Mister S

Nee, helaas zitten er geen recente herstelpunten nog op. De laatste is al van lang geleden en dan raak ik veel dingen kwijt. btw, Kunnen systeemherstelpunten niet ook geinfeteerd worden? Op de pc zit geloof ik nog een virus, maar ik weet het niet zeker (Mijn internetverbinding is wel door XS4all geblokkeerd). Is er manier om dit met zekerheid te checken? ik dacht namelijk eerder ook al dat het over was maar het kwam toch weer terug.

Bah. Het virus zit er nog steeds. ComboFix 10-06-01.03 - Stan 02-06-2010 16:19:41.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.3071.2621 [GMT 2:00] Gestart vanuit: c:\documents and settings\Stan\Mijn documenten\Downloads\ComboFix.exe AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Stan\Application Data\B5D8CECA469182407A56A0FB9A35B26B c:\documents and settings\Stan\Application Data\B5D8CECA469182407A56A0FB9A35B26B\enemies-names.txt c:\windows\system32\4057420743.dat . original MBR restored successfully ! . (((((((((((((((((((( Bestanden Gemaakt van 2010-05-02 to 2010-06-02 )))))))))))))))))))))))))))))) . 2010-06-01 19:36 . 2010-06-01 19:36 -------- d-----w- c:\documents and settings\Stan\Application Data\Malwarebytes 2010-06-01 19:36 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-06-01 19:36 . 2010-06-01 19:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-06-01 19:36 . 2010-06-01 19:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-06-01 19:36 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-06-01 19:25 . 2010-06-01 19:25 388096 ----a-r- c:\documents and settings\Stan\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2010-06-01 19:25 . 2010-06-01 19:25 -------- d-----w- c:\program files\Trend Micro 2010-06-01 17:27 . 2010-06-01 17:27 -------- d-----w- c:\documents and settings\HelpAssistant\IECompatCache 2010-06-01 15:13 . 2010-06-01 15:13 -------- d--h--r- c:\documents and settings\Stan\Onlangs geopend 2010-06-01 15:07 . 2010-06-01 15:07 -------- d-sh--w- c:\documents and settings\Stan\IECompatCache 2010-06-01 11:54 . 2010-06-01 19:12 -------- d-----w- c:\documents and settings\HelpAssistant\Tracing 2010-06-01 11:49 . 2010-06-01 11:50 -------- d-----w- c:\documents and settings\HelpAssistant\Favorieten 2010-06-01 11:49 . 2009-06-23 11:05 -------- d--h--w- c:\documents and settings\HelpAssistant\Netwerkprinteromgeving 2010-06-01 11:49 . 2009-06-23 11:05 -------- d-----r- c:\documents and settings\HelpAssistant\Menu Start 2010-06-01 11:49 . 2009-06-23 09:08 -------- d--h--w- c:\documents and settings\HelpAssistant\Sjablonen 2010-05-31 19:28 . 2010-05-31 19:28 -------- d-----w- c:\windows\system32\wbem\Repository 2010-05-31 19:28 . 2010-05-31 19:28 -------- d-----w- c:\documents and settings\Stan\Application Data\none 2010-05-31 19:28 . 2010-05-31 19:28 -------- d-----w- c:\program files\Supreme Commander 2 2010-05-31 19:28 . 2010-05-31 19:28 -------- d-----w- c:\program files\dumps 2010-05-31 19:28 . 2010-05-31 19:28 -------- d-----w- c:\program files\Casalus 2010-05-31 19:28 . 2010-05-31 19:28 -------- d-----w- c:\program files\Atari 2010-05-31 19:27 . 2010-05-31 19:27 -------- d-----w- c:\program files\Settlers 3 2010-05-31 19:27 . 2010-05-31 19:27 -------- d-----w- c:\program files\NBSoftSolutions 2010-05-31 19:27 . 2010-05-31 19:27 -------- d-----w- c:\program files\Kalypso 2010-05-31 19:27 . 2010-05-31 19:27 -------- d-----w- c:\program files\Map Generator 2010-05-31 19:27 . 2010-05-31 19:27 -------- d-----w- c:\program files\Sorian AI Mod 2010-05-31 19:23 . 2010-05-31 19:23 86720 ----a-w- c:\documents and settings\Stan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-05-31 18:53 . 2010-05-31 18:53 -------- d-----r- c:\documents and settings\NetworkService\Favorieten 2010-05-31 18:31 . 2010-05-31 18:31 -------- d-----w- c:\documents and settings\Administrator\PrivacIE 2010-05-31 18:26 . 2010-05-31 18:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\Apple Computer 2010-05-31 18:25 . 2010-05-31 18:26 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer 2010-05-30 20:19 . 2010-05-30 20:19 -------- d-----w- c:\documents and settings\Stan\Application Data\Sky-Banners 2010-05-29 15:24 . 2010-05-29 15:24 94208 ----a-w- c:\documents and settings\Stan\Application Data\none\Extended Realism v3.5.3b\install\decoder.dll . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-06-01 15:13 . 2010-01-02 17:09 -------- d-----w- c:\documents and settings\Stan\Application Data\Azureus 2010-06-01 15:08 . 2002-09-27 19:49 508570 ----a-w- c:\windows\system32\perfh013.dat 2010-06-01 15:08 . 2002-09-27 19:49 90642 ----a-w- c:\windows\system32\perfc013.dat 2010-05-31 19:22 . 2009-08-01 18:33 -------- d-----w- c:\documents and settings\Stan\Application Data\MSN6 2010-05-29 15:20 . 2009-11-16 14:50 -------- d-----w- c:\program files\Activision 2010-05-23 08:53 . 2009-12-05 11:55 -------- d-----w- c:\program files\Google 2010-05-09 20:45 . 2010-01-08 19:27 -------- d-----w- c:\program files\Vuze 2010-05-08 19:04 . 2009-07-04 10:35 -------- d-----w- c:\program files\Hotspot Shield 2010-05-05 20:59 . 2010-01-17 20:12 1 ----a-w- c:\documents and settings\Stan\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2010-05-02 20:10 . 2010-05-02 20:10 -------- d-----w- c:\program files\Bonjour 2010-05-02 20:07 . 2009-06-30 11:23 -------- d-----w- c:\program files\AirPort 2010-04-28 18:01 . 2010-04-28 17:49 -------- d-----w- c:\program files\Common Files\Real 2010-04-28 17:49 . 2009-08-05 16:09 499712 ----a-w- c:\windows\system32\msvcp71.dll 2010-04-27 17:03 . 2010-04-27 17:03 -------- d-----w- c:\program files\Common Files\Stardock 2010-04-26 20:33 . 2010-02-25 22:11 -------- d-----w- c:\program files\ChromePlus 2010-04-18 12:39 . 2010-04-18 12:39 -------- d-----w- c:\program files\SopCast 2010-04-17 15:33 . 2010-04-17 15:33 270606 ----a-r- c:\documents and settings\Stan\Application Data\Microsoft\Installer\{FA6B53B1-1D16-42F3-9E87-F7B33C7DCA63}\_758AA081B6B0B62C6C029E.exe 2010-04-16 06:33 . 2009-06-23 18:31 41472 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2010-04-16 06:33 . 2009-06-23 18:31 3003680 ----a-w- c:\windows\system32\usbaaplrc.dll 2010-04-13 13:24 . 2010-04-13 13:24 -------- d-----w- c:\program files\Common Files\Symantec Shared 2010-04-13 13:24 . 2010-04-13 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton 2010-04-13 13:23 . 2010-04-13 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec 2010-04-13 13:23 . 2010-04-13 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller 2010-04-11 15:04 . 2010-01-17 17:01 -------- d-----w- c:\program files\Paradox Interactive 2010-04-11 15:04 . 2009-06-23 09:17 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-04-10 10:38 . 2010-04-10 10:38 -------- d-----w- c:\documents and settings\Stan\Application Data\TeamViewer 2010-04-10 10:38 . 2010-04-10 10:38 -------- d-----w- c:\program files\TeamViewer 2010-04-08 11:20 . 2010-04-08 11:20 91424 ----a-w- c:\windows\system32\dnssd.dll 2010-04-08 11:20 . 2010-04-08 11:20 107808 ----a-w- c:\windows\system32\dns-sd.exe 2010-04-07 09:43 . 2010-04-07 09:43 -------- d-----w- c:\program files\Common Files\fwc 2010-03-24 18:17 . 2010-03-24 08:04 952768 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\3374\AdobeARM.exe 2010-03-24 18:17 . 2010-03-24 08:04 70584 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\3374\AdobeExtractFiles.dll 2010-03-24 18:17 . 2010-03-24 08:04 326056 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\3374\ReaderUpdater.exe 2010-03-24 18:17 . 2010-03-24 08:04 326056 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\3374\AcrobatUpdater.exe 2010-03-10 06:17 . 2002-09-27 19:57 420352 ----a-w- c:\windows\system32\vbscript.dll . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}] 2009-09-05 18:42 204248 ----a-w- c:\program files\Hotspot Shield\hssie\HssIE.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] "Google Update"="c:\documents and settings\Stan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-06-23 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-09-23 1657448] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2002-09-27 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-09-27 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-09-27 455168] "IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2002-09-27 44032] "AirPort Base Station Agent"="c:\program files\AirPort\APAgent.exe" [2009-11-11 771360] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Microsoft Office.lnk] backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Wireless USB 2.0 WLAN Card Utility.lnk] backup=c:\windows\pss\Wireless USB 2.0 WLAN Card Utility.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Stan^Menu Start^Programma's^Opstarten^Age2 Config.lnk] backup=c:\windows\pss\Age2 Config.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Stan^Menu Start^Programma's^Opstarten^Impulse Now.lnk] backup=c:\windows\pss\Impulse Now.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Stan^Menu Start^Programma's^Opstarten^ImpulseNow.lnk] backup=c:\windows\pss\ImpulseNow.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] 2009-07-26 14:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Lavasoft Ad-Aware Service"=2 (0x2) "helpsvc"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\security center] "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AirPort\\APAgent.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"= "c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire Entrenchment.exe"= "c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2010\\pes2010.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Program Files\\Stardock Games\\Demigod\\bin\\Demigod.exe"= "c:\\Program Files\\Vuze\\Azureus.exe"= "c:\\Program Files\\Vuze\\AzureusUpdater.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "56066:TCP"= 56066:TCP:Pando Media Booster "56066:UDP"= 56066:UDP:Pando Media Booster "5353:UDP"= 5353:UDP:Bonjour "65533:TCP"= 65533:TCP:Services "52344:TCP"= 52344:TCP:Services "7526:TCP"= 7526:TCP:Services "7527:TCP"= 7527:TCP:Services "3389:TCP"= 3389:TCP:Remote Desktop R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [24-6-2009 21:27 108289] R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe [1-4-2010 2:24 194608] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5-12-2009 13:55 135664] S3 Mkd2kfNt;Mkd2kfNt;c:\windows\system32\drivers\Mkd2kfNT.sys [17-11-2009 14:15 131072] S3 Mkd2Nadr;Mkd2Nadr;c:\windows\system32\drivers\Mkd2Nadr.sys [17-11-2009 14:15 79104] S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [27-6-2009 17:19 721904] . Inhoud van de 'Gedeelde Taken' map 2009-12-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2010-06-02 c:\windows\Tasks\GlaryInitialize.job - c:\program files\Glary Utilities\initialize.exe [2009-11-08 09:21] 2010-06-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cac6a3ac5c6c2c.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-05 11:55] 2010-06-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-05 11:55] 2010-06-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1788223648-839522115-1003Core.job - c:\documents and settings\Stan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-23 10:16] 2010-06-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1788223648-839522115-1003UA.job - c:\documents and settings\Stan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-23 10:16] . . ------- Bijkomende Scan ------- . uInternet Settings,ProxyOverride = *.local Trusted Zone: com.tw\asia.msi Trusted Zone: com.tw\global.msi DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab . - - - - ORPHANS VERWIJDERD - - - - WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file) ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2010-06-02 16:27 Windows 5.1.2600 Service Pack 3 NTFS scannen van verborgen processen ... scannen van verborgen autostart items ... scannen van verborgen bestanden ... Scan succesvol afgerond verborgen bestanden: 0 ************************************************************************** . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- [HKEY_USERS\S-1-5-21-2052111302-1788223648-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{CDF526F4-221E-285A-0290-0E6B7DEEE468}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . Voltooingstijd: 2010-06-02 16:27:59 ComboFix-quarantined-files.txt 2010-06-02 14:27 Pre-Run: 86.560.301.056 bytes beschikbaar Post-Run: 86.752.464.896 bytes beschikbaar - - End Of File - - D39BC9D22485D2C60C1949C713DB8CB6

Dat niet, maar volgens Avira zit er nog een (1) virus op mijn pc, maar MalwareBytes geeft geen virusmelding over dat bestand. Het kan dus een false positive zijn, maar ik weet het niet zeker. Tot nu toe ziet alles er echter goed uit (hij is weer razendsnel en ook avira geeft geen meldingen - op die ene na dan). In ieder geval bedankt voor de geleverde hulp tot nu toe!

Malwarebytes' Anti-Malware 1.46 Malwarebytes Databaseversie: 4161 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 1-6-2010 21:42:43 mbam-log-2010-06-01 (21-42-43).txt Scantype: Snelle scan Objecten gescand: 138201 Verstreken tijd: 4 minuut/minuten, 45 seconde(n) Geheugenprocessen geïnfecteerd: 0 Geheugenmodulen geïnfecteerd: 0 Registersleutels geïnfecteerd: 0 Registerwaarden geïnfecteerd: 0 Registerdata geïnfecteerd: 1 Mappen geïnfecteerd: 0 Bestanden geïnfecteerd: 26 Geheugenprocessen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Geheugenmodulen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registersleutels geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registerwaarden geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Registerdata geïnfecteerd: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Mappen geïnfecteerd: (Geen kwaadaardige objecten gedetecteerd) Bestanden geïnfecteerd: C:\Documents and Settings\HelpAssistant\Local Settings\Temp\586.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Documents and Settings\HelpAssistant\Local Settings\Temp\cjxaymdn.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\HelpAssistant\Local Settings\Temp\ccl9ke.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. C:\Documents and Settings\HelpAssistant\Local Settings\Temp\Obw.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\HelpAssistant\Local Settings\Temp\Obp.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\HelpAssistant\Local Settings\Temp\Obq.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\HelpAssistant\Local Settings\Temp\Obr.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\HelpAssistant\Local Settings\Temp\Obs.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\HelpAssistant\Local Settings\Temp\Obt.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\HelpAssistant\Local Settings\Temp\Obu.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\HelpAssistant\Local Settings\Temp\Obv.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\HelpAssistant\Local Settings\Temp\Obx.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\Stan\Local Settings\Temp\ccl9ke.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. C:\Documents and Settings\Stan\Local Settings\Temp\cjxaymdn.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Stan\Local Settings\Temp\Obp.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\Stan\Local Settings\Temp\Obr.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\Stan\Local Settings\Temp\Obs.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\Stan\Local Settings\Temp\Obt.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\Stan\Local Settings\Temp\Obw.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\Documents and Settings\Stan\Local Settings\Temp\Obx.exe (Trojan.Renos) -> Quarantined and deleted successfully. C:\WINDOWS\Explorer1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\explorer.ex_ (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully. C:\Documents and Settings\HelpAssistant\explorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully. C:\Documents and Settings\Stan\explorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully. Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 21:48:12, on 1-6-2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\AirPort\APAgent.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Hotspot Shield\bin\openvpnas.exe C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe C:\Program Files\Hotspot Shield\bin\hsswd.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Stan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\Stan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Stan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [iMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [AirPort Base Station Agent] "C:\Program Files\AirPort\APAgent.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Stan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://asia.msi.com.tw O15 - Trusted Zone: http://global.msi.com.tw O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {5727FF4C-EF4E-4d96-A96C-03AD91910448} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_ind.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1245749373568 O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE O23 - Service: Hotspot Shield Monitoring Service (HssWd) - Unknown owner - C:\Program Files\Hotspot Shield\bin\hsswd.exe O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe -- End of file - 8414 bytes

Ik heb sinds gisteren een naar virus op mijn pc, en antimalware doctor zit daar ook bij, samen met andere valse virusscanners. Avira wist deze echter meteen tegen te houden (met vele tientallen meldingen per minuut) maar toch blijft er een virus op mijn pc zitten dat hem ongeveer om de 15 minuten laat crashen. Ik heb al een scan in veilige modus laten uitvoeren, maar het probleem blijft. Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 21:26:23, on 1-6-2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\AirPort\APAgent.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Hotspot Shield\bin\openvpnas.exe C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe C:\Program Files\Hotspot Shield\bin\hsswd.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\iPod\bin\iPodService.exe C:\Documents and Settings\Stan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\Stan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Stan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Stan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe C:\Documents and Settings\Stan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q=%s R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen R3 - URLSearchHook: (no name) - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll O3 - Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file) O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [iMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [AirPort Base Station Agent] "C:\Program Files\AirPort\APAgent.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Stan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://asia.msi.com.tw O15 - Trusted Zone: http://global.msi.com.tw O15 - Trusted Zone: MSI Portal ? Computer, laptop, Notebook, Desktop, Mainboard, Graphics and more O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {5727FF4C-EF4E-4d96-A96C-03AD91910448} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_ind.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1245749373568 O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE O23 - Service: Hotspot Shield Monitoring Service (HssWd) - Unknown owner - C:\Program Files\Hotspot Shield\bin\hsswd.exe O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe -- End of file - 9196 bytes