foutmelding bij WLM

[kweezie wabbit]

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Folder::

c:\users\Lotje\AppData\Local\{1E48D5AF-F549-41E0-8E33-7D9810018958}

c:\users\Lotje\AppData\Local\{D08D7C01-0C79-4C94-89D5-22CA4BE97925}

c:\users\Lotje\AppData\Local\{B699525B-52FC-498A-B867-6A5F0B4D81A5}

c:\users\Lotje\AppData\Local\{F465D559-D674-450B-AA3B-73CB0EA79783}

c:\users\Lotje\AppData\Local\{3D0B7BF6-24AE-4D3A-914F-3A0288C94D98}

c:\users\Lotje\AppData\Local\{F9A76199-BF54-4E98-816E-7CBEAAB6C2F4}

c:\users\Lotje\AppData\Local\{6A7422B5-549D-4076-B2CA-A31A13033829}

c:\users\Lotje\AppData\Local\{79B0E408-B025-4AA0-817B-57585B9F9833}

c:\users\Lotje\AppData\Local\{B9FD3B91-5860-456D-82AE-1F277BE544C1}

c:\programdata\Trymedia

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

[Gast correos]

U vraagt wij draaien,

ComboFix 11-04-05.02 - Lotje 06/04/2011 21:11:59.2.2 - x86

Microsoft Windows 7 Starter 6.1.7601.1.1252.32.1043.18.1013.476 [GMT 2:00]

Gestart vanuit: c:\users\Lotje\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Lotje\Desktop\CFScript.txt

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\Trymedia

c:\programdata\Trymedia\data\{1A6A4E66-2F16-A8FF-702E-9F4DD6B12248}

c:\programdata\Trymedia\data\{3CF9D2BD-22AC-0601-9D39-27C9BECB0423}

c:\programdata\Trymedia\data\{AE917E87-7869-DE65-20CB-871406BB867E}

c:\programdata\Trymedia\data\{DDBBBDC6-0E8D-37A0-D64A-7AC405CD6536}

c:\programdata\Trymedia\licenses\40e103bc1150ac0787a642e86037dca3.dlcn

c:\programdata\Trymedia\stats\40e103bc1150ac0787a642e86037dca3.xml

c:\users\Lotje\AppData\Local\{1E48D5AF-F549-41E0-8E33-7D9810018958}

c:\users\Lotje\AppData\Local\{3D0B7BF6-24AE-4D3A-914F-3A0288C94D98}

c:\users\Lotje\AppData\Local\{6A7422B5-549D-4076-B2CA-A31A13033829}

c:\users\Lotje\AppData\Local\{79B0E408-B025-4AA0-817B-57585B9F9833}

c:\users\Lotje\AppData\Local\{B699525B-52FC-498A-B867-6A5F0B4D81A5}

c:\users\Lotje\AppData\Local\{B9FD3B91-5860-456D-82AE-1F277BE544C1}

c:\users\Lotje\AppData\Local\{D08D7C01-0C79-4C94-89D5-22CA4BE97925}

c:\users\Lotje\AppData\Local\{F465D559-D674-450B-AA3B-73CB0EA79783}

c:\users\Lotje\AppData\Local\{F9A76199-BF54-4E98-816E-7CBEAAB6C2F4}

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-03-06 to 2011-04-06 ))))))))))))))))))))))))))))))

.

.

2011-04-06 19:28 . 2011-04-06 19:28 -------- d-----w- c:\users\Lotje\AppData\Local\temp

2011-04-06 19:28 . 2011-04-06 19:28 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-04-06 07:29 . 2011-04-06 07:30 -------- d-----w- c:\users\Lotje\AppData\Local\{7ECD2F65-FD86-4306-898E-03AC27C00716}

2011-04-05 19:04 . 2011-04-05 19:04 -------- d-----w- c:\users\Lotje\AppData\Local\{7A6DEC15-CFC0-482D-A530-C97B8BCFA25D}

2011-04-05 09:43 . 2011-03-15 04:05 6792528 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0376D02C-BAD9-42AB-9B32-093EA9F7CD6D}\mpengine.dll

2011-04-03 16:37 . 2011-04-03 16:37 -------- d-----w- c:\program files\Trend Micro

2011-04-02 14:43 . 2011-04-02 14:53 -------- d-----w- c:\users\Lotje\AppData\Roaming\Windows Live Writer

2011-04-02 14:43 . 2011-04-02 14:43 -------- d-----w- c:\users\Lotje\AppData\Local\Windows Live Writer

2011-04-02 14:42 . 2011-04-02 14:42 -------- d-----w- c:\windows\nl

2011-04-02 14:38 . 2011-04-02 14:38 15712 ----a-w- c:\program files\Common Files\Windows Live\.cache\b0e0e07b1cbf14306\MeshBetaRemover.exe

2011-03-31 10:01 . 2011-03-31 10:01 -------- d-----w- c:\program files\Gadwin Systems

2011-03-21 10:44 . 2011-03-21 10:44 -------- d-----w- c:\program files\Common Files\Java

2011-03-09 16:21 . 2011-02-19 06:30 805376 ----a-w- c:\windows\system32\FntCache.dll

2011-03-09 16:21 . 2011-02-19 06:30 1076736 ----a-w- c:\windows\system32\DWrite.dll

2011-03-09 16:21 . 2011-02-19 06:30 739840 ----a-w- c:\windows\system32\d2d1.dll

2011-03-09 16:21 . 2010-12-23 05:54 642048 ----a-w- c:\windows\system32\CPFilters.dll

2011-03-09 16:21 . 2010-12-23 05:54 534528 ----a-w- c:\windows\system32\EncDec.dll

2011-03-09 16:21 . 2010-12-23 05:54 850944 ----a-w- c:\windows\system32\sbe.dll

2011-03-09 16:21 . 2010-12-23 05:50 199680 ----a-w- c:\windows\system32\mpg2splt.ax

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-21 10:44 . 2010-07-21 20:04 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-03-15 15:16 . 2010-02-22 17:03 66600 ----a-w- c:\windows\system32\drivers\L1C62x86.sys

2011-03-10 07:19 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-02-24 16:26 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll

2011-02-23 15:04 . 2010-06-30 13:14 40648 ----a-w- c:\windows\avastSS.scr

2011-02-23 15:04 . 2010-03-24 09:11 190016 ----a-w- c:\windows\system32\aswBoot.exe

2011-02-23 14:56 . 2011-02-25 12:59 371544 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-02-23 14:56 . 2010-03-24 09:12 301528 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-02-23 14:55 . 2010-03-24 09:11 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-02-23 14:55 . 2010-03-24 09:12 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-02-23 14:55 . 2010-03-24 09:11 53592 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2011-02-23 14:54 . 2010-03-24 09:12 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2011-02-03 05:54 . 2011-02-10 08:04 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys

2011-02-02 17:11 . 2010-03-24 09:25 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-01-17 05:47 . 2011-02-24 15:27 161792 ----a-w- c:\windows\system32\d3d10_1.dll

2011-01-07 07:46 . 2011-02-23 08:22 870912 ----a-w- c:\windows\system32\XpsPrint.dll

2011-01-07 07:46 . 2011-02-23 08:22 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll

2011-01-07 07:45 . 2011-02-10 08:05 34304 ----a-w- c:\windows\system32\atmlib.dll

2011-01-07 06:01 . 2011-02-10 08:05 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2011-01-07 05:43 . 2011-02-10 08:05 294400 ----a-w- c:\windows\system32\atmfd.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-02-23 15:04 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-09-10 13:41 120104 ----a-w- c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]

"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-09-30 703008]

"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-02-23 3451496]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-11-02 9808488]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-10-24 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-10-24 173592]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-10-24 150552]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-04 136176]

R3 EUCR;EUCR;c:\windows\system32\DRIVERS\EUCR6SK.SYS [2010-12-14 82768]

R3 MWLService;MyWinLocker Service;c:\program files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 18992]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 16432]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60976]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-02-23 53592]

S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [2009-08-24 107016]

S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-09-30 727584]

S2 Greg_Service;GRegService;c:\program files\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]

S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [2009-07-10 253952]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2011-03-15 66600]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc

.

Inhoud van de 'Gedeelde Taken' map

.

2011-04-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-04 19:48]

.

2011-04-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-04 19:48]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://ebay.be/

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Afbeelding verzenden naar &Bluetooth-apparaat... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

.

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Voltooingstijd: 2011-04-06 21:33:17

ComboFix-quarantined-files.txt 2011-04-06 19:33

ComboFix2.txt 2011-04-05 14:06

.

Pre-Run: 203.887.280.128 bytes beschikbaar

Post-Run: 203.606.470.656 bytes beschikbaar

.

- - End Of File - - 6E6B5A57E93A45BDE781169C1C325938

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 21:40:27, on 6/04/2011

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v8.00 (8.00.7601.17514)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

C:\Program Files\Alwil Software\Avast5\AvastUI.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\system32\igfxsrvc.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\igfxext.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Users\Lotje\Desktop\HijackThis.exe

C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = eBay.be - eBay Belgique, eBay België

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

O4 - HKLM\..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui

O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: Afbeelding verzenden naar &Bluetooth-apparaat... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

O23 - Service: Dritek WMI Service (DsiWMIService) - Dritek System Inc. - C:\Program Files\Launch Manager\dsiwmis.exe

O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

O23 - Service: GRegService (Greg_Service) - Acer Incorporated - C:\Program Files\Acer\Registration\GregHSRW.exe

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe

O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe

O23 - Service: Updater Service - Acer - C:\Program Files\Acer\Acer Updater\UpdaterService.exe

--

End of file - 5081 bytes

Zo te zien zijn de 015 lijnen verdwenen.:top:Man man man wat een expert!

Nogmaals heel erg bedankt.

Amicale groeten.

Correos.;-)

[kweezie wabbit]

Dit ziet er allemaal goed uit.

Heb je nog problemen met de pc?

[Gast correos]

Voor Kweezie wabbit,

Totaal geen problemen meer,meld mijn wederhelft,iedereen content.

Bedankt uit haar naam en voor mij mag deze gesloten worden.

Hopelijk kan 'k in de toekomst zelf een bijdrage in oplossingen aangeven,dit als blijk van waardering voor deze uitstekende site.

Amicale groeten.

Correos.

[kweezie wabbit]

Dan markeren we de vraag als opgelost.

nog veel computerplezier allebei.