[OPGELOST] Zwart Scherm

[Airandius]

Ik krijg de laatste tijd een zwart scherm bij het opstarten.

Het start normaal, scherm flikkert paar keer zwart en gaat dan verder.

Dit gebeurd altijd bij het inlog scherm of na het inloggen.

Ik had dit eerder, mijn oude monitor ging gwn stuk, want na een tidj kreeg ik kleur scheuren etc. Ik geloof echter niet dat het mijn scherm is want die is net nieuw.

Hier is een logje, mischien valt er iets te vinden.

P.S. Ik heb ook een malware test gedaan met malware bytes ofzo, vond een paar die zijn nu weg maar het probleem blijft.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:30:37 PM, on 10/2/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18248)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\ASUS\AASP\1.00.32\aaCenter.exe

C:\Program Files\Windows Defender\MSASCui.exe

D:\Alwil Software\Avast4\ashDisp.exe

C:\Program Files\Trust\GM-4600 Gamer Mouse\Amoumain.exe

D:\Unlocker\UnlockerAssistant.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

D:\DAEMON Tools\daemon.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Xfire\xfire.exe

D:\Mozilla Firefox\firefox.exe

D:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Ruim assortiment pc's en elektronica, scherpe prijzen! - norrod.nl

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Ruim assortiment pc's en elektronica, scherpe prijzen! - norrod.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [avast!] D:\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\Trust\GM-4600 Gamer Mouse\Amoumain.exe

O4 - HKLM\..\Run: [unlockerAssistant] "D:\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "D:\Malwarebytes Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\DAEMON Tools\daemon.exe" -autorun

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\RunServices: [system] explorer.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O8 - Extra context menu item: Add to Windows &Live Favorites - Sign In

O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MICROS~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\OFFICE11\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab

O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - D:\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - D:\Hamachi\hamachi-2.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--

End of file - 8737 bytes

[kape]

Start Hijackthis op. Ben je gebruiker van Vista kies dan voor “Run as administrator" of "Uitvoeren als administrator". Selecteer “Do a system scan only”. Selecteer alleen de items die hieronder zijn genoemd:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

O4 - HKCU\..\RunServices: [system] explorer.exe

Klik op 'Fix checked' om de items te verwijderen.

Maak dan een nieuw logje met HijackThis en laat even weten hoe het met de problemen staat ?

[Airandius]

Heb de items die je aangaf gefixed. Heb vervolgens opnieuw opgestart en het probleem deed zich weer voor.

Hier een betere uitleg van wat er gebeurd:

Een paar seconden nadat de login verschijnt gaat de scherm zwart, vervolgens na 1 of twee seconden komt het terug maar lijkt het alsof het in een andere resolutie is op dezelfde resolutie (onderaan komt een zwarte lijn). (Mijn scherm draaid op de resolutie 1280x1020 wat overigens het maximum is. En ik denk dat het na het zwart gaan springt op 1280x960 maar ik weet dat niet helemaal zeker.) Vervolgens spreid de inlog zich over hele scherm en is het normaal.

Vervolgens log ik in en dan flikkert het scherm een paar keer zwart en gaat vervolgens verder alsof er niets is gebeurd.

Hier is een logje na het heropstarten en het vorige logje.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:47:56 PM, on 10/2/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18248)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\ASUS\AASP\1.00.32\aaCenter.exe

C:\Program Files\Windows Defender\MSASCui.exe

D:\Alwil Software\Avast4\ashDisp.exe

C:\Program Files\Trust\GM-4600 Gamer Mouse\Amoumain.exe

D:\Unlocker\UnlockerAssistant.exe

D:\Adobe Reader 9.0\Reader\reader_sl.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe

C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

D:\DAEMON Tools\daemon.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\system32\wbem\unsecapp.exe

D:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Ruim assortiment pc's en elektronica, scherpe prijzen! - norrod.nl

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Ruim assortiment pc's en elektronica, scherpe prijzen! - norrod.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O1 - Hosts: ::1 localhost

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [avast!] D:\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\Trust\GM-4600 Gamer Mouse\Amoumain.exe

O4 - HKLM\..\Run: [unlockerAssistant] "D:\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "D:\Malwarebytes Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\DAEMON Tools\daemon.exe" -autorun

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O8 - Extra context menu item: Add to Windows &Live Favorites - Sign In

O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\MICROS~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\OFFICE11\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab

O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - D:\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - D:\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - D:\Hamachi\hamachi-2.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--

End of file - 8496 bytes

[kape]

We gaan eerst even door om malware uit te sluiten :

Download Combofix naar je Bureaublad.

Lees hier meer over correct gebruik van Combofix.

OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download Combofix opnieuw.

Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

• 
  Dubbelklik op Combofix.exe om het te starten.
  Indien je Combofix al eerder hebt gebruikt, kan je een waarschuwing krijgen dat een update beschikbaar is. Sta toe dat ComboFix wordt geupdate.
  Volg de instructies, aanvaard de disclaimer door op Ja te klikken.
  Indien de Recovery Console niet geïnstalleerd is, wordt je gevraagd om dit alsnog te doen door op JA te klikken in het "Query - Recovery Console" venster (enkel voor XP, niet voor VISTA).
  Klik op OK en Ja om automatisch de Recovery Console te laten installeren.
  Klik na afloop terug op Ja om het scannen op malware te starten.
  Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.
  

Wanneer de fix voltooid is en na herstart, zal de log Combofix.txt openen.

Post dit logje in je volgende antwoord.

[Airandius]

Bij het gebruik van die programma was er veel gepiep (schok er van xD) en kreeg een error over avast (kan ik helaas neit sluiten).

Toen de log klaar was kon ik echter niet meer op internet, na herstarten (probleem bestaat nog steeds) kan ik weer op internet maar alle persoonlijke gegevens zijn weg. D: Maar dat is niet zo erg.

Hier is de log:

ComboFix 09-10-01.01 - Richard 10/02/2009 15:04.1.4 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.31.1043.18.3070.1935 [GMT 2:00]

Gestart vanuit: d:\back up\Apps\Combofix\ComboFix.exe

AV: avast! antivirus 4.8.1296 [VPS 081129-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

SP: avast! antivirus 4.8.1296 [VPS 081129-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\$recycle.bin\S-1-5-21-1495173613-569258742-3764099308-500

c:\users\Richard\AppData\Roaming\Desktopicon

c:\users\Richard\AppData\Roaming\Desktopicon\eBayShortcuts.exe

c:\users\Richard\AppData\Roaming\inst.exe

c:\windows\Installer\3f7a5.msp

c:\windows\Installer\3f7b9.msp

c:\windows\Tasks\dqhiuxas.job

.

(((((((((((((((((((( Bestanden Gemaakt van 2009-09-02 to 2009-10-02 ))))))))))))))))))))))))))))))

.

2009-10-02 13:10 . 2009-10-02 13:10 -------- d-----w- c:\users\Richard\AppData\Local\temp

2009-10-02 13:10 . 2009-10-02 13:10 -------- d-----w- c:\users\Default\AppData\Local\temp

2009-10-02 11:14 . 2009-10-02 11:14 -------- d-----w- c:\users\Richard\AppData\Roaming\Malwarebytes

2009-10-02 11:14 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-02 11:14 . 2009-10-02 11:14 -------- d-----w- c:\programdata\Malwarebytes

2009-10-02 11:14 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-09-27 14:39 . 2009-10-01 20:38 -------- d-----w- c:\users\Richard\AppData\Roaming\Tropico 3

2009-09-25 22:20 . 2009-09-25 22:20 41872 ----a-w- c:\windows\system32\xfcodec.dll

2009-09-25 13:08 . 2009-09-25 13:08 -------- d-----w- C:\MoTemp

2009-09-07 16:08 . 2009-09-07 16:08 -------- d-----w- c:\users\Richard\AppData\Local\Microsoft Game Studios

2009-09-06 15:19 . 2009-09-06 15:21 -------- d-----w- c:\users\Richard\AppData\Local\LogMeIn Hamachi

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-02 11:47 . 2009-05-27 17:13 32061 ----a-w- c:\programdata\nvModes.dat

2009-10-01 22:05 . 2008-05-03 18:08 -------- d-----w- c:\users\Richard\AppData\Roaming\Xfire

2009-10-01 14:27 . 2008-12-24 19:15 -------- d-----w- c:\program files\Common Files\Steam

2009-09-30 20:37 . 2008-05-03 18:08 -------- d-----w- c:\programdata\Xfire

2009-09-30 07:37 . 2008-05-03 18:08 -------- d-----w- c:\program files\Xfire

2009-09-29 15:32 . 2008-06-04 17:48 -------- d-----w- c:\users\Richard\AppData\Roaming\uTorrent

2009-09-27 12:09 . 2008-12-29 21:07 -------- d-----w- c:\users\Richard\AppData\Roaming\GrabIt

2009-09-26 21:05 . 2008-01-21 06:47 680172 ----a-w- c:\windows\system32\perfh013.dat

2009-09-26 21:05 . 2008-01-21 06:47 132614 ----a-w- c:\windows\system32\perfc013.dat

2009-09-25 17:22 . 2009-08-07 13:20 173 ----a-w- c:\windows\popcinfo.dat

2009-09-17 19:42 . 2008-04-28 11:33 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-09-14 13:51 . 2008-07-11 08:56 -------- d-----w- c:\program files\Microsoft Silverlight

2009-09-07 16:11 . 2008-06-11 17:40 -------- d-----w- c:\programdata\Media Center Programs

2009-09-07 16:08 . 2008-07-23 11:18 -------- d-----w- c:\programdata\Microsoft Games

2009-09-07 16:08 . 2008-07-23 11:17 -------- d-----w- c:\users\Richard\AppData\Roaming\Microsoft Game Studios

2009-09-06 15:30 . 2008-05-03 18:33 79075 ----a-w- c:\windows\War3Unin.dat

2009-09-06 15:17 . 2008-05-19 20:29 -------- d-----w- c:\users\Richard\AppData\Roaming\Hamachi

2009-08-17 16:10 . 2008-05-06 13:07 1279456 ----a-w- c:\windows\system32\aswBoot.exe

2009-08-17 16:05 . 2008-05-06 13:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys

2009-08-17 16:05 . 2008-05-06 13:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2009-08-17 16:05 . 2008-05-06 13:07 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2009-08-17 16:04 . 2008-05-06 13:07 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2009-08-17 16:04 . 2008-05-06 13:07 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2009-08-17 16:02 . 2008-05-06 13:07 97480 ----a-w- c:\windows\system32\AvastSS.scr

2009-08-17 12:43 . 2009-08-17 12:43 -------- d-----w- c:\program files\ReflexiveArcade

2009-08-13 10:12 . 2009-08-07 18:48 -------- d-----w- c:\programdata\SpinTop Games

2009-08-13 10:10 . 2009-08-07 14:03 -------- d-----w- c:\programdata\PopCap Games

2009-08-07 20:17 . 2009-08-07 20:17 -------- d-----w- c:\programdata\Gamehouse

2009-08-07 18:08 . 2009-08-07 18:08 -------- d-----w- c:\programdata\PopCapv1005

2009-08-07 14:25 . 2009-08-07 14:25 -------- d-----w- c:\users\Richard\AppData\Roaming\PopCapv1002

2009-08-07 13:55 . 2009-08-07 13:55 -------- d-----w- c:\users\Richard\AppData\Roaming\PopCapv1005eni

2009-08-07 13:17 . 2009-01-01 16:15 -------- d-----w- c:\users\Richard\AppData\Roaming\InstallShield Installation Information

2009-07-15 11:59 . 2008-05-03 11:32 102512 ----a-w- c:\users\Richard\AppData\Local\GDIPFONTCACHEV1.DAT

2009-07-08 21:03 . 2008-06-11 17:15 281760 ----a-w- c:\windows\system32\drivers\atksgt.sys

2009-07-08 21:03 . 2008-06-11 17:15 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys

2009-07-07 12:53 . 2009-02-14 19:56 418480 ----a-w- c:\windows\system32\wrap_oal.dll

2009-07-07 12:53 . 2009-02-14 19:56 115432 ----a-w- c:\windows\system32\OpenAL32.dll

2006-05-03 09:06 . 2009-02-22 11:05 163328 --sh--r- c:\windows\System32\flvDX.dll

2007-02-21 10:47 . 2009-02-22 11:05 31232 --sh--r- c:\windows\System32\msfDX.dll

2008-03-16 12:30 . 2009-02-22 11:05 216064 --sh--r- c:\windows\System32\nbDX.dll

.

------- Sigcheck -------

[-] 2009-03-15 . 534B3525C497688ABE3C7FFE7D7DC5ED . 247296 . . [6.0.6000.16386] . . c:\windows\System32\shsvcs.dll

[7] 2008-01-21 . 27F10F348E508243F6254846F8370D0D . 247296 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6001.18000_none_cd305d2a1ced96e2\shsvcs.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="d:\daemon tools\daemon.exe" [2008-07-24 490952]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]

"avast!"="d:\alwils~1\Avast4\ashDisp.exe" [2009-08-17 81000]

"WheelMouse"="c:\program files\Trust\GM-4600 Gamer Mouse\Amoumain.exe" [2007-03-13 196608]

"UnlockerAssistant"="d:\unlocker\UnlockerAssistant.exe" [2008-05-02 15872]

"Adobe Reader Speed Launcher"="d:\adobe reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-30 13781536]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]

"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]

"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]

"Malwarebytes Anti-Malware (reboot)"="d:\malwarebytes anti-malware\mbam.exe" [2009-09-10 1312080]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-881388789-4157317966-2477145516-1000]

"EnableNotificationsRef"=dword:00000003

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{A18192B7-42B2-4C26-BEED-F24BA406A723}"= UDP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9

"{4559FDDA-2430-4D99-AE91-BFCAE479F599}"= TCP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9

"{506D31FC-5B2B-49DC-BB38-1743E63A50FA}"= UDP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10

"{FD636281-34D4-4544-A8E8-9B15B984E57A}"= TCP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10

"{15E9A2B3-DD04-4D79-8296-7FF7FC73B6A8}"= UDP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update

"{A8AA28A9-F9FE-4243-8B4F-302FC9D00D16}"= TCP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update

"TCP Query User{1764902C-20B3-467F-945C-40707BD6F9A4}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent

"UDP Query User{0A0A9920-9831-4D05-BCA2-A3C4480A61D6}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent

"TCP Query User{011CE2F8-E537-4F45-834D-3ED7A877D053}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent

"UDP Query User{19215EB7-3D2D-486D-8D12-4FED905A0F06}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent

"{6B24A959-0E54-4B2C-A448-985482822066}"= UDP:d:\age of empires iii\age3x.exe:Age of Empires III - The WarChiefs

"{C0744141-3AEA-46B6-9BA5-71BF7BA2A486}"= TCP:d:\age of empires iii\age3x.exe:Age of Empires III - The WarChiefs

"TCP Query User{384417DB-73EF-4234-B7F8-A3CD1F9F0B0D}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire

"UDP Query User{A0C084B5-A179-4E72-997D-49951041523C}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire

"TCP Query User{269CEEB9-5491-4E48-84EB-1987AE599292}c:\\users\\richard\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\4y6pry2s\\wow-engb-installer-downloader[1].exe"= UDP:c:\users\richard\appdata\local\microsoft\windows\temporary internet files\content.ie5\4y6pry2s\wow-engb-installer-downloader[1].exe:wow-engb-installer-downloader[1].exe

"UDP Query User{54262629-1F9B-4AF4-8F20-82F843E09DF7}c:\\users\\richard\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\4y6pry2s\\wow-engb-installer-downloader[1].exe"= TCP:c:\users\richard\appdata\local\microsoft\windows\temporary internet files\content.ie5\4y6pry2s\wow-engb-installer-downloader[1].exe:wow-engb-installer-downloader[1].exe

"TCP Query User{92368D72-493B-42D6-A75D-4041C4AD5817}c:\\users\\richard\\downloads\\wow-burningcrusade-engb-installer-downloader.exe"= UDP:c:\users\richard\downloads\wow-burningcrusade-engb-installer-downloader.exe:wow-burningcrusade-engb-installer-downloader.exe

"UDP Query User{9593901C-2685-4E20-8E81-87A8DE68B9F0}c:\\users\\richard\\downloads\\wow-burningcrusade-engb-installer-downloader.exe"= TCP:c:\users\richard\downloads\wow-burningcrusade-engb-installer-downloader.exe:wow-burningcrusade-engb-installer-downloader.exe

"TCP Query User{F4995531-7A89-4C47-9061-381FABAF258A}d:\\world of warcraft\\wow-2.4.0-engb-downloader.exe"= UDP:d:\world of warcraft\wow-2.4.0-engb-downloader.exe:Blizzard Downloader

"UDP Query User{6BF39F1A-66FD-4105-9243-EA8EEC3D352C}d:\\world of warcraft\\wow-2.4.0-engb-downloader.exe"= TCP:d:\world of warcraft\wow-2.4.0-engb-downloader.exe:Blizzard Downloader

"TCP Query User{6019F07B-0437-48C9-93BC-81A01AA57A74}d:\\world of warcraft\\wow-2.4.0-engb-downloader.exe"= UDP:d:\world of warcraft\wow-2.4.0-engb-downloader.exe:Blizzard Downloader

"UDP Query User{FFCF96EF-C8A2-484F-8E8F-484345CFA289}d:\\world of warcraft\\wow-2.4.0-engb-downloader.exe"= TCP:d:\world of warcraft\wow-2.4.0-engb-downloader.exe:Blizzard Downloader

"{77321E41-ABFA-4CB3-ABEC-CEC25F7D57C1}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.0.8089-to-2.4.1.8125-enGB-downloader.exe:Blizzard Downloader

"{2675CEAC-4F3F-49B1-B938-B564F8609787}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.0.8089-to-2.4.1.8125-enGB-downloader.exe:Blizzard Downloader

"{7DEB9578-8483-4662-BD39-7EDADA8845C8}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.1.8125-to-2.4.2.8278-enGB-downloader.exe:Blizzard Downloader

"{550BB1D0-176A-4E17-A658-302BBBAE343D}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.1.8125-to-2.4.2.8278-enGB-downloader.exe:Blizzard Downloader

"{CFF556EF-6B75-4B12-A9CC-422E640D3124}"= UDP:3724:Blizzard Downloader: 3724

"TCP Query User{3C1B2933-FFBC-4B1B-8EF6-16F71F7E64A5}d:\\bitlord2\\bitlord.exe"= UDP:d:\bitlord2\bitlord.exe:

"UDP Query User{6C51CC05-501B-45FA-B25E-D77EE1407CDC}d:\\bitlord2\\bitlord.exe"= TCP:d:\bitlord2\bitlord.exe:

"TCP Query User{C818EAD0-079C-47AF-A67C-BE86F66B3865}d:\\warcraft iii\\war3.exe"= UDP:d:\warcraft iii\war3.exe:Warcraft III

"UDP Query User{6B6EC8C2-ACCE-4FD8-BC39-156F63432A26}d:\\warcraft iii\\war3.exe"= TCP:d:\warcraft iii\war3.exe:Warcraft III

"TCP Query User{780D393F-116C-44E4-90CA-CF4117DEF368}d:\\bitcomet\\bitcomet.exe"= UDP:d:\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client

"UDP Query User{16566F85-C873-4503-B653-9548DBB83146}d:\\bitcomet\\bitcomet.exe"= TCP:d:\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client

"{375FB774-E788-4E79-B3A1-46E412841139}"= UDP:d:\utorrent\uTorrent.exe:µTorrent (TCP-In)

"{B29E0963-A557-4F57-BF91-CC7A8E8CDA42}"= TCP:d:\utorrent\uTorrent.exe:µTorrent (UDP-In)

"TCP Query User{A26C4F06-68F0-42E6-934A-69E83AF39DB8}d:\\utorrent\\utorrent.exe"= UDP:d:\utorrent\utorrent.exe:µTorrent

"UDP Query User{15C1E58D-A421-4E8C-9465-19475144F647}d:\\utorrent\\utorrent.exe"= TCP:d:\utorrent\utorrent.exe:µTorrent

"TCP Query User{C1130752-D7B7-4A42-A212-E49D0879BA67}d:\\dawn of war - dark crusade\\darkcrusade.exe"= UDP:d:\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade

"UDP Query User{9B8579B5-4F04-406E-861C-7093CBAABDBA}d:\\dawn of war - dark crusade\\darkcrusade.exe"= TCP:d:\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade

"TCP Query User{57B3FBE9-45AA-4E8D-9E0F-D7F390860F45}d:\\portforwardprogram\\networkactiv-portimport-console-v1.0.exe"= UDP:d:\portforwardprogram\networkactiv-portimport-console-v1.0.exe:NetworkActiv PortImport Console Application and Installer

"UDP Query User{B4ECEDFA-694B-4CDF-8EED-8373B6630115}d:\\portforwardprogram\\networkactiv-portimport-console-v1.0.exe"= TCP:d:\portforwardprogram\networkactiv-portimport-console-v1.0.exe:NetworkActiv PortImport Console Application and Installer

"TCP Query User{5BDABD75-07FD-4A22-9992-6967EF5BC972}c:\\users\\richard\\desktop\\mcoinstall.exe"= UDP:c:\users\richard\desktop\mcoinstall.exe:mcoinstall.exe

"UDP Query User{39011A13-077A-45AC-8399-8B0F061DE8B0}c:\\users\\richard\\desktop\\mcoinstall.exe"= TCP:c:\users\richard\desktop\mcoinstall.exe:mcoinstall.exe

"{2385CC78-96D3-4611-BC2A-891281AA151B}"= UDP:d:\the settlers - rise of an empire\base\bin\Settlers6.exe:THE SETTLERS - Rise of an Empire

"{F71256CC-93AA-44B7-887A-F99351E290E4}"= TCP:d:\the settlers - rise of an empire\base\bin\Settlers6.exe:THE SETTLERS - Rise of an Empire

"TCP Query User{0BE7D5AB-36AE-4085-BC37-63805600F335}c:\\program files\\sony\\station\\launchpad\\launchpad.exe"= UDP:c:\program files\sony\station\launchpad\launchpad.exe:LaunchPad

"UDP Query User{161478CA-E211-42F8-A5D8-26E676497577}c:\\program files\\sony\\station\\launchpad\\launchpad.exe"= TCP:c:\program files\sony\station\launchpad\launchpad.exe:LaunchPad

"TCP Query User{7E235D3C-677E-48BB-A691-0B8E448537EE}c:\\program files\\sony\\station\\launchpad\\launchpad.exe"= UDP:c:\program files\sony\station\launchpad\launchpad.exe:LaunchPad

"UDP Query User{28265EE4-A2FB-4956-A5DF-C48C46F723AC}c:\\program files\\sony\\station\\launchpad\\launchpad.exe"= TCP:c:\program files\sony\station\launchpad\launchpad.exe:LaunchPad

"TCP Query User{88B2BD91-2101-4688-A73C-76D4FB8ACAC1}d:\\garena\\garena.exe"= UDP:d:\garena\garena.exe:Garena

"UDP Query User{9F7990F0-7117-4EE5-B890-D2DD8C87573F}d:\\garena\\garena.exe"= TCP:d:\garena\garena.exe:Garena

"TCP Query User{779D2DCE-E648-4075-B197-1FFF710D19A5}d:\\garena\\garena.exe"= UDP:d:\garena\garena.exe:Garena

"UDP Query User{95158AB2-8AA0-4F97-89EC-5E0186DF7C76}d:\\garena\\garena.exe"= TCP:d:\garena\garena.exe:Garena

"{7EDB4501-B35D-437C-8765-E06F68369F98}"= UDP:d:\itunes\iTunes.exe:iTunes

"{CE42C63F-311D-4BCD-9721-6263D54D02F5}"= TCP:d:\itunes\iTunes.exe:iTunes

"{44D5DD74-F74F-4877-8EED-0E7D543B5C7C}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.2.8278-to-2.4.3.8606-enGB-downloader.exe:Blizzard Downloader

"{AF205EF8-4800-4B5F-B3FD-75ADB68D407E}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.2.8278-to-2.4.3.8606-enGB-downloader.exe:Blizzard Downloader

"{377DE386-019D-4D81-829F-94151ECC2A39}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA

"{A481825E-3AF7-4FA8-B32D-F88DC69D70D4}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA

"{0D51B205-EE93-489B-A901-F2D5D5B376EC}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB

"{1E25DC2A-A822-401A-9A3F-61FB0FE0570C}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB

"{6FFF795C-92DE-4A2C-A00E-9B462142FBA3}"= UDP:d:\enemy territory - quake wars\etqwded.exe:etqwded.exe

"{7C27CA1F-1F25-4083-A9A5-8B2C04E5A689}"= TCP:d:\enemy territory - quake wars\etqwded.exe:etqwded.exe

"{8AD80AB9-B8D2-48F9-BFF9-F7C0E5CB5CE9}"= UDP:d:\bfme ii\game.dat:The Battle for Middle-earth II

"{2F5A3156-938B-4C60-9566-BED14B1B8C31}"= TCP:d:\bfme ii\game.dat:The Battle for Middle-earth II

"{8A8521A0-7343-4CD6-B3BB-41D8B9F6C0BF}"= UDP:d:\bfme ii\game.dat:The Battle for Middle-earth II

"{C0C21558-BBFA-40D9-9F76-0E807F6132A3}"= TCP:d:\bfme ii\game.dat:The Battle for Middle-earth II

"TCP Query User{E068C90C-37B4-4982-A51D-67D7AD3E2510}d:\\bfme ii\\patchget.dat"= UDP:d:\bfme ii\patchget.dat:patchgrabber

"UDP Query User{2B07FC8C-2E01-41DE-90A1-68079CCFD0FA}d:\\bfme ii\\patchget.dat"= TCP:d:\bfme ii\patchget.dat:patchgrabber

"TCP Query User{175B1E7B-1F2F-4C8B-BE58-EDB7C9C22966}d:\\veoh\\veohclient.exe"= UDP:d:\veoh\veohclient.exe:Veoh Client

"UDP Query User{0EBA86CE-41B9-4DDD-8A6A-F5A169662215}d:\\veoh\\veohclient.exe"= TCP:d:\veoh\veohclient.exe:Veoh Client

"TCP Query User{E9F30535-21FE-48E3-AAAA-4892E1475125}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer

"UDP Query User{76118490-3AEC-4AA0-885B-4F7D0401DC74}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer

"TCP Query User{6789DD49-0525-46EB-900E-A81BAEBBCD10}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer

"UDP Query User{33FC60A3-F523-4BE7-AD1D-76EB07D59C84}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer

"TCP Query User{80252DEC-498F-484B-AB4D-8CC9E065B75C}d:\\orbitdownloader\\orbitnet.exe"= UDP:d:\orbitdownloader\orbitnet.exe:P2P service of Orbit Downloader

"UDP Query User{9D00575F-C462-4163-8920-4EBE97E3EE90}d:\\orbitdownloader\\orbitnet.exe"= TCP:d:\orbitdownloader\orbitnet.exe:P2P service of Orbit Downloader

"{027B649D-5084-4A74-A756-BF1192CA69AC}"= UDP:d:\age of empires iii\age3y.exe:Age of Empires III - The Asian Dynasties

"{22D5E273-9C13-4F1A-8D94-28E51A3837F1}"= TCP:d:\age of empires iii\age3y.exe:Age of Empires III - The Asian Dynasties

"{1A22A132-9FB7-4E98-9993-4E5C41061FC1}"= UDP:c:\windows\System32\dpnsvr.exe:Microsoft DirectPlay8 Server

"{33358D14-DBA7-4383-8125-CF2403A66A5C}"= TCP:c:\windows\System32\dpnsvr.exe:Microsoft DirectPlay8 Server

"{3C3CD84C-F2C8-4EC0-9CFA-607514A6847A}"= UDP:d:\dungeon siege 2\DungeonSiege2.exe:Dungeon Siege II Game Executable

"{94DD7472-2D1B-48B9-8AA7-1C34991B1764}"= TCP:d:\dungeon siege 2\DungeonSiege2.exe:Dungeon Siege II Game Executable

"{3413A93D-EA8C-42FF-B60C-4922E71B53D4}"= UDP:c:\windows\System32\dpnsvr.exe:Microsoft DirectPlay8 Server

"{B39C197F-4D0C-4909-96AA-D9A37C82C353}"= TCP:c:\windows\System32\dpnsvr.exe:Microsoft DirectPlay8 Server

"{90D3FB79-EEC2-40AA-86E1-18BE4A28BF3C}"= UDP:d:\hellgate london\Launcher.exe:Hellgate: London

"{C59C52A9-0252-47A0-8500-8B76C52871C2}"= TCP:d:\hellgate london\Launcher.exe:Hellgate: London

"{0A827E67-0AAC-4727-AEE8-19D3B676F497}"= UDP:d:\neverwinter nights 2\nwn2main.exe:Neverwinter Nights 2 Main

"{A17FC728-826B-44F3-8AED-600BB5F309CF}"= TCP:d:\neverwinter nights 2\nwn2main.exe:Neverwinter Nights 2 Main

"{EE602690-F253-45FF-97A2-8E12018C4D7F}"= UDP:d:\neverwinter nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD

"{3C5E6A00-7557-4AB5-82F4-898D77E0C2FD}"= TCP:d:\neverwinter nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD

"{0F85519B-4747-48E7-A081-60990BB805AD}"= UDP:d:\neverwinter nights 2\nwupdate.exe:Neverwinter Nights 2 Updater

"{0A79438B-7ABF-492F-83FA-DF44BEA3A3B8}"= TCP:d:\neverwinter nights 2\nwupdate.exe:Neverwinter Nights 2 Updater

"{47F57ACA-3592-4B1D-9852-0ED3C2EF82D1}"= UDP:d:\neverwinter nights 2\nwn2server.exe:Neverwinter Nights 2 Server

"{22D1CBF8-0636-4C43-AA8D-762C599EA9F1}"= TCP:d:\neverwinter nights 2\nwn2server.exe:Neverwinter Nights 2 Server

"{9006008D-1345-4A81-A8FE-C7774AA62CF7}"= UDP:c:\users\Richard\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBPXV2GK\utorrent[1].exe:µTorrent (TCP-In)

"{7AF6413F-9DC5-4D69-BA05-93E8DE62CEE4}"= TCP:c:\users\Richard\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBPXV2GK\utorrent[1].exe:µTorrent (UDP-In)

"{D5E76936-10D3-48EA-8222-B62772DA7C4A}"= UDP:d:\utorrent\uTorrent.exe:µTorrent (TCP-In)

"{079A78E7-2C4D-4A87-9CC2-321A2A56C511}"= TCP:d:\utorrent\uTorrent.exe:µTorrent (UDP-In)

"TCP Query User{6C52B8E2-1B1E-4365-8A4B-77F2E56A0E1B}d:\\neverwinter nights 2\\nwn2main.exe"= UDP:d:\neverwinter nights 2\nwn2main.exe:Neverwinter Nights 2

"UDP Query User{878CA585-52F8-4E63-8706-7B9A55A5DB9D}d:\\neverwinter nights 2\\nwn2main.exe"= TCP:d:\neverwinter nights 2\nwn2main.exe:Neverwinter Nights 2

"TCP Query User{216639F5-A6BE-46A8-A0CB-31B8C6597452}d:\\bitlord2\\bitlord.exe"= Disabled:UDP:d:\bitlord2\bitlord.exe:

"UDP Query User{F2B3F339-972D-4127-B64C-D58E4CF71CFB}d:\\bitlord2\\bitlord.exe"= Disabled:TCP:d:\bitlord2\bitlord.exe:

"TCP Query User{5781663D-70F0-48C2-ACC5-A87713867173}d:\\bitcomet\\bitcomet.exe"= Disabled:UDP:d:\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client

"UDP Query User{42273DBD-0692-4424-B8CC-51F7987C3FA1}d:\\bitcomet\\bitcomet.exe"= Disabled:TCP:d:\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client

"TCP Query User{B6DBDC9C-0592-41D3-AE4B-B9CAB24DA618}d:\\dawn of war - dark crusade\\darkcrusade.exe"= Disabled:UDP:d:\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade

"UDP Query User{00544154-7F1C-4B0F-82FE-09DA4CD460F3}d:\\dawn of war - dark crusade\\darkcrusade.exe"= Disabled:TCP:d:\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade

"{536F5D56-6EC9-4329-980C-B0895A6D1E14}"= UDP:d:\enemy territory - quake wars\etqw.exe:Enemy Territory - QUAKE Wars

"{E541D8BA-D9D7-4025-BE55-9296F8868A7D}"= TCP:d:\enemy territory - quake wars\etqw.exe:Enemy Territory - QUAKE Wars

"TCP Query User{2E89E7CF-04B2-4CCA-ACA1-24DAEA6CC5E4}d:\\orbitdownloader\\orbitnet.exe"= Disabled:UDP:d:\orbitdownloader\orbitnet.exe:P2P service of Orbit Downloader

"UDP Query User{4D107C1D-80E3-4F93-A5E8-85742FD88608}d:\\orbitdownloader\\orbitnet.exe"= Disabled:TCP:d:\orbitdownloader\orbitnet.exe:P2P service of Orbit Downloader

"TCP Query User{517BE684-AEAB-4FA2-ADE6-CF13CB2F9DFA}d:\\veoh\\veohclient.exe"= Disabled:UDP:d:\veoh\veohclient.exe:Veoh Client

"UDP Query User{C4974CF0-89EF-4BB5-B399-022EAA3A07D8}d:\\veoh\\veohclient.exe"= Disabled:TCP:d:\veoh\veohclient.exe:Veoh Client

"TCP Query User{D44B4114-2246-4D27-B6E7-02726F4E2E2B}c:\\users\\richard\\downloads\\wow-burningcrusade-engb-installer-downloader.exe"= Disabled:UDP:c:\users\richard\downloads\wow-burningcrusade-engb-installer-downloader.exe:wow-burningcrusade-engb-installer-downloader.exe

"UDP Query User{2B2E1847-988C-4941-A685-5D2914004CFE}c:\\users\\richard\\downloads\\wow-burningcrusade-engb-installer-downloader.exe"= Disabled:TCP:c:\users\richard\downloads\wow-burningcrusade-engb-installer-downloader.exe:wow-burningcrusade-engb-installer-downloader.exe

"TCP Query User{094FC9A9-8FCB-4CF3-ADE8-A0833AA2E85F}d:\\pokemon_world_online_9021\\pokemon game.exe"= UDP:d:\pokemon_world_online_9021\pokemon game.exe:Pokemon Game

"UDP Query User{E516364A-6936-4724-8672-6DC22FAB4840}d:\\pokemon_world_online_9021\\pokemon game.exe"= TCP:d:\pokemon_world_online_9021\pokemon game.exe:Pokemon Game

"TCP Query User{A5B845D0-ADED-4591-B037-BB3ABED6D8F0}d:\\the orange box\\team fortress 2\\hl2.exe"= UDP:d:\the orange box\team fortress 2\hl2.exe:hl2

"UDP Query User{A3D7B349-91E2-4914-B765-B6D44570F466}d:\\the orange box\\team fortress 2\\hl2.exe"= TCP:d:\the orange box\team fortress 2\hl2.exe:hl2

"TCP Query User{4D45C272-A1FA-4070-9898-EE5574F9CC6B}d:\\rise of the argonauts\\binaries\\riseoftheargonauts.exe"= UDP:d:\rise of the argonauts\binaries\riseoftheargonauts.exe:RiseOfTheArgonauts

"UDP Query User{BB88E8CE-AD0B-4A1B-AD0B-D7985804B52C}d:\\rise of the argonauts\\binaries\\riseoftheargonauts.exe"= TCP:d:\rise of the argonauts\binaries\riseoftheargonauts.exe:RiseOfTheArgonauts

"{67AFFC67-0447-4BCA-ACAE-85194960145A}"= Disabled:UDP:d:\red alert 3\RA3.exe:RA3

"{0F59506F-1B16-4774-873E-F4FA8A42B988}"= Disabled:TCP:d:\red alert 3\RA3.exe:RA3

"TCP Query User{36814649-6D14-4A4E-B9F2-048FFE9E6F10}d:\\worms2\\frontend.exe"= UDP:d:\worms2\frontend.exe:Worms 2 Frontend

"UDP Query User{EF39DF5E-7C29-45FF-85C4-9BE6F0A9323E}d:\\worms2\\frontend.exe"= TCP:d:\worms2\frontend.exe:Worms 2 Frontend

"TCP Query User{F5EA0058-502E-4D15-B56F-AB462051917E}c:\\windows\\system32\\explorer.exe"= UDP:c:\windows\system32\explorer.exe:explorer

"UDP Query User{58DB794F-1584-4FF2-97CE-5156A2F03CDD}c:\\windows\\system32\\explorer.exe"= TCP:c:\windows\system32\explorer.exe:explorer

"TCP Query User{E9993312-96F9-4E3F-B036-9DFB09555C8C}d:\\tmunitedforever\\tmforever.exe"= UDP:d:\tmunitedforever\tmforever.exe:TmForever

"UDP Query User{36C008D3-FDD4-4A33-B87F-519110D86EB1}d:\\tmunitedforever\\tmforever.exe"= TCP:d:\tmunitedforever\tmforever.exe:TmForever

"TCP Query User{DD83F518-C753-44E8-B84A-18592CA6034E}d:\\grand theft auto iv\\grand theft auto iv\\gtaiv.exe"= UDP:d:\grand theft auto iv\grand theft auto iv\gtaiv.exe:Grand Theft Auto IV

"UDP Query User{8E7D11CD-20A4-47B3-BD3E-B912958324CA}d:\\grand theft auto iv\\grand theft auto iv\\gtaiv.exe"= TCP:d:\grand theft auto iv\grand theft auto iv\gtaiv.exe:Grand Theft Auto IV

"TCP Query User{D0FFDE15-7FB5-4D77-8649-2B9A46BFFF2B}d:\\saints row 2\\sr2_pc.exe"= UDP:d:\saints row 2\sr2_pc.exe:SR2_pc

"UDP Query User{01F1CC7E-BF39-47C3-AE89-82BA7D20521C}d:\\saints row 2\\sr2_pc.exe"= TCP:d:\saints row 2\sr2_pc.exe:SR2_pc

"TCP Query User{395DB682-7D59-43E5-819D-45A1A0DA56DC}d:\\dawn of war ii\\dow2.exe"= UDP:d:\dawn of war ii\dow2.exe:DOW2

"UDP Query User{BD1C4266-877A-47B8-AFFF-77DF9E12A342}d:\\dawn of war ii\\dow2.exe"= TCP:d:\dawn of war ii\dow2.exe:DOW2

"TCP Query User{5A12331F-3A53-426B-92E1-87D3FF2319D1}d:\\worms 4\\worms 4 mayhem.exe"= UDP:d:\worms 4\worms 4 mayhem.exe:Worms 4 Mayhem

"UDP Query User{32980267-32A6-439F-9E9F-9D121C4171E1}d:\\worms 4\\worms 4 mayhem.exe"= TCP:d:\worms 4\worms 4 mayhem.exe:Worms 4 Mayhem

"{AF23F6D0-95A4-4B2E-BED9-AA4BBBD92276}"= UDP:d:\supreme commander forged alliance\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander - Forged Alliance

"{BED99CCF-D0BE-4C64-A501-9AF5C4E0F5C2}"= TCP:d:\supreme commander forged alliance\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander - Forged Alliance

"TCP Query User{EAE1542B-634F-4B10-A025-0B980B066BDC}d:\\steam\\steamapps\\airandius\\age of chivalry\\hl2.exe"= UDP:d:\steam\steamapps\airandius\age of chivalry\hl2.exe:hl2

"UDP Query User{3AD9D9BC-1F53-442D-9AC4-04E48CD486BA}d:\\steam\\steamapps\\airandius\\age of chivalry\\hl2.exe"= TCP:d:\steam\steamapps\airandius\age of chivalry\hl2.exe:hl2

"TCP Query User{8856B2C4-6922-41C3-8C60-1DD6370E1D95}d:\\downloaded items (back up)\\garry's mod 11 ____!!!!no steam!!!!____\\garry's mod 11\\hl2.exe"= UDP:d:\downloaded items (back up)\garry's mod 11 ____!!!!no steam!!!!____\garry's mod 11\hl2.exe:hl2

"UDP Query User{9F0762F8-7EA6-4A6B-A7B1-BB1A99959EED}d:\\downloaded items (back up)\\garry's mod 11 ____!!!!no steam!!!!____\\garry's mod 11\\hl2.exe"= TCP:d:\downloaded items (back up)\garry's mod 11 ____!!!!no steam!!!!____\garry's mod 11\hl2.exe:hl2

"TCP Query User{8B149253-0F62-4E27-A2EC-4CD0DA79C28A}d:\\garry's mod 11\\hl2.exe"= UDP:d:\garry's mod 11\hl2.exe:hl2

"UDP Query User{745DC4F1-81E9-4D1A-8F53-CCBB1227DF9C}d:\\garry's mod 11\\hl2.exe"= TCP:d:\garry's mod 11\hl2.exe:hl2

"{16738AB3-0C22-4EFA-BC62-9680FAF1F422}"= UDP:d:\demigod\bin\Demigod.exe:Demigod

"{88D4BCDF-939A-4191-983F-C4025007C211}"= TCP:d:\demigod\bin\Demigod.exe:Demigod

"{3F077F04-F8D2-4111-9DB2-E14B40B56512}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{7990067E-4C99-449B-B4C2-CDD605673A1A}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{FD9D95CF-9D96-4014-9A40-E88C005ED809}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes

"{487BF7DB-564B-4B92-AB68-0A70FB3D4DD7}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

"{3808EA10-F48F-4461-AFAD-1510D023D455}"= UDP:d:\transformers - revenge of the fallen\Transformers2.exe:Transformers - Revenge of the Fallen

"{B8376D2D-60F5-42CC-A8C1-1B528C2A3E39}"= TCP:d:\transformers - revenge of the fallen\Transformers2.exe:Transformers - Revenge of the Fallen

"{52250B61-5C22-4B28-981C-A416B113E711}"= UDP:d:\overlord ii\Overlord2.exe:Overlord II

"{5264A5A8-368C-4CE5-AED9-57FBD159A3A8}"= TCP:d:\overlord ii\Overlord2.exe:Overlord II

"{F79B1DC9-9C26-43F8-A8C2-EFD2264EA2A1}"= UDP:5353:Adobe CSI CS4

"{3C401BC8-766D-4FDE-8166-3056155DDD62}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4

"{8B0052B4-3B3D-4262-8377-6173192C85A3}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4

"{4942CB16-2931-4561-BC76-A7AA14318BB5}"= UDP:3703:Adobe Version Cue CS4 Server

"{FD1A6D10-5788-421C-9D0E-2A789F509D0B}"= UDP:3704:Adobe Version Cue CS4 Server

"{B5FBB78D-D40B-4F5B-AD6D-40F03CF902CE}"= UDP:51000:Adobe Version Cue CS4 Server

"{2DB37A8A-9AA1-4AC5-99B5-DC5B9B5A9323}"= UDP:51001:Adobe Version Cue CS4 Server

"{EFB1025A-B851-4287-B10D-9118A16E9469}"= UDP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server

"{9E5CC766-F484-4930-8AD0-E73BE38EC7F9}"= TCP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server

"{64B62B86-8E60-4CF0-9330-375BAA68AB6F}"= UDP:d:\anno 1404\Anno4.exe:ANNO 1404

"{8FC389A1-D8B3-465E-8510-0ADEB48CB410}"= TCP:d:\anno 1404\Anno4.exe:ANNO 1404

"{F720B46D-E96B-42A2-8A1B-D88AC2DD5F78}"= UDP:d:\anno 1404\tools\Anno4Web.exe:ANNO 1404 Web

"{4AFC37AA-E07C-4E1D-858C-F8004912E0AC}"= TCP:d:\anno 1404\tools\Anno4Web.exe:ANNO 1404 Web

"{27E66B4E-4A21-4140-8E94-023D6750253D}"= UDP:d:\steam\steamapps\common\america's army 3\Binaries\AA3Game.exe:America's Army 3

"{EF343252-6DCB-43B9-BABD-F16F50E12586}"= TCP:d:\steam\steamapps\common\america's army 3\Binaries\AA3Game.exe:America's Army 3

"{6FE06B31-9062-4F18-8B0C-109DD6C00233}"= UDP:d:\steam\steamapps\common\left 4 dead\left4dead.exe:Left 4 Dead

"{D2B1D9A9-75C4-4D22-BAE4-0D2926F5924C}"= TCP:d:\steam\steamapps\common\left 4 dead\left4dead.exe:Left 4 Dead

"TCP Query User{E886C9CD-0C61-4011-9BE6-291D59C6B671}d:\\diablo ii\\game.exe"= UDP:d:\diablo ii\game.exe:Diablo II

"UDP Query User{CE4F63F6-D2CC-46FC-814C-8DA1D12E96AB}d:\\diablo ii\\game.exe"= TCP:d:\diablo ii\game.exe:Diablo II

"TCP Query User{A0B34158-960F-4622-8EA6-F15EF1991CBB}d:\\mozilla firefox\\firefox.exe"= UDP:d:\mozilla firefox\firefox.exe:Firefox

"UDP Query User{95940556-3619-4F35-A7E4-7E93E589A45B}d:\\mozilla firefox\\firefox.exe"= TCP:d:\mozilla firefox\firefox.exe:Firefox

"{61A2A9C3-B827-4891-8CAC-DF53BDA84A43}"= UDP:d:\flock!\Flock.exe:FLOCK!

"{E2C61DF6-8BD6-465A-A458-2C5A651DDD1E}"= TCP:d:\flock!\Flock.exe:FLOCK!

"TCP Query User{B9006CD7-1081-49FE-A1B6-3E82A342507F}d:\\steam\\steamapps\\airandius\\team fortress 2\\hl2.exe"= UDP:d:\steam\steamapps\airandius\team fortress 2\hl2.exe:hl2

"UDP Query User{4128D298-8DDA-48DD-A323-A0ADBA323C33}d:\\steam\\steamapps\\airandius\\team fortress 2\\hl2.exe"= TCP:d:\steam\steamapps\airandius\team fortress 2\hl2.exe:hl2

"{AEFA9BB4-6447-4333-AE12-4EB68811FA0C}"= UDP:d:\steam\steamapps\common\america's army 3\Binaries\AA3Game.exe:America's Army 3

"{F7017544-42EE-49D8-9FDF-24B5488B3438}"= TCP:d:\steam\steamapps\common\america's army 3\Binaries\AA3Game.exe:America's Army 3

"{3C7B992C-1143-482D-BB93-D1877C0FD935}"= UDP:d:\steam\steamapps\common\left 4 dead\left4dead.exe:Left 4 Dead

"{04051D0D-3DE6-4983-9F0B-3EEE22B06F0F}"= TCP:d:\steam\steamapps\common\left 4 dead\left4dead.exe:Left 4 Dead

"{3ACCCB74-6439-4328-B11B-2949A81B0D31}"= UDP:d:\steam\steamapps\common\left 4 dead\bin\SDKLauncher.exe:Left 4 Dead Authoring Tools

"{9DC8F5AF-3E40-4822-A5DD-D5C79B9377DD}"= TCP:d:\steam\steamapps\common\left 4 dead\bin\SDKLauncher.exe:Left 4 Dead Authoring Tools

"{A7CE2871-70D5-44F3-A8D1-856B32C91791}"= UDP:d:\steam\steamapps\common\left 4 dead\bin\SDKLauncher.exe:Left 4 Dead Authoring Tools

"{D3D7F044-CE36-40E3-9AF5-66E2F2018B21}"= TCP:d:\steam\steamapps\common\left 4 dead\bin\SDKLauncher.exe:Left 4 Dead Authoring Tools

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [5/6/2008 3:07 PM 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [5/6/2008 3:07 PM 20560]

R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [5/6/2008 3:07 PM 53328]

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;d:\hamachi\hamachi-2.exe -s --> d:\hamachi\hamachi-2.exe -s [?]

R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\System32\drivers\atl01v32.sys [4/28/2008 1:33 PM 48128]

R3 athrusb;Atheros Wireless LAN USB device driver;c:\windows\System32\drivers\athrusb.sys [5/3/2008 3:06 PM 870400]

S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [8/15/2008 5:46 AM 284016]

S3 BT4501G;SpeedTouch 121g Wireless USB Adapter Driver;c:\windows\System32\drivers\BT4501G.sys [5/3/2008 3:18 PM 380128]

S3 CBPSp50;CBPSp50 NDIS Protocol Driver;c:\windows\System32\drivers\CBPSp50.sys [5/3/2008 2:42 PM 27072]

S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [8/2/2005 11:10 PM 32512]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

"c:\program files\Common Files\LightScribe\LSRunOnce.exe"

.

Inhoud van de 'Gedeelde Taken' map

2009-10-01 c:\windows\Tasks\User_Feed_Synchronization-{7399790C-AC2B-4CD8-A352-6C017D0A98C3}.job

- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.nl/

uInternet Settings,ProxyOverride = *.local

IE: Add to Windows &Live Favorites - Sign In

IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - d:\micros~1\OFFICE11\EXCEL.EXE/3000

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\mz6twv8p.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.nl/

FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll

FF - plugin: d:\adobe reader 9.0\Reader\browser\nppdf32.dll

FF - plugin: d:\mozilla firefox\plugins\np-mswmp.dll

FF - plugin: d:\mozilla firefox\plugins\npWebLaunch.dll

.

- - - - ORPHANS VERWIJDERD - - - -

HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

AddRemove-YouTube Downloader App - c:\program files\Red Kawa\Downloader App\uninstaller.exe

AddRemove-{0166E190-92D7-482A-A220-DE8B7354383A} - c:\users\Richard\AppData\Local\{67C33A62-5B1D-43D1-9600-16006F36EB2B}\setup.exe

AddRemove-{9A986603-03C1-45D0-9B18-A1695A55E51A} - c:\users\Richard\AppData\Local\{0BC8968B-5A12-4C72-ACF4-4CC9A9A6F102}\TweakVista_Setup.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2009-10-02 15:10

Windows 6.0.6001 Service Pack 1 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GarenaPEngine]

"ImagePath"="\??\c:\users\Richard\AppData\Local\Temp\CIYCA14.tmp"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\S-1-5-21-881388789-4157317966-2477145516-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0FD891F9-6187-DCE5-923E-42A0BCAD7F77}*]

"bblefhpipbobpkgpelndfhcbghaopbpmponn"=hex:61,62,6b,63,6d,65,67,68,6b,62,6b,70,

70,67,70,6d,70,69,6f,68,65,61,6b,61,6f,64,64,62,6c,65,65,6e,6f,66,00,63

"ablefhpipbobpkgpelodamcgcaabgkpebn"=hex:65,62,6c,65,67,6a,63,6d,6a,69,67,63,

63,62,6f,66,64,6b,68,6d,6e,6b,63,6f,6d,6a,65,69,69,6b,61,6b,6c,62,62,63,6d,\

[HKEY_USERS\S-1-5-21-881388789-4157317966-2477145516-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:ad,1e,16,39,94,43,c9,e9,a9,e8,f1,cc,ca,51,30,98,90,97,10,74,fa,ff,92,

e5,a4,dc,3d,d0,55,d3,7f,7f,aa,48,8f,2e,6b,2c,69,5d,8a,19,fc,9f,18,0a,64,e0,\

"??"=hex:9b,0f,f7,a5,d9,3a,0c,e2,ee,d1,ff,21,26,86,0a,c8

[HKEY_USERS\S-1-5-21-881388789-4157317966-2477145516-1000\Software\SecuROM\License information*]

"datasecu"=hex:2c,51,90,b9,3e,d5,22,fe,ee,4f,1c,3c,1e,a9,b6,5f,a7,d0,6a,93,52,

1f,45,2c,fb,3f,7f,de,d5,09,bf,16,b8,53,ae,ff,e7,8c,4e,e6,1b,74,cd,16,fb,48,\

"rkeysecu"=hex:34,d1,10,41,53,da,ff,93,40,af,ed,c7,ee,07,02,70

.

Voltooingstijd: 2009-10-02 15:11

ComboFix-quarantined-files.txt 2009-10-02 13:11

Pre-Run: 30,611,824,640 bytes beschikbaar

Post-Run: 30,992,265,216 bytes beschikbaar

375 --- E O F --- 2009-06-16 07:27

[kape]

Combofix heeft wel wat "beestjes" verwijderd. Je mag ervan uitgaan dat nu malware niet meer de oorzaak van je probleem is, maar dan lijkt het eerder hardware- of softwarematig te zijn.

We gaan eerst wel nog Combofix verwijderen : Start -> Uitvoeren en typ: combofix /u Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Verwijder volgende vetgedrukte map met Windows Verkenner : C:\Qoobox (indien nog aanwezig).

[Airandius]

Wat is dan de oorzaak? Moet ik nu verder vragen in de hardware forum?

[kape]

Lijkt me inderdaad het beste. Daar zitten de specialisten op dit vlak !