vastlopen bij opstart Vista

RS4ever · 12 juli 2010

Ik heb FindyKill laten lopen. Hier is het logje:

----------------- FindyKill V4.005 ------------------

* User : Yves - PC_VAN_YVES

* Emplacement : C:\Program Files\FindyKill

* Outils Mis a jours le 17/10/08 par Chiquitine29

* Recherche effectuée à 10:27:20 le ma 12/07/2010

* Windows_NT - Internet Explorer 8.0.6001.18928

((((((((((((((((( *** Recherche *** ))))))))))))))))))

--------------- [ Processus actifs ] ----------------

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Oxigen\bin\Oxigen.exe

C:\Program Files\Oxigen\bin\OxiTray.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe

C:\Program Files\Alwil Software\Avast5\AvastUI.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Windows\system32\svchost.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\SearchIndexer.exe

C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

C:\Program Files\adidas\miCoach Manager\miCoachManager.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\ehome\ehRecvr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe

C:\Windows\system32\Macromed\Flash\FlashUtil10c.exe

C:\Windows\System32\mobsync.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\conime.exe

C:\Windows\system32\wbem\wmiprvse.exe

--------------- [ Fichiers/Dossiers infectieux ] ----------------

»»»» Presence des fichiers dans C:

»»»» Presence des fichiers dans C:\Windows

»»»» Presence des fichiers dans C:\Windows\Prefetch

Present ! - C:\Windows\prefetch\MDELK.EXE-5D6CB589.pf

»»»» Presence des fichiers dans C:\Windows\system32

»»»» Presence des fichiers dans C:\Windows\system32\drivers

»»»» Presence des fichiers dans C:\Users\Yves.PC_van_2\AppData\Roaming

»»»» Presence des fichiers dans C:\Users\YVES~1.PC_\AppData\Local\Temp

--------------- [ Registre / Startup ] ----------------

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Windows Defender REG_EXPAND_SZ %ProgramFiles%\Windows Defender\MSASCui.exe -hide

RtHDVCpl REG_SZ RtHDVCpl.exe

NeroFilterCheck REG_SZ C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

toolbar_eula_launcher REG_SZ C:\Program Files\GoogleEULA\EULALauncher.exe

Skytel REG_SZ Skytel.exe

SSBkgdUpdate REG_SZ "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

OpwareSE4 REG_SZ "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

QuickTime Task REG_SZ "C:\Program Files\QuickTime\QTTask.exe" -atboottime

iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"

OxigenClientAdmin REG_SZ "C:\Program Files\Oxigen\bin\Oxigen.exe"

OxigenTrayIcon REG_SZ "C:\Program Files\Oxigen\bin\OxiTray.exe"

SunJavaUpdateSched REG_SZ "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

itype REG_SZ "C:\Program Files\Microsoft IntelliType Pro\itype.exe"

IntelliPoint REG_SZ "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"

Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

Adobe ARM REG_SZ "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

avast5 REG_SZ C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Sidebar REG_SZ C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

ehTray.exe REG_SZ C:\Windows\ehome\ehTray.exe

swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

micoach REG_SZ "C:\Program Files\adidas\miCoach Manager\miCoachManager.exe" /autostart

--------------- [ Registre / Clés infectieuses ] ----------------

Présent ! - HKEY_USERS\S-1-5-21-152359401-3691557688-741070910-1000\Software\Ubisoft

--------------- [ Etat / Services ] ----------------

+- Services : [ Auto=2 Demande=3 Désactivé=4 ]

Ndisuio - Type de démarrage = 3

EapHost - Type de démarrage = 3

Wlansvc - Type de démarrage = 3

/!\ SharedAccess - Type de démarrage = 4

wuauserv - Type de démarrage = 2

wscsvc - Type de démarrage = 2

--------------- [ Recherche dans supports amovibles] ----------------

+- Informations :

C: - vast station

D: - vast station

G: - vast station

+- presence des fichiers :

--------------- [ Registre / Moutpoint2 ] ----------------

-> Recherche négative.

------------------- ! Fin du rapport ! --------------------

kape · 12 juli 2010

OK, dan mag je nu hetzelfde uitvoeren maar met optie 2.

RS4ever · 12 juli 2010

voila!

----------------- FindyKill V4.005 ------------------

* User : Yves - PC_VAN_YVES

* Emplacement : C:\Program Files\FindyKill

* Outils Mis a jours le 17/10/08 par Chiquitine29

* Suppression effectuée à 13:04:07 le ma 12/07/2010

* Windows_NT - Internet Explorer 8.0.6001.18928

((((((((((((((( *** Suppression *** ))))))))))))))))))

--------------- [ Processus actifs ] ----------------

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\LogonUI.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\Windows\system32\userinit.exe

C:\Windows\system32\Dwm.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Windows\system32\svchost.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\SearchIndexer.exe

C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\runonce.exe

C:\Windows\system32\conime.exe

C:\Program Files\Alwil Software\Avast5\setup\avast.setup

--------------- [ Fichiers/Dossiers infectieux ] ----------------

»»»» Suppression des fichiers dans C:

»»»» Suppression des fichiers dans C:\Windows

»»»» Suppression des fichiers dans C:\Windows\Prefetch

Supprimé ! - C:\Windows\Prefetch\GOOGLETOOLBARUSER_32.EXE-6E5896AD.pf

Supprimé ! - C:\Windows\Prefetch\I4JDEL0.EXE-C4CCC686.pf

Supprimé ! - C:\Windows\Prefetch\WINTEMS.EXE-1A5C788B.pf

»»»» Suppression des fichiers dans C:\Windows\system32

»»»» Suppression des fichiers dans C:\Windows\system32\drivers

»»»» Suppression des fichiers dans C:\Users\Yves.PC_van_2\AppData\Roaming

»»»» Suppression des fichiers dans C:\Users\YVES~1.PC_\AppData\Local\Temp

Supprimé ! - C:\Users\YVES~1.PC_\AppData\Local\Temp\HouseCall\bspatch.exe

--------------- [ Registre / Clés infectieuses ] ----------------

Supprimé ! - HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA

Supprimé ! - HKEY_USERS\S-1-5-21-152359401-3691557688-741070910-1000\Software\Ubisoft

-> Certaines clés ont été supprimées au premier reboot ...

--------------- [ Etat / Redémarage des services ] ----------------

+- Mode sans echec restauré !

+- Services : [ Auto=2 Demande=3 Désactivé=4 ]

Ndisuio - Type de démarrage = 2

EapHost - Type de démarrage = 2

Wlansvc - Type de démarrage = 2

SharedAccess - Type de démarrage = 2

wuauserv - Type de démarrage = 2

wscsvc - Type de démarrage = 2

--------------- [ Nettoyage des supports amovibles ] ----------------

+- Informations :

C: - vast station

D: - vast station

G: - vast station

+- Suppression des fichiers :

--------------- [ Registre / Moutpoint2 ] ----------------

-> Recherche négative.

--------------- [ Recherche Cracks / Keygen ] ----------------

---------------- ! Fin du rapport ! ------------------

kape · 12 juli 2010

Wil je eens kijken of volgende bestanden zich nog op je PC bevinden en zo ja in welke map ?

WINTEMS.EXE

I4JDEL0.EXE

MDELK.EXE

RS4ever · 12 juli 2010

Dat zal ik direct doen!

Ondertussen heb ik nog eens geprobeerd om ComboFix te laten lopen en dit keer deed hij het prima!

Hier is het logje:

ComboFix 10-07-11.03 - Yves 12/07/2010 15:50:57.1.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.2047.1045 [GMT 2:00]

Gestart vanuit: c:\users\Yves.PC_van_2\Desktop\ComboFix.exe

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

SP: avast! Antivirus *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}

SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Voorgaande Run -------

.

c:\windows\system32\msconfig.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-06-12 to 2010-07-12 ))))))))))))))))))))))))))))))

.

2010-07-12 13:46 . 2010-07-12 13:46 -------- d-----w- c:\users\Yves.PC_van_2\AppData\Local\Adobe

2010-07-12 13:30 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-12 13:30 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-07-12 11:56 . 2010-07-12 11:56 63488 ----a-w- c:\users\Yves.PC_van_2\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll

2010-07-12 11:56 . 2010-07-12 11:56 52224 ----a-w- c:\users\Yves.PC_van_2\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll

2010-07-12 11:56 . 2010-07-12 11:56 117760 ----a-w- c:\users\Yves.PC_van_2\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2010-07-12 11:56 . 2010-07-12 11:56 -------- d-----w- c:\users\Yves.PC_van_2\AppData\Roaming\SUPERAntiSpyware.com

2010-07-12 11:55 . 2010-07-12 11:56 -------- d-----w- c:\program files\SUPERAntiSpyware

2010-07-12 11:46 . 2010-07-12 11:46 -------- d-----w- c:\programdata\SUPERAntiSpyware.com

2010-07-12 10:25 . 2010-07-12 10:25 -------- d-----w- c:\users\Yves.PC_van_2\AppData\Local\Apple

2010-07-12 08:43 . 2010-07-12 10:20 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2010-07-12 08:43 . 2010-07-12 10:20 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-07-12 08:26 . 2010-07-12 11:12 -------- d-----w- c:\program files\FindyKill

2010-07-11 15:27 . 2010-07-11 22:35 -------- d-----w- c:\users\Yves.PC_van_2\AppData\Local\Temp(23)

2010-06-30 11:26 . 2010-06-30 11:26 -------- d-----w- c:\program files\Windows Portable Devices

2010-06-29 23:52 . 2009-09-10 02:01 3023360 ----a-w- c:\windows\system32\UIRibbon.dll

2010-06-29 23:52 . 2009-09-10 02:00 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll

2010-06-29 23:52 . 2009-09-10 02:00 92672 ----a-w- c:\windows\system32\UIAnimation.dll

2010-06-29 23:52 . 2009-09-25 01:33 369664 ----a-w- c:\windows\system32\WMPhoto.dll

2010-06-29 23:52 . 2009-09-25 01:27 634880 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2010-06-29 23:52 . 2009-09-25 01:27 37888 ----a-w- c:\windows\system32\cdd.dll

2010-06-29 23:52 . 2009-09-24 22:54 258048 ----a-w- c:\windows\system32\winspool.drv

2010-06-29 23:52 . 2009-09-25 01:36 280064 ----a-w- c:\windows\system32\XpsGdiConverter.dll

2010-06-29 23:52 . 2009-09-25 01:35 135680 ----a-w- c:\windows\system32\XpsRasterService.dll

2010-06-29 23:52 . 2009-09-25 01:33 829440 ----a-w- c:\windows\system32\d3d10warp.dll

2010-06-29 23:52 . 2009-09-25 01:31 828928 ----a-w- c:\windows\system32\d2d1.dll

2010-06-29 23:52 . 2009-09-24 22:54 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll

2010-06-29 23:50 . 2009-10-08 21:08 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll

2010-06-29 23:50 . 2009-10-08 21:08 234496 ----a-w- c:\windows\system32\oleacc.dll

2010-06-29 23:50 . 2009-10-08 21:07 4096 ----a-w- c:\windows\system32\oleaccrc.dll

2010-06-29 22:47 . 2010-06-29 22:47 -------- d-----w- C:\found.000

2010-06-29 09:12 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr

2010-06-28 12:49 . 2010-06-28 12:49 -------- d-----w- c:\programdata\WindowsSearch

2010-06-27 22:16 . 2010-06-27 22:17 -------- d-----w- c:\windows\system32\ca-ES

2010-06-27 22:16 . 2010-06-27 22:17 -------- d-----w- c:\windows\system32\eu-ES

2010-06-27 22:16 . 2010-06-27 22:17 -------- d-----w- c:\windows\system32\vi-VN

2010-06-27 21:59 . 2010-06-27 21:59 -------- d-----w- c:\windows\system32\EventProviders

2010-06-27 21:40 . 2009-04-11 05:03 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll

2010-06-27 21:40 . 2009-04-11 06:28 1081344 ----a-w- c:\windows\system32\SLCExt.dll

2010-06-27 21:40 . 2009-04-11 06:27 3408896 ----a-w- c:\windows\system32\SLsvc.exe

2010-06-27 21:40 . 2009-04-11 06:28 2134528 ----a-w- c:\windows\system32\FunctionDiscoveryFolder.dll

2010-06-27 21:40 . 2009-04-11 06:27 65536 ----a-w- c:\windows\system32\DevicePairingWizard.exe

2010-06-27 21:40 . 2009-04-11 05:03 2644480 ----a-w- c:\windows\system32\NlsLexicons0009.dll

2010-06-27 21:40 . 2009-04-11 06:28 1480704 ----a-w- c:\windows\system32\mssrch.dll

2010-06-27 21:38 . 2009-04-11 06:28 1086464 ----a-w- c:\windows\system32\NetProjW.dll

2010-06-27 21:37 . 2009-04-11 06:28 560640 ----a-w- c:\windows\system32\msdtcprx.dll

2010-06-27 21:36 . 2009-04-11 06:28 98816 ----a-w- c:\windows\system32\powrprof.dll

2010-06-27 21:35 . 2009-04-11 04:39 19456 ----a-w- c:\windows\system32\drivers\Diskdump.sys

2010-06-27 21:34 . 2009-04-11 06:28 705536 ----a-w- c:\windows\system32\SmiEngine.dll

2010-06-27 21:34 . 2009-04-11 06:28 218624 ----a-w- c:\windows\system32\wdscore.dll

2010-06-27 21:34 . 2009-04-11 06:27 130560 ----a-w- c:\windows\system32\PkgMgr.exe

2010-06-27 21:31 . 2009-04-11 06:28 247808 ----a-w- c:\windows\system32\drvstore.dll

2010-06-27 21:31 . 2008-05-27 04:59 18904 ----a-w- c:\windows\system32\StructuredQuerySchemaTrivial.bin

2010-06-27 21:25 . 2010-06-27 21:25 388096 ----a-r- c:\users\Yves.PC_van_2\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-06-27 21:22 . 2009-11-08 08:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll

2010-06-27 21:22 . 2009-11-08 08:55 297808 ----a-w- c:\windows\system32\mscoree.dll

2010-06-27 21:22 . 2009-11-08 08:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe

2010-06-27 21:22 . 2009-11-08 08:55 49472 ----a-w- c:\windows\system32\netfxperf.dll

2010-06-27 21:22 . 2009-11-08 08:55 1130824 ----a-w- c:\windows\system32\dfshim.dll

2010-06-27 21:07 . 2010-06-27 21:07 -------- d-----w- c:\program files\Trend Micro

2010-06-27 20:50 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll

2010-06-27 20:50 . 2010-04-05 17:01 67072 ----a-w- c:\windows\system32\asycfilt.dll

2010-06-27 20:50 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll

2010-06-27 20:50 . 2010-04-16 16:43 28672 ----a-w- c:\windows\system32\Apphlpdm.dll

2010-06-27 20:50 . 2010-04-16 14:39 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll

2010-06-27 20:50 . 2010-04-23 14:13 2048 ----a-w- c:\windows\system32\tzres.dll

2010-06-27 20:50 . 2010-05-26 14:47 289792 ----a-w- c:\windows\system32\atmfd.dll

2010-06-27 20:50 . 2010-05-26 17:06 34304 ----a-w- c:\windows\system32\atmlib.dll

2010-06-24 21:18 . 2010-06-24 21:19 -------- d-----w- c:\program files\NVIDIA Corporation

2010-06-24 14:40 . 2010-06-24 14:40 -------- d-----w- C:\PerfLogs

2010-06-23 10:07 . 2010-06-23 10:07 501936 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb255C.tmp.exe

2010-06-22 13:04 . 2010-02-04 08:01 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll

2010-06-22 13:04 . 2010-02-04 08:01 528216 ----a-w- c:\windows\system32\XAudio2_6.dll

2010-06-22 13:04 . 2010-02-04 08:01 238936 ----a-w- c:\windows\system32\xactengine3_6.dll

2010-06-22 13:04 . 2010-02-04 08:01 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll

2010-06-22 13:04 . 2009-09-04 15:44 515416 ----a-w- c:\windows\system32\XAudio2_5.dll

2010-06-22 13:04 . 2009-09-04 15:44 238936 ----a-w- c:\windows\system32\xactengine3_5.dll

2010-06-22 13:04 . 2009-09-04 15:29 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll

2010-06-22 13:04 . 2009-09-04 15:29 235344 ----a-w- c:\windows\system32\d3dx11_42.dll

2010-06-22 13:04 . 2009-09-04 15:29 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll

2010-06-22 13:04 . 2009-09-04 15:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll

2010-06-22 13:04 . 2009-09-04 15:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

2010-06-22 13:04 . 2009-09-04 15:44 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-12 13:42 . 2009-11-30 19:37 -------- d-----w- c:\program files\Spyware Doctor

2010-07-12 13:30 . 2010-06-07 11:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-12 12:26 . 2009-06-20 23:59 52597 ----a-w- c:\programdata\nvModes.dat

2010-07-12 12:26 . 2007-08-16 08:23 -------- d---a-w- c:\program files\GoogleEULA

2010-07-12 11:30 . 2009-06-20 20:22 1356 ----a-w- c:\users\Yves.PC_van_2\AppData\Local\d3d9caps.dat

2010-07-12 11:17 . 2009-06-20 20:23 85248 ----a-w- c:\users\Yves.PC_van_2\AppData\Local\GDIPFONTCACHEV1.DAT

2010-07-12 08:31 . 2009-07-18 23:03 -------- d-----w- c:\users\Yves.PC_van_2\AppData\Roaming\Media Player Classic

2010-07-11 22:55 . 2006-11-02 16:11 676772 ----a-w- c:\windows\system32\perfh013.dat

2010-07-11 22:55 . 2006-11-02 16:11 131268 ----a-w- c:\windows\system32\perfc013.dat

2010-06-30 11:26 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat

2010-06-30 11:25 . 2010-06-30 11:25 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf

2010-06-28 20:57 . 2010-06-07 11:47 165032 ----a-w- c:\windows\system32\aswBoot.exe

2010-06-28 20:37 . 2010-06-07 11:49 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2010-06-28 20:37 . 2010-06-07 11:49 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys

2010-06-28 20:33 . 2010-06-07 11:49 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2010-06-28 20:32 . 2010-06-07 11:49 50256 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2010-06-28 20:32 . 2010-06-07 11:49 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2010-06-27 22:17 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar

2010-06-27 22:17 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal

2010-06-27 22:17 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration

2010-06-27 22:17 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar

2010-06-27 22:17 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail

2010-06-27 22:17 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery

2010-06-27 22:17 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender

2010-06-27 21:10 . 2010-05-28 15:24 -------- d-----w- c:\program files\CCleaner

2010-06-27 20:34 . 2007-08-16 08:23 -------- d-----w- c:\program files\Google

2010-06-24 21:19 . 2009-06-20 23:56 -------- d-----w- c:\programdata\NVIDIA

2010-06-24 17:05 . 2010-04-19 13:50 10145433 ----a-w- c:\users\Yves.PC_van_2\AppData\Roaming\adidas\miCoach Manager\miCoachManagerSetup.exe

2010-06-24 16:59 . 2010-06-24 16:59 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf

2010-06-24 14:25 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll

2010-06-24 14:24 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll

2010-06-22 13:04 . 2010-05-08 02:22 -------- d-----w- c:\program files\Ubisoft

2010-06-22 13:04 . 2007-08-13 12:39 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-06-13 00:01 . 2007-08-15 14:19 -------- d-----w- c:\programdata\Microsoft Help

2010-06-07 11:46 . 2010-06-07 11:46 -------- d-----w- c:\programdata\Alwil Software

2010-06-07 11:46 . 2009-06-28 09:36 -------- d-----w- c:\program files\Alwil Software

2010-06-07 11:19 . 2010-06-07 11:19 -------- d-----w- c:\users\Yves.PC_van_2\AppData\Roaming\Malwarebytes

2010-06-07 11:19 . 2010-06-07 11:19 -------- d-----w- c:\programdata\Malwarebytes

2010-06-04 17:21 . 2009-10-12 17:47 -------- d-----w- c:\program files\Microsoft Silverlight

2010-05-28 00:20 . 2010-05-28 00:20 -------- d-----w- c:\users\Yves.PC_van_2\AppData\Roaming\PlayFirst

2010-05-28 00:20 . 2010-05-28 00:20 -------- d-----w- c:\programdata\PlayFirst

2010-05-27 23:54 . 2010-05-27 23:54 -------- d-----w- c:\program files\ReflexiveArcade

2010-05-21 12:14 . 2009-10-02 18:07 221568 ------w- c:\windows\system32\MpSigStub.exe

2010-05-05 23:02 . 2010-05-05 23:02 418480 ----a-w- c:\windows\system32\wrap_oal.dll

2010-05-05 23:02 . 2010-05-05 23:02 115432 ----a-w- c:\windows\system32\OpenAL32.dll

2010-05-04 05:59 . 2010-06-27 20:49 916480 ----a-w- c:\windows\system32\wininet.dll

2010-05-04 05:55 . 2010-06-27 20:49 109056 ----a-w- c:\windows\system32\iesysprep.dll

2010-05-04 05:55 . 2010-06-27 20:49 71680 ----a-w- c:\windows\system32\iesetup.dll

2010-05-04 04:31 . 2010-06-27 20:49 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2010-05-01 14:13 . 2010-06-27 20:49 2037248 ----a-w- c:\windows\system32\win32k.sys

2010-04-21 23:04 . 2010-04-21 23:05 38784 ----a-w- c:\users\Yves.PC_van_2\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2010-04-21 23:04 . 2010-04-21 23:05 38784 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2010-04-16 16:43 . 2010-06-27 20:50 173056 ----a-w- c:\windows\AppPatch\AcXtrnal.dll

2010-04-16 16:43 . 2010-06-27 20:50 458752 ----a-w- c:\windows\AppPatch\AcSpecfc.dll

2010-04-16 16:43 . 2010-06-27 20:50 542720 ----a-w- c:\windows\AppPatch\AcLayers.dll

2010-04-16 16:43 . 2010-06-27 20:50 2159616 ----a-w- c:\windows\AppPatch\AcGenral.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-22 39408]

"micoach"="c:\program files\adidas\miCoach Manager\miCoachManager.exe" [2010-04-04 6990800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]

"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 4669440]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"toolbar_eula_launcher"="c:\program files\GoogleEULA\EULALauncher.exe" [2007-02-09 16896]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]

"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]

"OxigenClientAdmin"="c:\program files\Oxigen\bin\Oxigen.exe" [2007-06-23 887264]

"OxigenTrayIcon"="c:\program files\Oxigen\bin\OxiTray.exe" [2007-06-23 557536]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]

@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"VistaSp2"=hex(:e5,b8,b5,5a,47,16,cb,01

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 135664]

R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-02-04 1181328]

R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-09-23 358600]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-09-23 64288]

S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-09-23 207280]

S1 aswSP;aswSP; [x]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]

S1 SAS***IL;SAS***IL;c:\program files\SUPERAntiSpyware\SAS***IL.SYS [2010-05-10 67656]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-06-28 50256]

S3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-07-23 1223008]

S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2006-11-17 13976]

--- Andere Services/Drivers In Geheugen ---

*Deregistered* - PCTSDInjDriver32

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

Inhoud van de 'Gedeelde Taken' map

2010-07-12 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-16 19:15]

2010-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 20:26]

2010-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 20:26]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.clubbrugge.be/

uInternet Settings,ProxyOverride = *.local

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

FF - ProfilePath - c:\users\Yves.PC_van_2\AppData\Roaming\Mozilla\Firefox\Profiles\x3xmye8e.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.clubbrugge.be/|Google

FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1739.5352\npCIDetect13.dll

FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

- - - - ORPHANS VERWIJDERD - - - -

SafeBoot-dmboot.sys

SafeBoot-dmio.sys

SafeBoot-dmload.sys

SafeBoot-dmadmin

SafeBoot-dmserver

SafeBoot-SRService

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-07-12 16:00

Windows 6.0.6002 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

Voltooingstijd: 2010-07-12 16:04:38

ComboFix-quarantined-files.txt 2010-07-12 14:04

Pre-Run: 104.696.459.264 bytes beschikbaar

Post-Run: 104.647.909.376 bytes beschikbaar

- - End Of File - - DF0D7128FE1F1AFA52FCBC4BDA153341

---------- Post toegevoegd om 16:15 ---------- Vorige post was om 16:09 ----------

Ik heb geen enkele van de 3 bestanden gevonden op mijn computer...

kape · 12 juli 2010

Is de optie "verborgen bestanden zichtbaar maken" ingeschakeld op deze PC ? Want deze 3 bestanden zouden wel eens "verborgen bestanden" kunnen zijn. Zo ja, is het verder OK. Zo nee, even die optie inschakelen en dan opnieuw via de zoekfunctie nog eens de 3 (eventuele) boosdoeners opsporen.

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Folder::

C:\found.000

Registry::

aswSP

aswFsBlk

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht en laat meteen ook even weten hoe het nu met de problemen op deze PC staat ?

RS4ever · 12 juli 2010

De drie bestanden heb ik niet gevonden, ook niet als verborgen bestand!

Hierna volgt het logje van ComboFix:

ComboFix 10-07-11.07 - Yves 12/07/2010 19:54:32.1.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.2047.1301 [GMT 2:00]

Gestart vanuit: c:\users\Yves.PC_van_2\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Yves.PC_van_2\Desktop\CFScript.txt

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

SP: avast! Antivirus *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}

SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\found.000

c:\found.000\dir0000.chk\Aavm4h.dll

c:\found.000\dir0000.chk\AavmRpch.dll

c:\found.000\dir0000.chk\AhResBhv.dll

c:\found.000\dir0000.chk\AhResMai.dll

c:\found.000\dir0000.chk\ahResMes.dll

c:\found.000\dir0000.chk\AhResNS.dll

c:\found.000\dir0000.chk\ahResP2P.dll

c:\found.000\dir0000.chk\AhResStd.dll

c:\found.000\dir0000.chk\AhResWS.dll

c:\found.000\dir0000.chk\ashBase.dll

c:\found.000\dir0000.chk\ashMaiSv.dll

c:\found.000\dir0000.chk\ashOutXt.dll

c:\found.000\dir0000.chk\ashQuick.exe

c:\found.000\dir0000.chk\ashServ.dll

c:\found.000\dir0000.chk\ashShell.dll

c:\found.000\dir0000.chk\ashTask.dll

c:\found.000\dir0000.chk\ashTaskEx.dll

c:\found.000\dir0000.chk\ashUpd.exe

c:\found.000\dir0000.chk\ashWebSv.dll

c:\found.000\dir0000.chk\ashWsFtr.dll

c:\found.000\dir0000.chk\aswAux.dll

c:\found.000\dir0000.chk\aswCmnBS.dll

c:\found.000\dir0000.chk\aswCmnIS.dll

c:\found.000\dir0000.chk\aswCmnOS.dll

c:\found.000\dir0000.chk\aswData.dll

c:\found.000\dir0000.chk\aswIdle.dll

c:\found.000\dir0000.chk\aswLog.dll

c:\found.000\dir0000.chk\aswProperty.dll

c:\found.000\dir0000.chk\aswSqLt.dll

c:\found.000\dir0000.chk\aswUtil.dll

c:\found.000\dir0000.chk\avastSS.dll

c:\found.000\dir0000.chk\AvastUI.exe

c:\found.000\dir0000.chk\AvSSHook.dll

c:\found.000\dir0000.chk\CommonRes.dll

c:\found.000\dir0000.chk\sched.exe

c:\found.000\dir0000.chk\VisthAux.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-06-12 to 2010-07-12 ))))))))))))))))))))))))))))))

.

2010-07-12 18:02 . 2010-07-12 18:03 -------- d-----w- c:\users\Yves.PC_van_2\AppData\Local\temp

2010-07-12 18:02 . 2010-07-12 18:02 -------- d-----w- c:\users\YVES~1~PC_\AppData\Local\temp

2010-07-12 18:02 . 2010-07-12 18:02 -------- d-----w- c:\users\Yves\AppData\Local\temp

2010-07-12 18:02 . 2010-07-12 18:02 -------- d-----w- c:\users\Public\AppData\Local\temp

2010-07-12 18:02 . 2010-07-12 18:02 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-07-12 14:37 . 2010-07-12 14:53 214958 ----a-w- C:\MGlogs.zip

2010-07-12 14:37 . 2010-07-12 14:53 -------- d-----w- C:\MGtools