trage pc

[kape]

Combofix heeft behoorlijk wat ongewenst spul verwijderd. Wat ook opvalt is dat je nog sporen van drie virusscanners (AVG, AVEngine en Norton/Symantec) meesleept. Op het eerste zicht is AVG je actieve scanner. Dan is het best om die twee anderen te verwijderen, want die durven elkaar wel eens tegenwerken (wat ook weer zijn negatieve invloed heeft op de snelheid). Laat even weten welke antivirus je verder wil gebruiken, dan ruimen we al de rest meteen mee op !

[agie]

Inderdaad en er is weer een verbetering in de snelheid!!!

Ik ben van AVG proefversie overgegaan naar een versie van Norton ,omdat de AVG-virusscanner de infectie niet heeft opgepakt. In het verleden had ik de AVG free versie en eigenlijk geen problemen, dus ik vraag me op dit moment af : wat is het beste, een betaalde versie of een gratis versie?

Wat raadt u mij aan?

En......bedankt voor de snelle reactie's !!

[kweezie wabbit]

Er zijn gratis versies die beter zijn dan sommige betalende virusscanners.

Bij de betalende is G Data de beste.

Bij de gratis scanners zijn Avira en Avast de toppers.

[kape]

Indien het een betalende versie van Norton is, die nog niet vervallen is ... lijkt me het best (om financiële redenen) om deze de hele termijn te blijven gebruiken.

Op zich is er niets mis met AVG Free als gratis scanner (ook Avast, Antivir en Microsoft Security Essentials horen in dit gratis keuzerijtje thuis). En elke scanner kan wel eens een foutje maken, geen enkele is 100 % waterdicht (laat staan de gebruiker ervan ).

Maar de keuze is uiteraard aan de gebruiker !

[clarkie]

IK gebruik zelf ook norton (internet security 2011).

Werkt bij mij heel goed.

Levert geen speciale vertraging op.

Vroeger had ik eens tussendoor G-data maar die zorgde voor vertragingen.

En files willen we toch net vermijden, of niet?

[agie]

Bedankt voor jullie advies,ik kan hier nu een goede keuze maken wat virusscanner betreft, hier kan ik wat mee!

Op u vraag: "welke virusscanner ik wil gebruiken", hou ik verlopig Norton aan.

Dus de ander twee virusscanner AVG, AVEngine kunnen nu worden verwijderd.

Ik gebruik ook regelmatig Malware/advanced Systemcare/Ccleaner, heeft dit verder nog invloed op de snelheid?

[clarkie]

Je kan je best aan 1 enkele virusscanner houden.

Geen twee antivirusprogramma's installeren dus.

Malware/advanced Systemcare/Ccleaner is een programma dat ik niet gebruik.

Kan dus niet zeggen of het erg vertragend werkt.

[kape]

Dan gaan we onder de virusscanners een beetje opruiming houden :

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc stop "AV Watch Service"

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc delete "AV Watch Service"

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc stop "AV Engine Scanning Service"

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc delete "AV Engine Scanning Service"

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc stop avgfws

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc delete avgfws

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc stop AVGIDSAgent

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc delete AVGIDSAgent

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc stop avgwd

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc delete avgwd

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc stop "Application Updater"

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc delete "Application Updater"

Druk op Enter.

Om AVG volledig te verwijderen laat je de speciale Removal Tool werken.

Maak daarna een nieuw logje met HijackThis en Combofix en hang beiden in een volgende bericht ter controle.

Wat je andere programma's betreft :

- CCleaner = geen enkel probleem wat vertraging betreft. Dit start je normaal enkel op indien je zelf wenst en neemt dus geen extra tijd in beslag bij de normale opstart.

- Malwarebytes & ASC hebben een instelling waarbij ze - bij elke opstart - onmiddellijk beginnen te scannen en dus wel (mogelijk) tot vertraging aanleiding kunnen geven. Maar ... dit hangt af of je deze instelling ook hebt ingeschakeld bij de installatie van deze programma's. Om te zien of dit enige (negatieve) invloed heeft, stel ik voor om beide programma's te verwijderen van je PC. Dan kan je het verschil bekijken. Het zijn beiden programma's die je daarna probleemloos opnieuw kan downloaden en installeren.

Veel werk aan de winkel, dus ;-)

[agie]

Hier het log van Hajackit en combofix en Malware en ASC verwijderd:

ComboFix 11-03-21.02 - riekie 22-03-2011 16:35:44.3.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.1015.207 [GMT 1:00]

Gestart vanuit: c:\users\riekie\Desktop\ComboFix.exe

AV: Norton AntiVirus *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-02-22 to 2011-03-22 ))))))))))))))))))))))))))))))

.

.

2011-03-22 15:49 . 2011-03-22 15:49 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-03-18 23:42 . 2011-03-18 23:52 126512 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2011-03-18 23:42 . 2011-03-18 23:53 -------- d-----w- c:\program files\Symantec

2011-03-18 23:40 . 2011-03-19 15:03 -------- d-----w- c:\windows\system32\drivers\NAV

2011-03-18 23:40 . 2011-03-18 23:40 -------- d-----w- c:\program files\Norton AntiVirus

2011-03-18 23:40 . 2011-03-18 23:45 -------- d-----w- c:\programdata\Norton

2011-03-18 23:36 . 2011-03-18 23:36 -------- d-----w- c:\program files\NortonInstaller

2011-03-18 23:31 . 2011-03-22 14:22 -------- d-----w- c:\programdata\AVG Security Toolbar

2011-03-18 23:11 . 2011-03-18 23:11 -------- d-----w- c:\users\riekie\AppData\Roaming\Download Manager

2011-03-18 22:50 . 2011-03-18 22:50 -------- d-----w- c:\programdata\Preventon

2011-03-14 19:10 . 2011-03-14 19:10 388096 ----a-r- c:\users\riekie\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-03-14 19:10 . 2011-03-14 19:10 -------- d-----w- c:\program files\Trend Micro

2011-03-09 15:47 . 2010-12-29 18:28 429056 ----a-w- c:\windows\system32\EncDec.dll

2011-03-09 15:47 . 2010-12-29 18:28 322560 ----a-w- c:\windows\system32\sbe.dll

2011-03-09 15:47 . 2010-12-29 18:26 177664 ----a-w- c:\windows\system32\mpg2splt.ax

2011-03-09 15:47 . 2010-12-29 18:28 153088 ----a-w- c:\windows\system32\sbeio.dll

2011-03-09 15:46 . 2010-12-17 15:45 2067968 ----a-w- c:\windows\system32\mstscax.dll

2011-03-09 15:46 . 2010-12-17 13:54 677888 ----a-w- c:\windows\system32\mstsc.exe

2011-03-08 15:17 . 2011-02-11 06:54 5943120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{23AB8B9B-9C99-49DF-915C-003290BD8B4F}\mpengine.dll

2011-03-08 14:12 . 2011-03-08 14:13 -------- d-----w- c:\users\riekie\AppData\Local\{BC2666C5-9FDF-476B-B7A6-B379B079FA2A}

2011-03-06 11:14 . 2011-03-06 11:15 -------- d-----w- c:\users\riekie\AppData\Local\{64AACFF4-37A8-4945-94B6-36E235092F0C}

2011-03-04 17:02 . 2011-03-04 17:02 -------- d-----w- c:\program files\Belastingdienst

2011-03-04 16:48 . 2011-03-04 16:48 -------- d-----w- c:\users\riekie\AppData\Local\FixItCenter

2011-03-04 16:43 . 2011-03-04 16:43 -------- d-----w- c:\windows\MATS

2011-03-01 15:52 . 2011-03-01 15:52 -------- d-----w- c:\users\riekie\AppData\Local\{4BC0EAE7-E9E2-49CA-9452-6D32A30F35F7}

2011-02-25 21:28 . 2011-03-04 16:43 -------- d-----w- c:\program files\Microsoft Fix it Center

2011-02-25 20:39 . 2011-02-25 20:40 -------- d-----w- c:\users\riekie\AppData\Local\{FF3A4ED5-6F5D-4FA9-9B4C-812F1A43DB54}

2011-02-23 20:37 . 2011-02-23 20:37 -------- d-----w- c:\users\riekie\AppData\Local\Sunbelt Software

2011-02-23 20:06 . 2011-02-23 20:06 -------- dc-h--w- c:\programdata\{E53F90E0-D7CA-4310-8844-F6E688407890}

2011-02-22 07:14 . 2011-02-22 12:31 -------- d-----w- c:\users\riekie\AppData\Roaming\Sammsoft

2011-02-21 23:11 . 2011-02-23 21:27 -------- d-----w- c:\programdata\clp

2011-02-21 20:16 . 2011-03-11 18:17 -------- d-----w- c:\users\riekie\AppData\Local\WinZip

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-17 14:55 . 2010-06-24 10:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-02-02 20:40 . 2010-04-28 17:47 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-02-02 16:11 . 2009-10-03 13:40 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-01-20 16:37 . 2011-02-17 15:35 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2011-01-20 16:08 . 2011-02-17 15:35 478720 ----a-w- c:\windows\system32\dxgi.dll

2011-01-20 16:08 . 2011-02-17 15:35 219648 ----a-w- c:\windows\system32\d3d10_1core.dll

2011-01-20 16:08 . 2011-02-17 15:35 160768 ----a-w- c:\windows\system32\d3d10_1.dll

2011-01-20 16:08 . 2011-02-17 15:35 189952 ----a-w- c:\windows\system32\d3d10core.dll

2011-01-20 16:08 . 2011-02-17 15:35 1029120 ----a-w- c:\windows\system32\d3d10.dll

2011-01-20 16:07 . 2011-02-17 15:35 37376 ----a-w- c:\windows\system32\cdd.dll

2011-01-20 16:07 . 2011-02-17 15:35 258048 ----a-w- c:\windows\system32\winspool.drv

2011-01-20 16:07 . 2011-02-17 15:35 586240 ----a-w- c:\windows\system32\stobject.dll

2011-01-20 16:06 . 2011-02-17 15:35 2873344 ----a-w- c:\windows\system32\mf.dll

2011-01-20 16:06 . 2011-02-17 15:35 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll

2011-01-20 16:04 . 2011-02-17 15:35 209920 ----a-w- c:\windows\system32\mfplat.dll

2011-01-20 16:04 . 2011-02-17 15:35 98816 ----a-w- c:\windows\system32\mfps.dll

2011-01-20 14:28 . 2011-02-17 15:35 1554432 ----a-w- c:\windows\system32\xpsservices.dll

2011-01-20 14:27 . 2011-02-17 15:35 876032 ----a-w- c:\windows\system32\XpsPrint.dll

2011-01-20 14:26 . 2011-02-17 15:35 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe

2011-01-20 14:25 . 2011-02-17 15:35 847360 ----a-w- c:\windows\system32\OpcServices.dll

2011-01-20 14:24 . 2011-02-17 15:35 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll

2011-01-20 14:24 . 2011-02-17 15:35 135680 ----a-w- c:\windows\system32\XpsRasterService.dll

2011-01-20 14:15 . 2011-02-17 15:35 979456 ----a-w- c:\windows\system32\MFH264Dec.dll

2011-01-20 14:14 . 2011-02-17 15:35 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll

2011-01-20 14:14 . 2011-02-17 15:35 261632 ----a-w- c:\windows\system32\mfreadwrite.dll

2011-01-20 14:14 . 2011-02-17 15:35 302592 ----a-w- c:\windows\system32\mfmp4src.dll

2011-01-20 14:12 . 2011-02-17 15:35 1172480 ----a-w- c:\windows\system32\d3d10warp.dll

2011-01-20 14:11 . 2011-02-17 15:35 486400 ----a-w- c:\windows\system32\d3d10level9.dll

2011-01-20 13:47 . 2011-02-17 15:35 683008 ----a-w- c:\windows\system32\d2d1.dll

2011-01-20 13:44 . 2011-02-17 15:35 1068544 ----a-w- c:\windows\system32\DWrite.dll

2011-01-20 13:44 . 2011-02-17 15:35 797184 ----a-w- c:\windows\system32\FntCache.dll

2011-01-08 08:47 . 2011-02-17 15:24 34304 ----a-w- c:\windows\system32\atmlib.dll

2011-01-08 06:28 . 2011-02-17 15:24 292352 ----a-w- c:\windows\system32\atmfd.dll

2010-12-31 13:57 . 2011-02-17 15:50 2039808 ----a-w- c:\windows\system32\win32k.sys

2010-12-28 15:55 . 2011-01-12 16:27 413696 ----a-w- c:\windows\system32\odbc32.dll

2010-12-23 19:55 . 2007-08-30 08:49 319456 ----a-w- c:\windows\DIFxAPI.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-08 68856]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]

"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]

"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]

"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2011-03-01 126976]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0bootdelete\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^$McRebootA5E6DEAA56$.lnk]

backup=c:\windows\pss\$McRebootA5E6DEAA56$.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

%ProgramFiles%\Windows Defender\MSASCui.exe -hide [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-09-20 22:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2011-01-31 08:44 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]

2007-04-03 16:50 1603152 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]

2007-04-03 16:00 644696 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeApp]

2011-01-02 11:30 814496 ----a-w- c:\program files\FreeApps\FreeApps.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box]

2011-03-01 16:33 126976 ----a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2008-06-18 19:01 166424 ----a-w- c:\windows\System32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]

2007-05-24 11:13 71176 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2008-12-08 13:50 54576 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]

2007-04-18 15:01 65536 ----a-w- c:\hp\support\hpsysdrv.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2008-06-18 19:01 141848 ----a-w- c:\windows\System32\igfxtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]

2006-12-08 16:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KPN]

2008-06-06 15:08 198184 ----a-w- c:\program files\KPN\bin\sprtcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KPNAssistentUpdater]

2010-12-22 14:49 1964928 ----a-w- c:\program files\KPN\KPN Update\KPNAssistentUpdater.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]

2008-06-18 19:01 133656 ----a-w- c:\windows\System32\igfxpers.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateReg]

2008-02-22 02:25 54672 ----a-w- c:\windows\System32\jureg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]

2007-05-31 07:21 648072 ----a-w- c:\windows\WindowsMobile\wmdc.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1753990348-677674000-2389129793-1000]

"EnableNotificationsRef"=dword:00000001

.

R1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [x]

R1 ctredrv.sys;ctredrv.sys;c:\windows\system32\drivers\ctredrv.sys [x]

R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 DUMeterSvc;DU Meter Service; [x]

R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-26 136176]

R2 SPAMfighter Update Service;SPAMfighter Update Service; [x]

R3 AVFSFilter;AVFSFilter;c:\windows\system32\DRIVERS\avfsfilter.sys [x]

R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [x]

R3 cpuz134;cpuz134;c:\program files\CPUID\PC Wizard 2010\pcwiz_x32.sys [2010-07-09 20328]

R3 hitmanpro2;Hitman Pro 2 Driver;c:\program files\Hitman Pro\hitmanpro2.sys [x]

R3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [2010-11-16 267568]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R4 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x]

R4 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x]

R4 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x]

R4 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1205000.07D\SYMDS.SYS [2010-10-21 340016]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1205000.07D\SYMEFA.SYS [2010-11-18 652336]

S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20110309.001\BHDrvx86.sys [2011-03-09 800376]

S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20110317.005\IDSvix86.sys [2010-11-09 353912]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1205000.07D\Ironx86.SYS [2010-11-16 136312]

S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NAV\1205000.07D\SYMTDIV.SYS [2010-12-01 330360]

S2 iprip;RIP-listener;c:\windows\System32\svchost.exe [2008-01-19 21504]

S2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe [2010-11-24 130000]

S2 sprtsvc_KPN;SupportSoft Sprocket Service (KPN);c:\program files\KPN\bin\sprtsvc.exe [2008-06-06 202016]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-03-19 102448]

S3 rt61x86;Ralink RT61 Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr61.sys [2007-05-11 357376]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

ipripsvc REG_MULTI_SZ iprip

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

.

Inhoud van de 'Gedeelde Taken' map

.

2011-03-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-26 16:06]

.

2011-03-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-26 16:06]

.

2011-03-22 c:\windows\Tasks\User_Feed_Synchronization-{522C3C04-2DFD-4007-AE2B-05A1BC1F3F9A}.job

- c:\windows\system32\msfeedssync.exe [2011-02-17 04:47]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.nl/webhp?sourceid=navclient&hl=nl&ie=UTF-8&rlz=1T4HPEA_nlNL315NL315

mStart Page = hxxp://www.msn.com

uSearchAssistant = hxxp://www.google.com/ie

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-03-22 16:50

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\NAV]

"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"

.

Voltooingstijd: 2011-03-22 17:00:09

ComboFix-quarantined-files.txt 2011-03-22 16:00

ComboFix2.txt 2011-03-20 21:25

.

Pre-Run: 96.315.326.464 bytes beschikbaar

Post-Run: 96.267.612.160 bytes beschikbaar

.

- - End Of File - - 7A7B62A4129162413E73BD278468113B

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 23:08:42, on 22-3-2011

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.19019)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe

C:\Program Files\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe

C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Windows\System32\mobsync.exe

C:\Program Files\Windows Media Player\wmplayer.exe

C:\Windows\explorer.exe

C:\Windows\system32\conime.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\18.5.0.125\IPS\IPSBHO.DLL

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"

O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/VistaMSNPUpldnl-nl.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272387255067

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1293400404301

O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/m3/photouploadcontrol/VistaMSNPUpldnl-nl.cab

O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - (no file)

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Application Updater - Unknown owner - C:\Program Files\Application Updater\ApplicationUpdater.exe (file missing)

O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe (file missing)

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe

O23 - Service: SupportSoft Sprocket Service (KPN) (sprtsvc_KPN) - SupportSoft, Inc. - C:\Program Files\KPN\bin\sprtsvc.exe

--

End of file - 6862 bytes

22 maart 2011 aangepast door agie

[kape]

Start Hijackthis op. Selecteer “Scan”. Selecteer alleen de items die hieronder zijn genoemd:

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanage...ex-2.2.5.7.cab

O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - (no file)

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O23 - Service: Application Updater - Unknown owner - C:\Program Files\Application Updater\ApplicationUpdater.exe (file missing)

O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe (file missing)

Klik op 'Fix checked' om de items te verwijderen.

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\system32\DRIVERS\avgfwd6x.sys

c:\program files\Application Updater\ApplicationUpdater.exe

c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe

c:\program files\Hitman Pro\hitmanpro2.sys

c:\windows\system32\DRIVERS\AVGIDSDriver.Sys

c:\windows\system32\DRIVERS\AVGIDSEH.Sys

c:\windows\system32\DRIVERS\AVGIDSFilter.Sys

c:\windows\system32\DRIVERS\AVGIDSShim.Sys

Folder::

c:\programdata\AVG Security Toolbar

c:\users\riekie\AppData\Local\{BC2666C5-9FDF-476B-B7A6-B379B079FA2A}

c:\users\riekie\AppData\Local\{64AACFF4-37A8-4945-94B6-36E235092F0C}

c:\users\riekie\AppData\Local\{4BC0EAE7-E9E2-49CA-9452-6D32A30F35F7}

c:\users\riekie\AppData\Local\{FF3A4ED5-6F5D-4FA9-9B4C-812F1A43DB54}

c:\programdata\{E53F90E0-D7CA-4310-8844-F6E688407890}

Registry::

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

Driver::

Avgfwfd

Application Updater

AVG Security Toolbar Service

hitmanpro2

AVGIDSDriver

AVGIDSEH

AVGIDSFilter

AVGIDSShim

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

23 maart 2011 aangepast door kape