-10-19 22:40 655872 -c--a-w- c:\program files\opera\program\plugins\msvcr90.dll 2012-07-10 20:23 . 2011-10-09 18:30 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys [7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\SoftwareDistributionold\Download\2f7964faba1b02d922ef1bc199202cbc\atapi.sys [7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\atapi.sys [-] 2008-04-13 18:40 . F6584BD8E76EFE3FA37397D90F982265 . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys [7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys . . ((((((((((((((((((((((((((((( SnapShot@2012-08-14_19.44.42 ))))))))))))))))))))))))))))))))))))))))) . + 2012-08-15 08:26 . 2012-08-15 08:26 16384 c:\windows\Temp\Perflib_Perfdata_938.dat . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2012-08-12 15:28 2045024 ----a-w- c:\program files\AVG Secure Search\12.2.0.5\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\12.2.0.5\AVG Secure Search_toolbar.dll" [2012-08-12 2045024] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 204288] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-05-24 39408] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2005-08-18 14820864] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-04-18 421888] "PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 406016] "nwiz"="nwiz.exe" [2006-10-22 1622016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NSU_agent"="c:\program files\Nokia\Nokia Software Updater\nsu3ui_agent.exe" [2011-08-11 169264] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-14 221184] "HostManager"="c:\program files\Common Files\AOL\1271854961\ee\AOLSoftware.exe" [2010-02-10 41800] "CmUCRRun"="c:\windows\system32\CmUCReye.exe" [2006-07-12 237568] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280] "AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2011-02-23 611712] "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592] "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008] "vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-08-12 1162848] "ROC_roc_ssl_v12"="c:\program files\AVG Secure Search\ROC_roc_ssl_v12.exe" [2012-08-12 1020512] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] . c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\ McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.229\SSScheduler.exe [2011-9-20 272528] . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^Documents and Settings^Harrie^Menu Start^Programma's^Opstarten^OpenOffice.org 3.3 .lnk] backup=c:\windows\pss\OpenOffice.org 3.3 .lnkStartup . [HKLM\~\startupfolder\C:^Documents and Settings^Harrie^Menu Start^Programma's^Opstarten^Verjaardagskalender Zonnekindpoppen.lnk] backup=c:\windows\pss\Verjaardagskalender Zonnekindpoppen.lnkStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\4shared Desktop] 2011-12-09 12:00 4613624 ----a-w- c:\program files\4shared Desktop\desktop.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\4shared Update] 2011-12-09 12:00 608760 ----a-w- c:\program files\4shared Desktop\checkUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeBridge] 2008-08-28 17:34 13145448 ----a-w- c:\program files\Adobe\Adobe Bridge CS4\Bridge.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] 2008-04-14 17:03 110592 ----a-w- c:\windows\system32\bthprops.cpl . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter] 2010-03-24 17:50 2516296 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx] 2010-04-02 08:18 1185112 ----a-w- c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Family Tree Builder Update] 2011-12-21 15:26 229376 -c--a-w- c:\program files\MyHeritage\Bin\FTBCheckUpdates.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HyvesDesktop.exe] 2010-11-17 09:34 137216 ----a-w- c:\program files\Hyves Desktop\bin\HyvesDesktop.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2012-06-07 17:33 421776 ----a-w- c:\program files\iTunes\iTunesHelper.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] 2012-06-30 13:15 296096 ----a-w- c:\program files\Real\RealPlayer\Update\realsched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe] 2011-04-22 12:21 247728 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] 2011-03-22 18:37 74752 ----a-w- c:\program files\Winamp\winampa.exe . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"=c:\windows\system32\ctfmon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Documents and Settings\\Harrie\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"= "c:\\Documents and Settings\\Harrie\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"= "c:\\Program Files\\deepinvent\\MailStore Home\\MailStoreLocal.exe"= "c:\\Program Files\\Common Files\\aol\\1271854961\\ee\\aolsoftware.exe"= "c:\\Program Files\\Common Files\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"= "c:\\Program Files\\Common Files\\aol\\Loader\\aolload.exe"= "c:\\Program Files\\Common Files\\aol\\System Information\\sinf.exe"= "c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"= "c:\\Program Files\\Windows iLivid Toolbar\\Datamngr\\ToolBar\\dtUser.exe"= "c:\\Documents and Settings\\Ruud\\Application Data\\Dropbox\\bin\\Dropbox.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"= "c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"= "c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"= "c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:Remote Desktop "85:TCP"= 85:TCP:BroadWave Web Server "5353:TCP"= 5353:TCP:Adobe CSI CS4 "4100:UDP"= 4100:UDP:uPNP Router Control Port "86:TCP"= 86:TCP:BroadCam Video Streaming Server Web Server "1935:TCP"= 1935:TCP:BroadCam Video Streaming Server Flash Video Server "65533:TCP"= 65533:TCP:Services "52344:TCP"= 52344:TCP:Services . R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [19-4-2012 4:50 24896] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [31-1-2012 4:46 31952] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [22-2-2012 5:25 235216] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [19-3-2012 5:17 301248] R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [12-8-2012 17:29 27496] R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14-5-2009 15:47 107256] R2 ASTSRV;Nalpeiron Licensing Service;c:\windows\system32\ASTSRV.EXE [26-12-2010 13:58 57344] R2 avgfws;AVG Firewall;c:\program files\AVG\AVG2012\avgfws.exe [13-6-2012 3:48 2321560] R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [14-2-2012 4:53 193288] R2 Dokan;Dokan;c:\windows\system32\drivers\dokan.sys [11-2-2012 22:52 91904] R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [22-4-2011 14:21 92592] R2 vToolbarUpdater12.2.0;vToolbarUpdater12.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.0\ToolbarUpdater.exe [12-8-2012 17:29 927840] R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [12-1-2012 19:52 30944] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [23-12-2011 13:32 139856] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [23-12-2011 13:32 24144] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [23-12-2011 13:32 17232] S0 cvxxed;cvxxed;c:\windows\system32\drivers\ofvhvac.sys --> c:\windows\system32\drivers\ofvhvac.sys [?] S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10-7-2008 18:08 721904] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [4-7-2012 17:25 5160568] S2 DokanMounter;DokanMounter;c:\program files\SpeedyDrive\mounter.exe [11-2-2012 22:52 25088] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [30-6-2010 13:19 136176] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [6-4-2012 21:07 250056] S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [12-1-2012 19:52 30944] S3 CMISTOR;CMIUCR.SYS CM320/CM220 Card Reader Driver;c:\windows\system32\drivers\cmiucr.SYS [5-1-2007 18:21 93056] S3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [30-6-2010 13:19 136176] S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [31-7-2008 23:09 22344] S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.229\McCHSvc.exe [20-9-2011 22:15 237008] S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [6-5-2012 17:49 113120] S3 nwd5aas.sys;nwd5aas.sys;\??\c:\windows\system32\drivers\nwd5aas.sys --> c:\windows\system32\drivers\nwd5aas.sys [?] S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [12-3-2010 23:39 86824] S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [12-3-2010 23:39 15016] S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [12-3-2010 23:39 114600] S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [12-3-2010 23:39 108328] S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [12-3-2010 23:39 104616] S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [12-3-2010 23:39 109736] S4 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14-5-2009 15:47 731840] S4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [31-7-2008 23:09 655944] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Inhoud van de 'Gedeelde Taken' map . 2012-08-15 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 17:53] . 2012-06-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57] . 2012-08-10 c:\windows\Tasks\Easy Onderhoud.job - c:\program files\TuneUp Utilities 2008\OneClick.exe [2008-02-04 07:39] . 2011-11-02 c:\windows\Tasks\expressburnShakeIcon.job - c:\program files\NCH Software\ExpressBurn\expressburn.exe [2011-10-23 20:47] . 2012-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-30 11:19] . 2012-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-30 11:19] . 2012-08-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1770027372-725345543-1004Core.job - c:\documents and settings\Harrie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-22 08:24] . 2012-08-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1770027372-725345543-1004UA.job - c:\documents and settings\Harrie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-22 08:24] . 2012-07-24 c:\windows\Tasks\mixpadShakeIcon.job - c:\program files\NCH Swift Sound\MixPad\mixpad.exe [2011-04-06 12:31] . 2012-01-01 c:\windows\Tasks\photostageShakeIcon.job - c:\program files\NCH Software\PhotoStage\photostage.exe [2011-02-16 08:43] . 2011-12-24 c:\windows\Tasks\pixillionShakeIcon.job - c:\program files\NCH Software\Pixillion\pixillion.exe [2011-06-13 20:57] . 2012-02-07 c:\windows\Tasks\prismShakeIcon.job - c:\program files\NCH Software\Prism\prism.exe [2011-04-06 12:17] . 2012-08-15 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-776561741-1770027372-725345543-1004.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-06-21 10:00] . 2012-08-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-776561741-1770027372-725345543-1004.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-06-21 10:00] . 2012-08-14 c:\windows\Tasks\SyncBack backupMijndokumenten.job - c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2008-12-07 11:00] . 2012-08-15 c:\windows\Tasks\User_Feed_Synchronization-{C2FD9CBF-E149-4384-AFD2-474518755E3E}.job - c:\windows\system32\msfeedssync.exe [2007-08-13 02:31] . 2011-03-19 c:\windows\Tasks\videopadShakeIcon.job - c:\program files\NCH Software\VideoPad\videopad.exe [2011-03-16 12:53] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.com/ IE: &Download All using 4shared Desktop - c:\program files\4shared Desktop\Desktop.32/D_ALL_LINK IE: &Download using 4shared Desktop - c:\program files\4shared Desktop\Desktop.32/D_ONE_LINK IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Download met Mipony - file://c:\program files\MiPony\Browser\IEContext.htm IE: Free YouTube to Mp3 Converter - c:\documents and settings\Harrie\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm TCP: DhcpNameServer = 194.134.5.5 194.134.0.97 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.0\ViProtocol.dll FF - ProfilePath - c:\documents and settings\Harrie\Application Data\Mozilla\Firefox\Profiles\rqv5syvk.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.winamp.com/search/search?query={searchterms}&invocationtype=tb50-ff-winamp-chromesbox-en-us&tb_uuid=20110329141600890&tb_oid=15-12-2010&tb_mrud=03-04-2011&query= FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.search.selectedengine - search the web FF - prefs.js: browser.startup.homepage - hxxp://search.etype.com/?smart=1 FF - prefs.js: keyword.url - hxxp://search.etype.com/?smart=1&query= FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: content.max.tokenizing.time - 200000 FF - user.js: content.notify.interval - 100000 FF - user.js: content.switch.threshold - 650000 FF - user.js: nglayout.initialpaint.delay - 300 FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112470&tt=230512_54x FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.id - 78d34d9f000000000000001f81000830 FF - user.js: extensions.BabylonToolbar_i.hardId - 78d34d9f000000000000001f81000830 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15493 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1716:54 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - base FF - user.js: extensions.BabylonToolbar_i.instlRef - sst . - - - - ORPHANS VERWIJDERD - - - - . Toolbar-Locked - (no file) Toolbar-10 - (no file) WebBrowser-{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) ShellIconOverlayIdentifiers-{2012DE06-50C0-48BD-ACDE-88F95D4CAD1F} - (no file) ShellIconOverlayIdentifiers-{C72C6188-BEF2-46E5-A89A-52F0ED75219E} - (no file) ShellIconOverlayIdentifiers-{C92F6BC2-AF61-4C0E-80E0-939B8282DDB7} - (no file) ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellExecuteHooks-{EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - (no file) SafeBoot-WudfPf SafeBoot-WudfRd AddRemove-Artistic Effects by Lokas Software - c:\windows\AWuninstall.exe Software\Lokas Ltd\Artistic Effects AddRemove-Color Efex Pro 3.0 Complete - k:\harrie\PSP\Filters\Nik color efex pro\Nik Software\Color Efex Pro 3.0 Complete\uninstall.exe AddRemove-EyeCandy5Impact - k:\harrie\PSP\ALIENS~1\EYECAN~1\UNWISE32.EXE AddRemove-Xenofex2 - k:\harrie\PSP\FILTERS\XENOFE~1\UNWISE.EXE . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2012-08-15 10:58 Windows 5.1.2600 Service Pack 3 NTFS . scannen van verborgen processen ... . scannen van verborgen autostart items ... . scannen van verborgen bestanden ... . . c:\documents and settings\Harrie\Application Data\Mozilla\Firefox\Profiles\rqv5syvk.default\pluginreg.dat.bak 27498 bytes c:\documents and settings\Harrie\Application Data\Mozilla\Firefox\Profiles\rqv5syvk.default\user.js.BAK . Scan succesvol afgerond verborgen bestanden: 2 . ************************************************************************** . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,34,9b,eb,66,29,84,e5,48,bc,72,33,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,34,9b,eb,66,29,84,e5,48,bc,72,33,\ . [HKEY_USERS\S-1-5-21-776561741-1770027372-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{379B6AB7-0432-49DE-7392-2AFD86EB5275}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "ianpmkgmmdhiadjibi"=hex:6a,61,6a,65,6f,64,62,6c,6c,65,6b,6a,6c,64,6b,69,62,65, 6f,6a,00,00 "hahaoeobmdlfmhhj"=hex:6a,61,6d,65,66,68,6b,62,62,6d,6d,6a,62,6a,70,61,64,67, 6f,66,00,dd . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{2b5d67da-bd57-43c5-96c3-12aa7e42fcd0}] @Denied: (Full) (Everyone) "Model"=dword:0000010a "Therad"=dword:0000001e "MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26, 38,95,44,29,53,01,52,53,ee,8c,54,e6,4f,ed,aa,17,b0,0f,3f,83,e0,8b,c5,07,bb,\ . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}] @Denied: (Full) (Everyone) "scansk"=hex(0):30,9d,a2,76,9e,d7,eb,f5,7b,b1,3e,de,31,7b,f3,68,18,1c,b9,f2,48, 49,db,39,fa,ee,26,c1,ac,bd,ee,ae,1d,98,4a,08,52,5c,75,fd,00,00,00,00,00,00,\ . [HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info] @Denied: (2) (LocalSystem) "AppDataDir"="c:\\Documents and Settings\\All Users\\Application Data\\ESET\\ESET Smart Security\\" "DataDir"="ESET\\ESET Smart Security\\" "EditionName"=" " "InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\" "LanguageId"=dword:00000413 "PackageTag"=dword:6090e758 "ProductBase"=dword:00000001 "ProductCode"="{B05C29C5-C9A4-45C4-A8E9-F8385E3D5B45}" "ProductName"="ESET Smart Security" "ProductType"="ess" "ProductVersion"="4.0.437.0" "UniqueId"="00B304BC4BC4B6BB" "ScannerBuild"=dword:00001329 "ScannerVersionId"=dword:00000feb "ScannerVersion"="Open window for status." "FixId"=dword:00000009 "ei2"=hex(:36,83,0a,0f,5f,19,36,8e "ei1"=hex(:00,13,d3,b6,a7,44,00,00 "ei3"=hex(:91,0c,e0,4d,00,00,00,00 "ei4"=dword:00000005 . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–}|ÿÿÿÿÀ•}|ù•9~*] "3140710900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" . --------------------- DLLs Geladen Onder Lopende Processen --------------------- . - - - - - - - > 'explorer.exe'(2616) c:\progra~1\WINDOW~2\wmpband.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll . Voltooingstijd: 2012-08-15 11:05:35 ComboFix-quarantined-files.txt 2012-08-15 09:05 ComboFix2.txt 2008-07-27 13:39 . Pre-Run: 12.014.604.288 bytes beschikbaar Post-Run: 11.986.657.280 bytes beschikbaar . - - End Of File - - A50811297AAB08E49E46B986C325A264

Malwarebytes Anti-Malware (-evaluatieversie-) 1.62.0.1300 www.malwarebytes.org Databaseversie: v2012.08.13.05 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Harrie :: GEZIN [administrator] Realtime bescherming: Ingeschakeld 13-8-2012 19:12 mbam-log-2012-08-13 (19-12-07).txt Scantype: Snelle scan Ingeschakelde scanopties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM Uitgeschakelde scanopties: P2P Objecten gescand: 326265 Verstreken tijd: 41 minuut/minuten, 52 seconde(n) Geheugenprocessen gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Geheugenmodulen gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Registersleutels gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Registerwaarden gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Registerdata gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Mappen gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Bestanden gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) (einde) =================================================== Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 20:52, on 13-8-2012 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\WINDOWS\system32\ASTSRV.EXE C:\Program Files\AVG\AVG2012\avgfws.exe C:\Program Files\AVG\AVG2012\avgwdsvc.exe C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe c:\Program Files\SpeedyDrive\mounter.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\AVG\AVG2012\avgnsx.exe C:\Program Files\AVG\AVG2012\avgrsx.exe C:\Program Files\AVG\AVG2012\avgcsrvx.exe C:\Program Files\AVG\AVG2012\avgemcx.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PSIService.exe c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.0\ToolbarUpdater.exe C:\Program Files\AVG\AVG2012\avgidsagent.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Nokia\Nokia Software Updater\nsu3ui_agent.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Common Files\AOL\1271854961\ee\AOLSoftware.exe C:\WINDOWS\system32\CmUCReye.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\AVG\AVG2012\avgtray.exe C:\Program Files\AVG Secure Search\vprot.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AVG\AVG2012\avgcsrvx.exe C:\Program Files\McAfee Security Scan\3.0.229\SSScheduler.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\AVG Secure Search\ScriptHelperInstaller\12.2.0\ScriptHelper.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll O2 - BHO: AVG Do Not Track - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2k0.dll O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\12.2.0.5\AVG Secure Search_toolbar.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O3 - Toolbar: (no name) - !{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - (no file) O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\12.2.0.5\AVG Secure Search_toolbar.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NSU_agent] "C:\Program Files\Nokia\Nokia Software Updater\nsu3ui_agent.exe" O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1271854961\ee\AOLSoftware.exe O4 - HKLM\..\Run: [CmUCRRun] C:\WINDOWS\system32\CmUCReye.exe O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe" O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" O4 - HKLM\..\Run: [ROC_roc_ssl_v12] "C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12 O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Harrie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.0.229\SSScheduler.exe O8 - Extra context menu item: &Download All using 4shared Desktop - res://C:\Program Files\4shared Desktop\Desktop.32/D_ALL_LINK O8 - Extra context menu item: &Download using 4shared Desktop - res://C:\Program Files\4shared Desktop\Desktop.32/D_ONE_LINK O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Download met Mipony -Files\MiPony\Browser\IEContext.htm O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\Harrie\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Skype\toolbars\Shared\Skype4ComAPI.dll O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.0\ViProtocol.dll O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Nalpeiron Licensing Service (ASTSRV) - Nalpeiron Ltd. - C:\WINDOWS\system32\ASTSRV.EXE O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgfws.exe O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgidsagent.exe O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe O23 - Service: DokanMounter - Unknown owner - c:\Program Files\SpeedyDrive\mounter.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.0.229\McCHSvc.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe O23 - Service: vToolbarUpdater12.2.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.0\ToolbarUpdater.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe -- End of file - 14375 bytes ============================================================ klopt het dat 2 van de 4 toolbars niet verwijderd zijn?

Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 20:38, on 12-8-2012 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Nokia\Nokia Software Updater\nsu3ui_agent.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Common Files\AOL\1271854961\ee\AOLSoftware.exe C:\WINDOWS\system32\CmUCReye.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\AVG\AVG2012\avgtray.exe C:\Program Files\AVG Secure Search\vprot.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\McAfee Security Scan\3.0.229\SSScheduler.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\WINDOWS\system32\ASTSRV.EXE C:\Program Files\AVG\AVG2012\avgfws.exe C:\Program Files\AVG\AVG2012\avgwdsvc.exe C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe c:\Program Files\SpeedyDrive\mounter.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\AVG\AVG2012\avgnsx.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\AVG\AVG2012\avgemcx.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\AVG\AVG2012\avgrsx.exe C:\Program Files\AVG\AVG2012\avgcsrvx.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PSIService.exe c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.0\ToolbarUpdater.exe C:\Program Files\AVG\AVG2012\avgidsagent.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\AVG Secure Search\ScriptHelperInstaller\12.2.0\ScriptHelper.exe C:\Program Files\AVG\AVG2012\avgcsrvx.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll O2 - BHO: AVG Do Not Track - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2k0.dll O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\12.2.0.5\AVG Secure Search_toolbar.dll O2 - BHO: (no name) - {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: (no name) - {ABA5418C-8F9F-2826-E87F-F8DD26E8699D} - (no file) O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: (no name) - {d0230100-3044-43b1-a44e-70dc12fd418c} - (no file) O3 - Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O3 - Toolbar: (no name) - !{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - (no file) O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\12.2.0.5\AVG Secure Search_toolbar.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NSU_agent] "C:\Program Files\Nokia\Nokia Software Updater\nsu3ui_agent.exe" O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1271854961\ee\AOLSoftware.exe O4 - HKLM\..\Run: [CmUCRRun] C:\WINDOWS\system32\CmUCReye.exe O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe" O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" O4 - HKLM\..\Run: [ROC_roc_ssl_v12] "C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12 O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Harrie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.0.229\SSScheduler.exe O8 - Extra context menu item: &Download All using 4shared Desktop - res://C:\Program Files\4shared Desktop\Desktop.32/D_ALL_LINK O8 - Extra context menu item: &Download using 4shared Desktop - res://C:\Program Files\4shared Desktop\Desktop.32/D_ONE_LINK O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Download met Mipony - Files\MiPony\Browser\IEContext.htm O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\Harrie\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} - O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} (CSEQueryObject Object) - O16 - DPF: {63D6DD13-C913-466D-9444-9357561E4D94} (upload toepassing Control) - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Skype\toolbars\Shared\Skype4ComAPI.dll O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.0\ViProtocol.dll O20 - AppInit_DLLs: protector.dll O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Nalpeiron Licensing Service (ASTSRV) - Nalpeiron Ltd. - C:\WINDOWS\system32\ASTSRV.EXE O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgfws.exe O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgidsagent.exe O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe O23 - Service: DokanMounter - Unknown owner - c:\Program Files\SpeedyDrive\mounter.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.0.229\McCHSvc.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe O23 - Service: vToolbarUpdater12.2.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.0\ToolbarUpdater.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe -- End of file - 17109 bytes

Bij het starten van mijn pc kreeg ik ineens een blauw scherm met een fysieke geheugendump. Aanleiding was waarschijnlijk een virus. Opnieuw gestart in veilige modus en maar kon de virusscanner niet meer draaien op de pc. Spybot S&D gedraaid en die heeft er aardig wat threats afgegooid. Wonderwel kon ik hem starten in foutopsporingsmodus.(met internet)Eset gaf aan fout bij het communiseren met kernel. Toen de online scanner van eset gedraaid. Ook Ccleaner gedraaid. Kan hem nog steeds niet normaal opstarten en wanneer ik pc opstart met cd dan geeft hij aan dat dmio.sys beschadigd is. Dus vraag me af of hij echt schoon is en vooral hoe kan ik hem weer normaal starten? Wat zijn de te nemen stappen om mijn pc weer toppie te krijgen?