antivirus soft

brewie · 26 mei 2010

Er gaat ergens iets fout, ik kan nu niet meer via het startmenu en via de desktop internet niet openen.

hieronder mijn logje,

ComboFix 10-05-25.05 - Margareth 26-05-2010 17:10:07.2.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.2037.1250 [GMT 2:00]

Gestart vanuit: c:\users\Margareth\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Margareth\Desktop\CFScript.txt

SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Margareth\AppData\Local\xmoqohwvo

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_TpChoice

(((((((((((((((((((( Bestanden Gemaakt van 2010-04-26 to 2010-05-26 ))))))))))))))))))))))))))))))

.

2010-05-26 15:18 . 2010-05-26 17:01 -------- d-----w- c:\users\Margareth\AppData\Local\temp

2010-05-26 15:18 . 2010-05-26 15:18 -------- d-----w- c:\users\Public\AppData\Local\temp

2010-05-26 12:22 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-05-26 12:22 . 2010-05-26 12:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-05-26 12:22 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-05-26 08:15 . 2010-05-26 08:15 -------- d-----w- c:\users\Margareth\AppData\Roaming\Malwarebytes

2010-05-26 08:15 . 2010-05-26 08:15 -------- d-----w- c:\programdata\Malwarebytes

2010-05-26 06:37 . 2010-05-26 08:04 -------- d-----w- c:\windows\BDOSCAN8

2010-05-26 05:36 . 2010-04-23 14:13 2048 ----a-w- c:\windows\system32\tzres.dll

2010-05-25 20:16 . 2010-05-26 05:28 -------- d-----w- c:\program files\Spyware Doctor

2010-05-25 16:19 . 2010-05-25 16:19 -------- d-----w- c:\users\Margareth\AppData\Local\Power2Go

2010-05-25 16:02 . 2010-05-25 16:02 32 --s-a-w- c:\users\Margareth\AppData\Local\2576507741.dat

2010-05-21 03:50 . 2010-05-21 03:50 -------- d-----w- c:\users\Public\CyberLink

2010-05-20 17:46 . 2010-05-20 17:47 -------- d-----w- C:\Temp

2010-05-20 17:45 . 2010-05-20 17:45 53319 ----a-w- c:\programdata\TEMP\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\PostBuild.exe

2010-05-20 17:45 . 2010-05-20 17:47 16384 ----a-w- c:\windows\system32\lgfwunis.exe

2010-05-20 17:45 . 1998-07-21 22:00 102912 ----a-w- c:\windows\system32\Vb6stkit.dll

2010-05-20 17:45 . 2010-05-26 12:34 -------- d-----w- c:\program files\lg_fwupdate

2010-05-20 17:44 . 2010-05-20 17:44 36864 ----a-w- c:\programdata\TEMP\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\PostBuild.exe

2010-05-20 17:42 . 2010-05-20 17:42 36864 ----a-w- c:\programdata\TEMP\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\PostBuild.exe

2010-05-20 17:41 . 2010-05-20 17:41 -------- d-----w- c:\program files\Common Files\CyberLink

2010-05-20 17:40 . 2010-05-20 17:40 53319 ----a-w- c:\programdata\TEMP\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\PostBuild.exe

2010-05-20 17:40 . 2010-05-26 12:32 -------- d-----w- c:\users\Margareth\AppData\Roaming\CyberLink

2010-05-20 17:39 . 2009-01-08 09:20 34088 ----a-w- c:\programdata\CyberLink\Power2Go\P2GoGadget.dll

2010-05-20 17:38 . 2010-05-20 17:38 36864 ----a-w- c:\programdata\TEMP\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe

2010-05-20 17:37 . 2010-05-20 17:37 53319 ----a-w- c:\programdata\TEMP\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\PostBuild.exe

2010-05-20 17:36 . 2010-05-20 17:46 -------- d-----w- c:\program files\CyberLink

2010-05-20 17:36 . 2010-05-21 03:50 -------- d-----w- c:\programdata\CyberLink

2010-05-20 17:36 . 2010-05-20 17:35 53319 ----a-w- c:\programdata\TEMP\{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}\PostBuild.exe

2010-05-12 13:13 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll

2010-05-09 11:28 . 2010-05-09 11:28 -------- d-----r- c:\users\Public\Recorded TV

2010-04-29 20:11 . 2009-05-18 11:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2010-04-29 20:11 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2010-04-29 20:10 . 2010-04-29 20:10 -------- d-----w- c:\program files\iPod

2010-04-29 20:09 . 2010-04-29 20:09 -------- d-----w- c:\program files\Apple Software Update

2010-04-29 20:05 . 2010-04-29 20:05 -------- d-----w- c:\program files\Bonjour

2010-04-28 13:45 . 2010-04-28 13:45 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.1.12\SetupAdmin.exe

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-26 15:25 . 2006-11-02 16:11 744168 ----a-w- c:\windows\system32\perfh013.dat

2010-05-26 15:25 . 2006-11-02 16:11 159632 ----a-w- c:\windows\system32\perfc013.dat

2010-05-26 13:49 . 2008-02-27 18:13 149023 ----a-w- c:\windows\HPHins15.dat

2010-05-26 12:08 . 2008-11-07 07:48 -------- d-----w- c:\users\Margareth\AppData\Roaming\Belastingdienst

2010-05-26 11:31 . 2009-02-23 18:19 -------- d-----w- c:\users\Margareth\AppData\Roaming\uTorrent

2010-05-26 11:30 . 2008-07-21 10:34 -------- d-----w- c:\users\Margareth\AppData\Roaming\Vso

2010-05-25 21:38 . 2007-10-27 14:23 5892 ----a-w- c:\users\Margareth\AppData\Local\d3d9caps.dat

2010-05-25 21:07 . 2009-10-22 18:04 -------- d-----w- c:\program files\DAEMON Tools Lite

2010-05-25 21:07 . 2008-12-08 08:04 -------- d-----w- c:\program files\Bit Che

2010-05-21 03:50 . 2008-08-18 11:45 118064 ----a-w- c:\users\Margareth\AppData\Local\GDIPFONTCACHEV1.DAT

2010-05-20 17:46 . 2007-03-20 16:08 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-05-20 17:40 . 2003-03-18 20:14 505128 ----a-w- c:\windows\system32\msvcp71.dll

2010-05-20 17:40 . 2003-02-21 04:42 353576 ----a-w- c:\windows\system32\msvcr71.dll

2010-05-16 09:30 . 2009-02-23 18:19 -------- d-----w- c:\program files\uTorrent

2010-05-16 09:26 . 2007-09-24 08:18 -------- d-----w- c:\program files\Common Files\Exact Shared

2010-05-16 09:22 . 2007-11-01 17:35 -------- d-----w- c:\users\Margareth\AppData\Roaming\Bapi

2010-05-13 01:20 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail

2010-05-12 09:21 . 2009-10-03 00:11 221568 ------w- c:\windows\system32\MpSigStub.exe

2010-04-29 20:10 . 2010-02-24 15:40 -------- d-----w- c:\program files\Common Files\Apple

2010-04-29 04:09 . 2009-02-14 18:28 -------- d-----w- c:\program files\Google

2010-04-28 18:01 . 2007-08-26 12:58 -------- d-----w- c:\program files\itunes

2010-04-25 14:55 . 2010-04-25 14:55 -------- d-----w- c:\users\Margareth\AppData\Roaming\Samsung

2010-04-25 14:11 . 2010-04-25 14:11 -------- d-----w- c:\program files\Samsung

2010-04-24 06:28 . 2008-08-12 17:38 -------- d-----w- c:\program files\Common Files\Nero

2010-04-24 06:22 . 2009-03-23 23:30 -------- d-----w- c:\program files\BurnAware Professional

2010-04-18 17:57 . 2007-11-27 18:59 -------- d-----w- c:\program files\Belastingdienst

2010-04-18 17:56 . 2008-08-30 10:48 -------- d-----w- c:\program files\PokerStars.NET

2010-04-16 06:33 . 2010-04-16 06:33 41472 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2010-04-16 06:33 . 2010-04-16 06:33 3003680 ----a-w- c:\windows\system32\usbaaplrc.dll

2010-04-11 11:21 . 2008-04-06 18:11 -------- d-----w- c:\programdata\Installations

2010-04-11 11:20 . 2008-04-06 18:20 -------- d-----w- c:\program files\Common Files\Nokia

2010-04-11 11:20 . 2008-04-06 18:15 -------- d-----w- c:\program files\Nokia

2010-04-08 11:20 . 2010-04-08 11:20 91424 ----a-w- c:\windows\system32\dnssd.dll

2010-04-08 11:20 . 2010-04-08 11:20 107808 ----a-w- c:\windows\system32\dns-sd.exe

2010-04-05 07:03 . 2010-04-05 07:02 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2010-04-05 06:59 . 2010-04-05 06:58 -------- d-----w- c:\program files\QuickTime

2010-03-05 14:01 . 2010-04-14 10:54 420352 ----a-w- c:\windows\system32\vbscript.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]

"RtHDVCpl"="RtHDVCpl.exe" [2007-01-18 4349952]

"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-19 411768]

"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]

"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-02-06 509496]

"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-01-17 534648]

"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-06 34352]

"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2006-11-01 413696]

"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-01-13 90191]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-01-13 7766016]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-01-13 81920]

"SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-03-22 438272]

"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-09-11 180224]

"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2007-02-19 571024]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-03-20 1451304]

"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-07-27 204800]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-11 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-11 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-11 133656]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]

"iTunesHelper"="e:\itunes\iTunesHelper.exe" [2010-04-28 142120]

"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]

"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]

"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-02-17 218408]

"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2010-05-20 557056]

"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-09-29 210216]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth Monitor.lnk - c:\program files\TOSHIBA\Bluetooth Monitor\BtMon2.exe [2007-9-14 69632]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-4-28 415072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"VistaSp2"=hex(:2a,df,72,62,a2,3d,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2656932112-1169786959-795547525-1000]

"EnableNotificationsRef"=dword:00000001

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-10-22 721904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

Inhoud van de 'Gedeelde Taken' map

2010-05-26 c:\windows\Tasks\User_Feed_Synchronization-{53D871B2-BC4B-40A3-BFC7-503DEE825548}.job

- c:\windows\system32\msfeedssync.exe [2010-03-30 04:54]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.nl/

uInternet Settings,ProxyOverride = <local>

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-05-26 19:00

Windows 6.0.6002 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, GMER - Rootkit Detector and Remover

device: opened successfully

user: MBR read successfully

called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x84A0D1F8]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

\Driver\Disk -> CLASSPNP.SYS @ 0x881c8d24

\Driver\ACPI -> acpi.sys @ 0x82772d68

\Driver\atapi -> 0x84a0d1f8

IoDeviceObjectType ->\Device\Harddisk0\DR0 ->Warning: possible MBR rootkit infection !

user & kernel MBR OK

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

c:\windows\system32\agrsmsvc.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

c:\program files\CyberLink\Shared files\RichVideo.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe

c:\windows\system32\TODDSrv.exe

c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\system32\conime.exe

c:\windows\RtHDVCpl.exe

c:\windows\System32\rundll32.exe

c:\windows\system32\igfxsrvc.exe

c:\windows\system32\wbem\unsecapp.exe

c:\windows\ehome\ehmsas.exe

c:\program files\Windows Live\Contacts\wlcomm.exe

c:\program files\Synaptics\SynTP\SynToshiba.exe

c:\program files\Synaptics\SynTP\SynTPHelper.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe

.

**************************************************************************

.

Voltooingstijd: 2010-05-26 19:05:57 - machine werd herstart

ComboFix-quarantined-files.txt 2010-05-26 17:05

ComboFix2.txt 2010-05-26 13:48

Pre-Run: 26.570.338.304 bytes beschikbaar

Post-Run: 27.220.033.536 bytes beschikbaar

- - End Of File - - 479806A06D6C9836AF8CFAE7E8E7F6A1

---------- Post toegevoegd om 19:16 ---------- Vorige post was om 19:11 ----------

het bovengenoemde geldt voor alle programma's

kape · 26 mei 2010

Kan je via de PC nog bij systeemherstel komen ?

brewie · 27 mei 2010

via veligemodus kan ik een punt vinden van voor de vorige actie

moet ik deze nemen?

kape · 27 mei 2010

via veligemodus kan ik een punt vinden van voor de vorige actie moet ik deze nemen?

Indien je daar dit oude herstelpunt mee kan terugzetten ... jazeker

brewie · 27 mei 2010

Dat ga ik dan meteen doen als ik vanovond thuis ben moet ik dan nog ergens een log van maken?

kape · 27 mei 2010

Dat ga ik dan meteen doen als ik vanovond thuis ben moet ik dan nog ergens een log van maken?

Laten we dan eerst terug beginnen met een log van HijackThis ter controle.

brewie · 27 mei 2010

systeem is terug gezet. Pc opnieuw gestart. krijg nog wel de oude melding. maar de programma's zijn weer te openen.

hierbij een nieuw logje

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 18:32:47, on 27-5-2010

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18904)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\TOSHIBA\Utilities\KeNotify.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe

E:\Itunes\iTunesHelper.exe

C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe

C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

C:\Program Files\TOSHIBA\Bluetooth Monitor\BtMon2.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\Windows\system32\igfxsrvc.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\System32\rundll32.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Users\Margareth\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: Aanmeldhulp voor Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: TBSB07500 - {C89733F1-C3AE-4283-86DD-2AEE11E701F2} - C:\Program Files\HyvesToolbar\Hyves Toolbar\tbcore3.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: Hyves Toolbar - {AB8DC1E0-22BE-4181-B77E-02C495E031F8} - C:\Program Files\HyvesToolbar\Hyves Toolbar\tbcore3.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe

O4 - HKLM\..\Run: [smoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe

O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe

O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [synTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "E:\Itunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [updateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"

O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"

O4 - HKLM\..\Run: [updateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"

O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"

O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"

O4 - HKLM\..\Run: [updatePPShortCut] "C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"

O4 - HKLM\..\Run: [uCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"

O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun

O4 - HKLM\..\Run: [updatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler

O4 - Global Startup: Bluetooth Monitor.lnk = ?

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: HP Clipboek - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll

O9 - Extra button: HP Slim selecteren - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://cache.hyves-static.net/statics/Aurigma/ImageUploader4.cab

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)

O23 - Service: Planner voor Automatische LiveUpdate - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

--

End of file - 10813 bytes

kape · 27 mei 2010

Om te bekijken waar de problemen zich manifesteren, gaan we nu stap-na-stap bepaalde handelingen herhalen. Zal wel wat langer duren ... maar gezien de vreemde reactie na de vorige behandeling met Combofix, moet het - helaas - wel zo.

Start Hijackthis op. Ben je gebruiker van Vista kies dan voor “Run as administrator" of "Uitvoeren als administrator". Selecteer “Do a system scan only”. Selecteer alleen de items die hieronder zijn genoemd:

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: TBSB07500 - {C89733F1-C3AE-4283-86DD-2AEE11E701F2} - C:\Program Files\HyvesToolbar\Hyves Toolbar\tbcore3.dll

O3 - Toolbar: Hyves Toolbar - {AB8DC1E0-22BE-4181-B77E-02C495E031F8} - C:\Program Files\HyvesToolbar\Hyves Toolbar\tbcore3.dll

Klik op 'Fix checked' om de items te verwijderen.

Laat daarna opnieuw Malwarebytes scannen en hang het logje van Malwarebytes, samen met een nieuw log van HijackThis in je volgende bericht.

Wil je hierbij ook even melden of de valse virusmelding nà opstarten nog verschijnt ?

brewie · 27 mei 2010

Bij het opstarten geeft ie nog de melding dat er geblokeerde opstartprogramma's zijn (fwupdate en malware)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 20:35:21, on 27-5-2010