oudere framework verwijderen?

[honk]

Mag ik de oudere updates voor de laatste update (zie bijlage) verwijderen zodat alleen de laatste overblijft?

Deze pc is namelijk veel te traag geworden.

Doc1.doc

6 juli 2010 aangepast door honk

[kape]

Principieel zou dat kunnen ... maar als je dan toepassingen tegenkomt die nog gebruikmaken van de oude versies van Framework heb je deze toch nodig. De kans dat je nog applicaties met de versie 1.1 tegenkomt is echter eerder klein, maar het kan nog.

Indien er geen capaciteitsproblemen zijn, is er geen overtuigende reden om ze uit Software te verwijderen. Maar dat is natuurlijk altijd een beetje eigen keuze

Wat de traagheid betreft zal dat ook geen (merkbare) invloed hebben. Dan zal je eerder op andere vlakken moeten gaan zoeken : malware, opstertprogramma's, antivirus ... of gewoon de leeftijd van het beestje.

[honk]

Dus als ik een systeemherstelpunt instel voor de verwijdering en ik doe er een paar weg? Indien er dan nog knelpunten voorkomen kan ik deze terug zetten. Het beestje is inderdaad al oud dateert van de jaren 2000. Hij wordt alleen gebruikt voor word documenten en excel, niet veel meer dan dit. Heb nu windows op beste prestaties eens gezet. Aangezien wij toch niet zoveel software gebruiken denk ik dat ik deze zal verwijderen.

Heeft u tevens een goed programma voor het controleren (snel) van de computer op eventuele virussen? Wij gebruiken BullGuard als antivirus.

EDIT: zou ik hier eventueel ComboFix eens mogen draaien?

6 juli 2010 aangepast door honk

[kweezie wabbit]

ComboFix is al redelijk zwaar geschut hoor.

Laat ons met iets lichter beginnen.

Download HiJackThis

Dubbelklik op HJTInstall.exe

Hijackthis wordt nu op je PC geïnstalleerd, een snelkoppeling wordt op je bureaublad geplaatst.

HijackThis zal openen na het installeren.

Klik op "Do a systemscan and save a logfile".

Er opent een kladblokvenster, hou gelijktijdig de CTRL en A-toets ingedrukt, nu is alles geselecteerd. Hou gelijktijdig de CTRL en C-toets ingedrukt, nu is alles gekopieerd. Plak nu het HJT logje in je bericht door CTRL en V-toets.

N.B. : gebruikers van Windows Vista en Windows 7 zullen eerst moeten rechtsklikken op HijackThis.exe en dan kiezen voor "Run as Administrator".

[Jean-Pierre]

Kweezie wabbit was me voor.

[honk]

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 15:11:15, on 6/07/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\ATKKBService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\hot_plug.exe

C:\Program Files\Brother\ControlCenter3\brccMCtl.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Windows Live\Toolbar\wltuser.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\msiexec.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN | Hotmail | Messenger | Nieuws, entertainment, video, sport, lifestyle, auto en nog veel meer, dat is MSN !

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

O4 - HKLM\..\Run: [indexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe

O4 - HKLM\..\Run: [setDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe

O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun

O4 - HKLM\..\Run: [siSRaid] C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

O4 - HKLM\..\Run: [Hotplug] C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\hot_plug.exe

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [bullGuardResumeInstall] "C:\Documents and Settings\Patrick\Bureaublad\BullGuard Install.exe" /nowelcome /lang=1043 /D=C:\Program Files\BullGuard Ltd\BullGuard

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.de/common/asusTek_sys_ctrl.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1260895128421

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1260895040046

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--

End of file - 8336 bytes

---------- Post toegevoegd om 15:12 ---------- Vorige post was om 15:11 ----------

Kweezie wabbit was me voor.

Geen probleem Ik ben al blij dat iemand me helpt.

[kape]

Dit logje is probleemloos

Er zitten wel wat dingetjes in die je kan uitschakelen bij het opstarten.

Download Codestuff Starter

Start Codestuff Starter op

Selecteer het tabblad Automatisch Opstarten en vink volgende items uit. Deze programma’s worden onnodig mee opgestart.

O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

O4 - HKLM\..\Run: [indexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

Als de snelheid dan nog niet mee wil, kan je die ComboFix wel eens laten runnen ... al is de kans niet bijzonder groot dat daar grote snelheidswinst in zal zitten. Maar wie niet waagt, niet wint

[honk]

Ik zal iets moeten proberen, want dit is niet meer te doen. Afsluiten kan ik ook al niet meer... hij reageert niet meer op de commando's, zelfs niet via cmd. Internet werkt niet, start op, maar de startpagina komt er niet meer op. Het blijft een wit scherm met 'Laden...'

EDIT: Heb nu de pc laten opstarten in Velige Modus... wat een verschil! De computer gaat nu 5x zo snel!

7 juli 2010 aangepast door honk

[kape]

Voer ComboFix dan eens uit in die "veilige modus".

[honk]

ComboFix 10-07-06.05 - Patrick 07/07/2010 22:18:00.6.1 - x86 NETWORK

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.511.363 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Patrick\Bureaublad\ComboFix.exe

AV: BullGuard Antivirus *On-access scanning enabled* (Updated) {7A9BB333-8EDF-4FDC-A2A5-1A30FA021913}

FW: BullGuard Firewall *enabled* {2AEF4CB6-61B5-4E60-AF22-D95E75B63FA1}

.

(((((((((((((((((((( Bestanden Gemaakt van 2010-06-07 to 2010-07-07 ))))))))))))))))))))))))))))))

.

2010-07-07 10:09 . 2010-07-07 10:09 -------- d-----w- c:\program files\CodeStuff

2010-07-06 13:24 . 2010-04-06 09:13 459600 ----a-w- c:\documents and settings\All Users\Application Data\BullGuard\Update\Bin\libxml2.dll

2010-07-06 13:24 . 2010-02-25 15:43 67920 ----a-w- c:\documents and settings\All Users\Application Data\BullGuard\Update\Bin\zlib1.dll

2010-07-06 13:24 . 2010-02-25 15:43 983376 ----a-w- c:\documents and settings\All Users\Application Data\BullGuard\Update\Bin\libeay32.dll

2010-07-06 13:24 . 2010-02-25 15:43 55120 ----a-w- c:\documents and settings\All Users\Application Data\BullGuard\Update\Bin\libbz2.dll

2010-07-06 13:24 . 2010-07-06 13:24 352576 ----a-w- c:\documents and settings\All Users\Application Data\BullGuard\Update\Download\APPDIR\BullGuardUpdate.exe

2010-07-06 13:24 . 2010-07-06 13:24 352576 ----a-w- c:\documents and settings\All Users\Application Data\BullGuard\Update\Bin\BullGuardUpdate.exe

2010-07-06 13:24 . 2010-02-25 15:43 190800 ----a-w- c:\documents and settings\All Users\Application Data\BullGuard\Update\Bin\libcurl.dll

2010-07-06 13:15 . 2010-07-06 13:15 -------- d-----w- c:\program files\BullGuard Ltd

2010-07-06 13:10 . 2010-07-06 13:10 388096 ----a-r- c:\documents and settings\Patrick\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-06-09 08:06 . 2010-06-09 08:06 976832 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\24787\AdobeARM.exe

2010-06-09 08:06 . 2010-06-09 08:06 70584 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\24787\AdobeExtractFiles.dll

2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\24787\ReaderUpdater.exe

2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.3\ARM\24787\AcrobatUpdater.exe

2010-06-08 09:08 . 2010-06-08 09:08 150848 ----a-w- c:\windows\system32\BGLsp.dll

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-07 09:58 . 2009-04-18 12:07 -------- d-----w- c:\documents and settings\All Users\Application Data\BullGuard

2010-07-07 09:09 . 2009-04-20 06:38 -------- d-----w- c:\documents and settings\Hendrik\Application Data\BullGuard

2010-07-06 13:21 . 2009-04-18 12:07 -------- d-----w- c:\documents and settings\Patrick\Application Data\BullGuard

2010-07-06 12:16 . 2010-02-27 15:10 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-06-17 14:30 . 2010-02-03 11:41 -------- d-----w- c:\documents and settings\Elien\Application Data\Audacity

2010-06-03 18:47 . 2010-06-03 18:47 3584 ----a-r- c:\documents and settings\Elien\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe

2010-06-03 18:47 . 2010-06-03 18:47 -------- d-----w- c:\program files\Windows Installer Clean Up

2010-06-03 18:47 . 2010-06-03 18:47 -------- d-----w- c:\program files\MSECACHE

2010-05-30 19:42 . 2009-12-12 15:18 -------- d-----w- c:\program files\SpeedFan

2010-05-30 11:09 . 2010-05-30 11:09 -------- d-----w- c:\documents and settings\Elien\Application Data\Malwarebytes

2010-05-30 11:09 . 2010-05-30 11:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-05-29 18:03 . 2010-05-29 18:03 388096 ----a-r- c:\documents and settings\Elien\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-05-29 18:03 . 2010-05-29 18:03 -------- d-----w- c:\program files\Trend Micro

2010-05-29 17:57 . 2009-04-18 11:27 -------- d-----w- c:\program files\Analog Devices

2010-05-28 16:50 . 2009-08-31 12:33 -------- d-----w- c:\program files\CCleaner

2010-05-28 16:46 . 2010-05-28 16:45 -------- d-----w- c:\program files\ahead

2010-05-28 15:38 . 2010-03-20 12:11 -------- d-----w- c:\program files\Wise Registry Cleaner

2010-05-28 15:38 . 2009-12-12 15:19 -------- d-----w- c:\program files\Belgium Identity Card

2010-05-19 15:53 . 2010-05-19 15:53 -------- d-----w- c:\documents and settings\Elien\Application Data\Windows Search

2010-05-18 21:06 . 2010-05-18 21:06 -------- d-----w- c:\documents and settings\Patrick\Application Data\Windows Search

2010-05-18 20:25 . 2004-08-04 12:00 537190 ----a-w- c:\windows\system32\perfh013.dat

2010-05-18 20:25 . 2004-08-04 12:00 101744 ----a-w- c:\windows\system32\perfc013.dat

2010-05-18 16:45 . 2009-10-07 12:11 -------- d-----w- c:\program files\Microsoft

2010-05-18 16:45 . 2010-05-18 16:45 -------- d-----w- c:\program files\Microsoft Office Outlook Connector

2010-05-18 16:44 . 2009-04-20 19:12 -------- d-----w- c:\program files\Windows Live

2010-05-18 16:43 . 2010-05-18 16:43 -------- d-----w- c:\program files\Microsoft Sync Framework

2010-05-18 16:41 . 2010-05-18 16:41 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition

2010-05-14 16:46 . 2010-05-14 16:46 -------- d-----w- c:\documents and settings\Hendrik\Application Data\Windows Search

2010-05-14 16:08 . 2010-05-14 16:08 -------- d-----w- c:\documents and settings\Hendrik\Application Data\Windows Desktop Search

2010-05-14 16:07 . 2010-05-14 16:07 -------- d-----w- c:\program files\Windows Desktop Search

2010-05-14 15:16 . 2010-05-14 15:16 -------- d-----w- c:\documents and settings\Hendrik\Application Data\Malwarebytes

2010-04-29 13:39 . 2010-05-30 11:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 13:39 . 2010-05-30 11:09 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-28 09:41 . 2010-04-28 09:41 58576 ----a-w- c:\windows\system32\drivers\BdSpy.sys

2010-04-28 05:44 . 2010-05-18 16:44 54760 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys

2010-04-25 14:12 . 2010-04-25 14:12 411368 ----a-w- c:\windows\system32\deployJava1.dll

2010-04-23 10:19 . 2010-04-23 10:19 98128 ----a-w- c:\windows\system32\BgGamingMonitor.dll

2010-04-16 20:12 . 2010-04-16 20:12 48464 ----a-w- c:\windows\system32\sirenacm.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"beid"="c:\program files\Belgium Identity Card\beid35gui.exe" [2009-06-04 2056192]

"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"BullGuard"="c:\program files\BullGuard Ltd\BullGuard\BullGuard.exe" [2010-07-06 2071360]

"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"Hotplug"="c:\program files\Silicon Integrated Systems\SiSRaidPackage\hot_plug.exe" [2005-07-28 278528]

"SiSRaid"="c:\program files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe" [2005-05-18 905216]

"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-06-29 77824]

"SetDefPrt"="c:\program files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 49152]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsMain]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner]

@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Windows Search.lnk]

backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"BrMfcWnd"=c:\program files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R2 BsMain;BullGuard main service;c:\windows\System32\SvcHost.exe -k BullGuard_Main [4/08/2004 14:00 14336]

R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [4/12/2009 12:00 31640]

S1 BdSpy;BdSpy;c:\windows\system32\drivers\BdSpy.sys [28/04/2010 11:41 58576]

S2 BsFileScan;BullGuard on-access service;c:\windows\System32\SvcHost.exe -k BullGuard [4/08/2004 14:00 14336]

S2 BsFire;BullGuard firewall service;c:\windows\System32\SvcHost.exe -k BullGuard [4/08/2004 14:00 14336]

S2 BsMailProxy;BullGuard e-mail monitoring service;c:\windows\System32\SvcHost.exe -k BullGuard [4/08/2004 14:00 14336]

S2 BsUpdate;BullGuard update service;c:\program files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe [23/06/2010 14:16 352576]

S3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\drivers\a38usbxp.sys [30/04/2004 15:35 24832]

S3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [4/12/2009 12:00 256792]

S3 BgRaSvc;BgRaSvc;c:\program files\BullGuard Ltd\BullGuard\Support\BgRaSvc.exe [8/06/2010 11:09 122688]

S3 BsBrowser;BullGuard antiphishing service;c:\windows\System32\SvcHost.exe -k BullGuard_LowPriv [4/08/2004 14:00 14336]

S3 BsScanner;BullGuard scanning service;c:\program files\BullGuard Ltd\BullGuard\BullGuardScanner.exe [23/06/2010 14:16 301376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

getPlusHelper REG_MULTI_SZ getPlusHelper

BullGuard_Main REG_MULTI_SZ BsMain

BullGuard REG_MULTI_SZ BsFileScan BsMailProxy BsFire

BullGuard_LowPriv REG_MULTI_SZ BsBrowser

.

Inhoud van de 'Gedeelde Taken' map

2010-06-02 c:\windows\Tasks\BACKUP Doc E & H.job

- c:\windows\system32\ntbackup.exe [2001-09-06 19:27]

2010-06-03 c:\windows\Tasks\jucheck.job

- c:\program files\Common Files\Java\Java Update\jucheck.exe [2010-02-18 09:43]

.

.

------- Bijkomende Scan -------

.

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

LSP: c:\windows\system32\BGLsp.dll

.

- - - - ORPHANS VERWIJDERD - - - -

AddRemove-Mistral2 - c:\program files\Mistral2\uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-07-07 22:27

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Ñw*]

"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]

"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'explorer.exe'(1880)

c:\program files\Microsoft Office\OFFICE11\msohev.dll

.

Voltooingstijd: 2010-07-07 22:30:28

ComboFix-quarantined-files.txt 2010-07-07 20:30

ComboFix2.txt 2010-05-30 16:01

Pre-Run: 92.141.223.936 bytes beschikbaar

Post-Run: 92.309.118.976 bytes beschikbaar

WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /safeboot:network

- - End Of File - - 0A17D85BE6852758ACEB7E45FDAE82F6