amosa

ja internet explorer

daar vraag je mij helemaal vast

ja ,ik klik de link aan, dan next en dan komt er staan plaise wait, maar toen ik terug van werk kwam was er nog niets gebeurd, nog steeds plaise wait

hoofdzakelijk bij mail en surfen, maar ik heb ook een kweekprogramma zooeasy als je dat kent, en dat doet ook wel moeilijk... heb vandaag de pc gans de dag op laten staan terwijl ik werken was, en op moment gaat het precies wel even beter.

heb de op de link geklikt, verder dan next geraak ik niet

C:\WINDOWS\Prefetech C:\Program files\findy kill

Dit is weer een avondvullend programma geweest om dit gepost te krijgen Groeten............ ----------------- FindyKill V4.005 ------------------ * User : Paula - PAULA-3F0C268A7 * Emplacement : C:\Program Files\FindyKill * Outils Mis a jours le 17/10/08 par Chiquitine29 * Suppression effectuée à 21:54:07 le zo 08/08/2010 * Windows XP - Internet Explorer 7.0.5730.13 ((((((((((((((( *** Suppression *** )))))))))))))))))) --------------- [ Processus actifs ] ---------------- C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Security Essentials\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\userinit.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wbem\wmiprvse.exe --------------- [ Fichiers/Dossiers infectieux ] ---------------- »»»» Suppression des fichiers dans C: »»»» Suppression des fichiers dans C:\WINDOWS »»»» Suppression des fichiers dans C:\WINDOWS\Prefetch Supprimé ! - C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf Supprimé ! - C:\WINDOWS\Prefetch\DW20.EXE-22C39A55.pf Supprimé ! - C:\WINDOWS\Prefetch\WINTEMS.EXE-26D98C75.pf »»»» Suppression des fichiers dans C:\WINDOWS\system32 »»»» Suppression des fichiers dans C:\WINDOWS\system32\drivers »»»» Suppression des fichiers dans C:\Documents and Settings\Paula\Application Data »»»» Suppression des fichiers dans C:\DOCUME~1\Paula\LOCALS~1\Temp --------------- [ Registre / Clés infectieuses ] ---------------- Supprimé ! - HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA -> Certaines clés ont été supprimées au premier reboot ... --------------- [ Etat / Redémarage des services ] ---------------- +- Mode sans echec restauré ! +- Services : [ Auto=2 Demande=3 Désactivé=4 ] Ndisuio - Type de démarrage = 2 EapHost - Type de démarrage = 2 Wlansvc - Type de démarrage = 2 Ip6Fw - Type de démarrage = 2 SharedAccess - Type de démarrage = 2 wuauserv - Type de démarrage = 2 wscsvc - Type de démarrage = 2 --------------- [ Nettoyage des supports amovibles ] ---------------- +- Informations : C: - vast station D: - vast station +- Suppression des fichiers : --------------- [ Registre / Moutpoint2 ] ---------------- -> Recherche négative. --------------- [ Recherche Cracks / Keygen ] ---------------- ---------------- ! Fin du rapport ! ------------------

----------------- FindyKill V4.005 ------------------ * User : Paula - PAULA-3F0C268A7 * Emplacement : C:\Program Files\FindyKill * Outils Mis a jours le 17/10/08 par Chiquitine29 * Recherche effectuée à 10:16:55 le zo 08/08/2010 * Windows XP - Internet Explorer 7.0.5730.13 ((((((((((((((((( *** Recherche *** )))))))))))))))))) --------------- [ Processus actifs ] ---------------- C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Security Essentials\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft Security Essentials\msseces.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\internet explorer\iexplore.exe --------------- [ Fichiers/Dossiers infectieux ] ---------------- »»»» Presence des fichiers dans C: »»»» Presence des fichiers dans C:\WINDOWS »»»» Presence des fichiers dans C:\WINDOWS\Prefetch Present ! - C:\WINDOWS\Prefetch\AM_DELTA_PATCH1.EXE-1E34A3CB.pf Present ! - C:\WINDOWS\Prefetch\AM_DELTA_PATCH2.EXE-1B96EA75.pf »»»» Presence des fichiers dans C:\WINDOWS\system32 »»»» Presence des fichiers dans C:\WINDOWS\system32\drivers »»»» Presence des fichiers dans C:\Documents and Settings\Paula\Application Data »»»» Presence des fichiers dans C:\DOCUME~1\Paula\LOCALS~1\Temp --------------- [ Registre / Startup ] ---------------- ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run MSSE REG_SZ "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey SunJavaUpdateSched REG_SZ "C:\Program Files\Common Files\Java\Java Update\jusched.exe" Adobe ARM REG_SZ "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" TkBellExe REG_SZ "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot EOUApp REG_SZ "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" IntelWireless REG_SZ "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless IntelZeroConfig REG_SZ "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" AGRSMMSG REG_SZ AGRSMMSG.exe RTHDCPL REG_SZ RTHDCPL.EXE AzMixerSel REG_SZ "C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents ! REG.EXE VERSION 3.0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe --------------- [ Registre / Clés infectieuses ] ---------------- --------------- [ Etat / Services ] ---------------- +- Services : [ Auto=2 Demande=3 Désactivé=4 ] Ndisuio - Type de démarrage = 3 EapHost - Type de démarrage = 3 Ip6Fw - Type de démarrage = 3 SharedAccess - Type de démarrage = 2 wuauserv - Type de démarrage = 2 wscsvc - Type de démarrage = 2 --------------- [ Recherche dans supports amovibles] ---------------- +- Informations : C: - vast station D: - vast station +- presence des fichiers : --------------- [ Registre / Moutpoint2 ] ---------------- -> Recherche négative. ------------------- ! Fin du rapport ! -------------------- KON LINK NIET DOWNLOADEN, HEB ZELF GEZOCHT, IS IN HET FRANS, EN DIE TAAL BEN IK NIET HELEMAAL MEESTER. ZODOENDE WEET IK NIET OF IK GOED GEDAAN HEB. VOOR DEZE AKTIE WAS HET NOG EEN RAMP, ALLES GAAT OPEN EN TOE GELIJK HET ZIN HEEFT, EN DAN VAST, EN ALLES AAN EEN SLAKKEN TEMPO, AFWACHTEN DUS GROETEN

Ja, het blijft zenuwslopend traag gaag, wat kan ik eventueel verwijderen om de snelheid een beetje te normaliseren? groetjes

ComboFix 10-08-06.03 - Paula 07/08/2010 13:51:04.4.2 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.502.189 [GMT 2:00] Gestart vanuit: c:\documents and settings\Paula\Bureaublad\ComboFix.exe AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF} . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Menu Start\Programma's\Microsoft Security Essentials.lnk . (((((((((((((((((((( Bestanden Gemaakt van 2010-07-07 to 2010-08-07 )))))))))))))))))))))))))))))) . 2010-08-06 11:57 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-08-06 11:57 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-08-06 11:57 . 2010-08-06 11:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-06 04:45 . 2010-08-06 04:45 -------- d-----w- c:\program files\TrendMicro 2010-08-05 20:30 . 2010-08-06 05:25 -------- d--h--r- c:\documents and settings\Paula\Onlangs geopend 2010-07-14 16:10 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-06 17:06 . 2010-08-06 17:06 452104 ----a-w- c:\documents and settings\Paula\Application Data\Real\Update\setup3.12\setup.exe 2010-08-06 05:48 . 2009-04-17 14:38 -------- d-----w- c:\program files\ZooEasy v8 2010-08-06 04:45 . 2010-08-06 04:45 388096 ----a-r- c:\documents and settings\Paula\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe 2010-08-03 22:26 . 2010-08-03 22:26 503808 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-476ab2d6-n\msvcp71.dll 2010-08-03 22:26 . 2010-08-03 22:26 499712 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-476ab2d6-n\jmc.dll 2010-08-03 22:26 . 2010-08-03 22:26 348160 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-476ab2d6-n\msvcr71.dll 2010-08-03 22:26 . 2010-08-03 22:26 61440 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4587dfd7-n\decora-sse.dll 2010-08-03 22:26 . 2010-08-03 22:26 12800 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4587dfd7-n\decora-d3d.dll 2010-08-03 22:26 . 2008-04-13 14:52 664 ----a-w- c:\windows\system32\d3d9caps.dat 2010-08-02 20:00 . 2009-07-29 19:16 -------- d-----w- c:\documents and settings\All Users\Application Data\CanonIJPLM 2010-07-26 11:10 . 2006-03-02 12:00 546352 ----a-w- c:\windows\system32\perfh013.dat 2010-07-26 11:10 . 2006-03-02 12:00 105286 ----a-w- c:\windows\system32\perfc013.dat 2010-07-25 13:23 . 2010-04-01 15:16 -------- d-----w- c:\program files\CCleaner 2010-06-29 16:17 . 2010-06-26 13:31 -------- d-----w- c:\program files\Microsoft Security Essentials 2010-06-23 20:16 . 2010-03-31 17:40 439816 ----a-w- c:\documents and settings\Paula\Application Data\Real\Update\setup3.10\setup.exe 2010-06-22 20:04 . 2010-06-22 20:04 501936 ----a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb11.tmp.exe 2010-06-20 10:05 . 2009-11-06 15:48 -------- d-----w- c:\documents and settings\All Users\Application Data\CanonIJ 2010-06-14 14:31 . 2008-01-15 20:08 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe 2010-06-07 19:03 . 2008-01-17 18:56 54968 ----a-w- c:\documents and settings\Paula\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-06-06 20:42 . 2010-06-06 20:42 1956656 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe 2010-06-03 02:41 . 2010-06-03 02:41 3600384 ----a-w- c:\windows\system32\GPhotos.scr 2010-06-01 17:37 . 2009-10-07 14:37 221568 ------w- c:\windows\system32\MpSigStub.exe 2010-05-24 12:17 . 2010-05-24 12:17 503808 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-689f0896-n\msvcp71.dll 2010-05-24 12:17 . 2010-05-24 12:17 499712 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-689f0896-n\jmc.dll 2010-05-24 12:17 . 2010-05-24 12:17 348160 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-689f0896-n\msvcr71.dll 2010-05-24 12:17 . 2010-05-24 12:17 12800 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7ef424cc-n\decora-d3d.dll 2010-05-24 12:17 . 2010-05-24 12:17 61440 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7ef424cc-n\decora-sse.dll 2010-05-24 12:17 . 2010-05-24 12:17 411368 ----a-w- c:\windows\system32\deployJava1.dll 2010-05-18 15:43 . 2010-05-18 15:43 61440 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-2e97675f-n\decora-sse.dll 2010-05-18 15:43 . 2010-05-18 15:43 12800 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-2e97675f-n\decora-d3d.dll 2010-05-18 15:43 . 2010-05-18 15:43 503808 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1c78307c-n\msvcp71.dll 2010-05-18 15:43 . 2010-05-18 15:43 499712 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1c78307c-n\jmc.dll 2010-05-18 15:43 . 2010-05-18 15:43 348160 ----a-w- c:\documents and settings\Paula\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1c78307c-n\msvcr71.dll 2009-11-11 15:40 . 2009-11-11 15:40 14290 ----a-w- c:\program files\settings.dat . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-19 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-06-01 1093208] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-19 198160] "EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [2005-11-28 569413] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182] "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718] "AGRSMMSG"="AGRSMMSG.exe" [2005-12-12 88204] "RTHDCPL"="RTHDCPL.EXE" [2006-04-17 16143872] "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-08-25 53248] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160] c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\ Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= S1 ctredrv.sys;ctredrv.sys;\??\c:\windows\system32\drivers\ctredrv.sys --> c:\windows\system32\drivers\ctredrv.sys [?] S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [19/10/2009 22:27 133104] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] getPlusHelper REG_MULTI_SZ getPlusHelper . Inhoud van de 'Gedeelde Taken' map 2010-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-10-19 20:27] 2010-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-10-19 20:27] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.be/ uDefault_Search_URL = hxxp://www.google.com/ie uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.6.4/GarminAxControl.CAB DPF: {DAF94F73-2AA6-44D8-A562-A28831820D34} - hxxp://nl.pixum.be/apps/EasyUploadX.cab DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - hxxps://asp.photoprintit.de/microsite/1386/defaults/activex/ImageUploader3.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2010-08-07 14:00 Windows 5.1.2600 Service Pack 3 NTFS scannen van verborgen processen ... scannen van verborgen autostart items ... scannen van verborgen bestanden ... Scan succesvol afgerond verborgen bestanden: 0 ************************************************************************** . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*] "3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–}|ÿÿÿÿÀ•}|ù•9~*] "3140710900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" . Voltooingstijd: 2010-08-07 14:07:00 ComboFix-quarantined-files.txt 2010-08-07 12:06 Pre-Run: 16.061.431.808 bytes beschikbaar Post-Run: 16.167.583.744 bytes beschikbaar - - End Of File - - 1C60EA0E7EE56DA276C27BDF0F04E91A zal afwachten wat resultaat is,

Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Databaseversie: 4397 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 6/08/2010 16:51:59 mbam-log-2010-08-06 (16-51-59).txt Scantype: Volledige scan (C:\|D:\|) Objecten gescand: 194739 Verstreken tijd: 1 uur/uren, 45 minuut/minuten, 14 seconde(n) Geheugenprocessen geïnfecteerd: 0 Geheugenmodulen geïnfecteerd: 0 Registersleutels geïnfecteerd: 1 Registerwaarden geïnfecteerd: 0 Registerdata geïnfecteerd: 0 Mappen geïnfecteerd: 0 Bestanden geïnfecteerd: 0 Geheugenprocessen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Geheugenmodulen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registersleutels geïnfecteerd: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\Adparatus (Adware.Adparatus) -> Quarantined and deleted successfully. Registerwaarden geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registerdata geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Mappen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Bestanden geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) ben ondertussen een dag verder, een mail sturen of openen lijkt een dagtaak te worden, zo traag. Op internet gaan is een nachtmerrie eer iets opent. Mijn laptop is bijna 4jaar, dagelijks gebruikt, zou het kunnen dat hij te oud is, het is een Q-FORCE.......zo ja wat is op dit moment aangewezen om te kopen, dagelijks gebruik hoofdzakelijk voor het samenstellen van trips, met al wat er bij hoort, en mailen . Mijn internet is de standaard van belgacom. Alle tips welkom...............dank je .......Amosa

oeps toch gelukt Logfile of Trend Micro HijackThis v2.0.3 (BETA) Scan saved at 7:25:29, on 6/08/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.17055) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Security Essentials\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Microsoft Security Essentials\msseces.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\WINDOWS\AGRSMMSG.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\WINDOWS\msagent\AgentSvr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe C:\WINDOWS\system32\SearchProtocolHost.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Acronis Popup Blocker - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - (no file) O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [MSSE] "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AzMixerSel] "C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: Garmin Communicator Plug-In - https://my.garmin.com/static/m/cab/2.6.4/GarminAxControl.CAB O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://belgacom.extrafilm.be/ImageUploader5.cab O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://download.autodesk.com/esd/mapguide/SP1/ENG/mgaxctrl.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1254927666234 O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {DAF94F73-2AA6-44D8-A562-A28831820D34} (Pixum EasyUploadX Control) - http://nl.pixum.be/apps/EasyUploadX.cab O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - https://asp.photoprintit.de/microsite/1386/defaults/activex/ImageUploader3.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Inkjet Printer/Scanner Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- End of file - 9014 bytes

krijg het logje niet geselecteerd, noch gekopiëerd met CTRL A ,CTRL C

heb vandaag via een mail die heel erg prive leek trojan binnen gekregen. op naam van een vriendin, die zo bleek later helemaal niets verstuurd had. Moest eerst zogezegd inloggen, e, toen kreeg ik argwaan en heb alles verwijderd, later kreeg ik een sms van een andere vriendin die vroeg hoe ze mijn mail verder moest afwerken. Ik had helemaal geen mail gestuurd. Toen het ik onmiddelijk een volledige scan door mikrosoft essenciels gedaan en die vonden trojan, daarna heb ik ccleaner nog laten opschonen. Is dat voldoende of wat dien ik nog te doen? komen er soms ook via maps virtueel virussen mee, ik gebruik dat nog al veel, en moet heel dikwijs volledig scannen en opschonen om nog een beetje snelheid te halen met de pc. Wie weet raad,? groetjes amosa

bedankt, de uitleg was zeer nuttig voor mij

heb onlangs registry laten scannen en die geeft meer dan 800 fouten, hij herstelt er 15 en dan moet je aankopen, wie kan mij hier raad over geven.

wil je even laten weten dat de snelheid terug is, ik heb nog zoveel als mogelijk verwijderd, en hij doet het prima, had even te vroeg op gesloten gedrukt, bij deze merci en tot de volgende

ja ik had dat toch zo , maar het ging niet, daarna heb ik de zoekfunktie gebruikt om te zoeken waar alles juist zat, rechs geklikt en verwijderd, één bestand en drie maal tekst. dat is nu allemaal weg. ga nog enkele dagen afwachten wat de snelheid betreft, en laat je dan weten of het ok is.

dan ga ik het zo eens enkele dagen proberen, en laat wel weten hoe het gaat. ps. start uitvoeren ...combofix uninstall lukte niet. alvast mercikes hé

heb dan toch het logje van hijack vastgekregen, laat het eerst zien en als ik dan nog moet doen wat boven vermeld, laat me maar weten, alvast bedankt voor het geduld Logfile of Trend Micro HijackThis v2.0.3 (BETA) Scan saved at 21:15:48, on 2/03/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16981) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Security Essentials\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Microsoft Security Essentials\msseces.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe C:\WINDOWS\system32\SearchProtocolHost.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [AzMixerSel] "C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [MSSE] "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: Garmin Communicator Plug-In - https://my.garmin.com/static/m/cab/2.6.4/GarminAxControl.CAB O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://belgacom.extrafilm.be/ImageUploader5.cab O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://download.autodesk.com/esd/mapguide/SP1/ENG/mgaxctrl.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1254927666234 O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {DAF94F73-2AA6-44D8-A562-A28831820D34} (Pixum EasyUploadX Control) - http://nl.pixum.be/apps/EasyUploadX.cab O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - https://asp.photoprintit.de/microsite/1386/defaults/activex/ImageUploader3.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Inkjet Printer/Scanner Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- End of file - 8726 bytes

wat moet ik dan doen, de laptop gaat wel sneller als eerst maar in vermoed dat we nog niet afgewerkt zijn:-)

dit is een pr. screen van info on selected item (hijack)

heb HJ verwijderd en opnieuw geinstalleerd en het stopt na scan weer op fix checked, krijg geen logje

ComboFix 10-03-01.01 - Paula 01/03/2010 19:52:01.3.2 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.502.318 [GMT 1:00] Gestart vanuit: c:\documents and settings\Paula\Bureaublad\ComboFix.exe gebruikte Opdracht switches :: c:\documents and settings\Paula\Bureaublad\CFScript.txt AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF} FILE :: "c:\windows\system32\browserchoice.exe" . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\browserchoice.exe . (((((((((((((((((((( Bestanden Gemaakt van 2010-02-01 to 2010-03-01 )))))))))))))))))))))))))))))) . 2010-02-20 18:19 . 2010-02-20 18:19 -------- d-----w- c:\documents and settings\Paula\Local Settings\Application Data\kompozer.net 2010-02-20 18:19 . 2010-02-20 18:19 -------- d-----w- c:\documents and settings\Paula\Application Data\kompozer.net 2010-02-20 18:11 . 2010-02-20 18:11 -------- d-----w- c:\documents and settings\Paula\Application Data\KompoZer . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-24 08:16 . 2009-10-07 14:37 181632 ------w- c:\windows\system32\MpSigStub.exe 2010-02-21 15:20 . 2009-04-17 14:38 -------- d-----w- c:\program files\ZooEasy v8 2010-02-13 15:49 . 2008-04-13 14:52 664 ----a-w- c:\windows\system32\d3d9caps.dat 2010-02-09 19:52 . 2008-02-22 13:09 -------- d-----w- c:\program files\Google 2010-02-01 17:57 . 2009-07-29 19:16 -------- d-----w- c:\documents and settings\All Users\Application Data\CanonIJPLM 2010-02-01 06:48 . 2008-01-17 18:56 54576 ----a-w- c:\documents and settings\Paula\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-01-26 14:56 . 2008-01-21 18:22 -------- d-----w- c:\program files\Common Files\Adobe 2010-01-20 17:32 . 2009-01-30 18:28 -------- d-----w- c:\program files\Microsoft Silverlight 2010-01-17 13:37 . 2008-03-17 19:37 -------- d-----w- c:\documents and settings\Paula\Application Data\CyberLink 2010-01-17 13:37 . 2010-01-17 13:37 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink 2010-01-17 13:33 . 2008-03-17 19:29 -------- d-----w- c:\program files\CyberLink 2010-01-17 13:32 . 2008-01-15 20:19 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-01-15 19:07 . 2010-01-15 19:06 -------- d-----w- c:\program files\Microsoft Security Essentials 2010-01-15 13:26 . 2010-01-15 13:26 -------- d-----w- c:\program files\CCleaner 2010-01-15 13:24 . 2009-11-18 14:44 -------- d-----w- c:\program files\LimeWire 2010-01-15 13:24 . 2010-01-10 18:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-01-15 12:21 . 2006-03-02 12:00 542400 ----a-w- c:\windows\system32\perfh013.dat 2010-01-15 12:21 . 2006-03-02 12:00 103678 ----a-w- c:\windows\system32\perfc013.dat 2010-01-12 21:36 . 2010-01-12 21:36 388096 ----a-r- c:\documents and settings\Paula\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe 2010-01-10 18:39 . 2010-01-10 18:39 -------- d-----w- c:\program files\TrendMicro 2010-01-07 15:07 . 2009-12-26 21:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-07 15:07 . 2009-12-26 21:38 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-01-05 09:59 . 2006-03-02 12:00 832512 ------w- c:\windows\system32\wininet.dll 2010-01-05 09:59 . 2006-03-02 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-01-05 09:59 . 2006-03-02 12:00 17408 ------w- c:\windows\system32\corpol.dll 2010-01-01 14:38 . 2008-03-08 20:54 -------- d-----w- c:\documents and settings\Paula\Application Data\LimeWire 2009-12-31 16:50 . 2006-03-02 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys 2009-12-17 07:42 . 2008-01-15 20:06 345600 ----a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:10 . 2006-03-02 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll 2009-12-09 10:11 . 2006-03-02 12:00 2149888 ------w- c:\windows\system32\ntoskrnl.exe 2009-12-09 10:11 . 2004-08-04 00:58 2028544 ------w- c:\windows\system32\ntkrnlpa.exe 2009-12-04 18:22 . 2006-03-02 12:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2009-11-11 15:40 . 2009-11-11 15:40 14290 ----a-w- c:\program files\settings.dat . ((((((((((((((((((((((((((((( SnapShot_2010-02-28_17.12.05 ))))))))))))))))))))))))))))))))))))))))) . - 2010-02-28 16:37 . 2010-02-28 16:37 16384 c:\windows\Temp\Perflib_Perfdata_760.dat + 2010-03-01 18:31 . 2010-03-01 18:31 16384 c:\windows\Temp\Perflib_Perfdata_760.dat + 2010-02-28 17:34 . 2010-03-01 07:00 27136 c:\windows\Installer\{90170413-6000-11D3-8CFE-0150048383C9}\oisicon.exe + 2010-02-28 17:34 . 2010-03-01 07:00 12288 c:\windows\Installer\{90170413-6000-11D3-8CFE-0150048383C9}\cagicon.exe + 2003-07-15 06:29 . 2003-07-15 06:29 51808 c:\windows\Installer\$PatchCache$\Managed\3140710900063D11C8EF10054038389C\11.0.5614\MICROSOFT_OFFICE_FP_WFCHOST.DLL + 2010-02-28 17:34 . 2010-03-01 07:00 4096 c:\windows\Installer\{90170413-6000-11D3-8CFE-0150048383C9}\opwicon.exe + 2010-02-28 17:34 . 2010-03-01 07:00 135168 c:\windows\Installer\{90170413-6000-11D3-8CFE-0150048383C9}\misc.exe + 2010-02-28 17:34 . 2010-03-01 07:00 282624 c:\windows\Installer\{90170413-6000-11D3-8CFE-0150048383C9}\fpicon.exe + 2003-07-15 06:37 . 2003-07-15 06:37 736824 c:\windows\Installer\$PatchCache$\Managed\3140710900063D11C8EF10054038389C\11.0.5614\VTIPRES.EXE + 2003-07-15 06:33 . 2003-07-15 06:33 177720 c:\windows\Installer\$PatchCache$\Managed\3140710900063D11C8EF10054038389C\11.0.5614\VTIFORM.EXE + 2003-07-15 06:34 . 2003-07-15 06:34 587832 c:\windows\Installer\$PatchCache$\Managed\3140710900063D11C8EF10054038389C\11.0.5614\VTIDISC.EXE + 2003-07-15 06:36 . 2003-07-15 06:36 307256 c:\windows\Installer\$PatchCache$\Managed\3140710900063D11C8EF10054038389C\11.0.5614\VTIDB.EXE + 2003-07-15 06:34 . 2003-07-15 06:34 675904 c:\windows\Installer\$PatchCache$\Managed\3140710900063D11C8EF10054038389C\11.0.5614\MSIMPORT.EXE + 2003-05-30 17:51 . 2003-05-30 17:51 417792 c:\windows\Installer\$PatchCache$\Managed\3140710900063D11C8EF10054038389C\11.0.5614\LFCMP13N.DLL + 2003-07-15 06:29 . 2003-07-15 06:29 117824 c:\windows\Installer\$PatchCache$\Managed\3140710900063D11C8EF10054038389C\11.0.5614\HTMLCHKR.DLL + 2003-07-24 06:00 . 2003-07-24 06:00 694840 c:\windows\Installer\$PatchCache$\Managed\3140710900063D11C8EF10054038389C\11.0.5614\FPWEL.DLL + 2003-07-15 06:34 . 2003-07-15 06:34 320056 c:\windows\Installer\$PatchCache$\Managed\3140710900063D11C8EF10054038389C\11.0.5614\FPDB.DLL + 2010-02-28 17:34 . 2010-02-28 17:34 2919936 c:\windows\Installer\329c51.msi + 2003-07-24 06:00 . 2003-07-24 06:00 4425272 c:\windows\Installer\$PatchCache$\Managed\3140710900063D11C8EF10054038389C\11.0.5614\FRONTPG.EXE + 2003-07-28 20:04 . 2003-07-28 20:04 6600256 c:\windows\Installer\$PatchCache$\Managed\3140710900063D11C8EF10054038389C\11.0.5614\FPEDITAX.DLL . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-19 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-08-25 53248] "RTHDCPL"="RTHDCPL.EXE" [2006-04-17 16143872] "AGRSMMSG"="AGRSMMSG.exe" [2005-12-12 88204] "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182] "EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [2005-11-28 569413] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-19 198160] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-04 417792] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2009-09-13 1048392] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-01-08 68640] "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160] c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\ Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= S1 ctredrv.sys;ctredrv.sys;\??\c:\windows\system32\drivers\ctredrv.sys --> c:\windows\system32\drivers\ctredrv.sys [?] S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [19/10/2009 21:27 133104] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] getPlusHelper REG_MULTI_SZ getPlusHelper . Inhoud van de 'Gedeelde Taken' map 2010-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-10-19 20:27] 2010-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-10-19 20:27] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.be/webhp?rls=ig uInternet Settings,ProxyOverride = *.local IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html Trusted Zone: dexia.be\directnet DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.6.4/GarminAxControl.CAB DPF: {DAF94F73-2AA6-44D8-A562-A28831820D34} - hxxp://nl.pixum.be/apps/EasyUploadX.cab DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - hxxps://asp.photoprintit.de/microsite/1386/defaults/activex/ImageUploader3.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2010-03-01 19:58 Windows 5.1.2600 Service Pack 3 NTFS scannen van verborgen processen ... scannen van verborgen autostart items ... scannen van verborgen bestanden ... Scan succesvol afgerond verborgen bestanden: 0 ************************************************************************** . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*] "3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–}|ÿÿÿÿÀ•}|ù•9~*] "3140710900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" . Voltooingstijd: 2010-03-01 20:02:14 ComboFix-quarantined-files.txt 2010-03-01 19:02 ComboFix2.txt 2010-02-28 17:16 ComboFix3.txt 2010-01-15 18:54 Pre-Run: 17.592.930.304 bytes beschikbaar Post-Run: 18.123.866.112 bytes beschikbaar - - End Of File - - F5A6C849BD952A701F5E1160E04B0174

heb de CFSript uitgevoerd maar de HIJack scan stopt op fix checked, krijg dus geen logje. heb wel de combifix laten updaten toen die daar om vroeg, na opstarten met de cfscipt.