Spel traag voor pc

kape · 24 mei 2011

Nog niet helemaal correct verlopen. Doe even eerst het volgende :

Download ComboFix van één van deze locaties:

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:

Klik hier

2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.

3. Dubbelklik op "Combofix.exe" om de tool te starten.

4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion", herstart dan de computer.

5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Thuurke · 25 mei 2011

Hier is het log (heb er wel een paar minuten achter gewacht):

ComboFix 11-05-24.05 - HP 25/05/2011 12:57:00.1.2 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.32.1043.18.4063.2545 [GMT 2:00]

Gestart vanuit: c:\users\HP\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\Mozilla Firefox\searchplugins\SearchquWebSearch.xml

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-04-25 to 2011-05-25 ))))))))))))))))))))))))))))))

.

2011-05-25 11:18 . 2011-05-25 11:18 -------- d-----w- c:\users\Henri\AppData\Local\temp

2011-05-25 11:18 . 2011-05-25 11:18 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-05-25 06:00 . 2011-05-25 06:00 -------- d-----w- c:\users\HP\AppData\Local\{61FF7C8E-0090-49DF-9242-71BD835F8ACF}

2011-05-24 18:36 . 2011-05-24 18:36 -------- d-----w- c:\program files (x86)\Java

2011-05-24 14:29 . 2011-04-09 06:58 142336 ----a-w- c:\windows\system32\poqexec.exe

2011-05-24 14:29 . 2011-04-09 05:56 123904 ----a-w- c:\windows\SysWow64\poqexec.exe

2011-05-24 10:33 . 2011-05-24 10:33 -------- d-----w- c:\users\HP\AppData\Roaming\Malwarebytes

2011-05-24 10:33 . 2010-12-20 16:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-05-24 10:33 . 2011-05-24 10:33 -------- d-----w- c:\programdata\Malwarebytes

2011-05-24 10:33 . 2011-05-24 10:33 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2011-05-24 10:33 . 2010-12-20 16:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-05-24 06:45 . 2011-05-24 06:45 -------- d-----w- c:\users\HP\AppData\Local\{E083AD87-CF8E-4B30-B863-A86F73BA2589}

2011-05-24 06:06 . 2011-05-09 22:00 8718160 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5107B4D4-7F6A-4535-9C54-FBC606AB10E2}\mpengine.dll

2011-05-23 19:15 . 2011-05-23 19:15 388096 ----a-r- c:\users\HP\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-05-23 19:15 . 2011-05-23 19:15 -------- d-----w- c:\program files (x86)\Trend Micro

2011-05-23 15:43 . 2011-05-23 15:43 -------- d-----w- c:\users\HP\AppData\Local\{C009657E-48D6-4202-9E5E-9F541A6B96B1}

2011-05-20 21:12 . 2011-05-20 21:13 -------- d-----w- c:\users\HP\AppData\Local\{56C688FC-F70F-44DB-8D13-CCE17ACD118A}

2011-05-19 19:53 . 2011-05-19 19:54 -------- d-----w- c:\users\HP\AppData\Local\{96C6F470-E644-493F-B61C-E96130E6C50E}

2011-05-19 06:08 . 2011-05-19 06:08 -------- d-----w- c:\users\HP\AppData\Local\{3B213BA0-996F-49E5-8498-3D4D637E3F81}

2011-05-18 13:37 . 2011-05-18 13:37 -------- d-----w- C:\NVIDIA

2011-05-18 08:11 . 2011-05-18 08:11 -------- d-----w- c:\users\HP\AppData\Local\{CB7CBE90-BB28-4DD0-8F74-8069AB82A0AA}

2011-05-17 20:04 . 2011-05-17 20:04 -------- d-----w- c:\users\HP\AppData\Local\{9DA34129-3E20-4C5B-846F-28938FB898EE}

2011-05-17 16:36 . 2008-07-30 05:20 72200 ----a-w- c:\windows\system32\XAPOFX1_1.dll

2011-05-17 16:36 . 2008-07-30 05:20 68616 ----a-w- c:\windows\SysWow64\XAPOFX1_1.dll

2011-05-17 16:36 . 2008-07-30 05:20 513544 ----a-w- c:\windows\system32\XAudio2_2.dll

2011-05-17 16:36 . 2008-07-30 05:20 509448 ----a-w- c:\windows\SysWow64\XAudio2_2.dll

2011-05-17 16:36 . 2008-07-30 05:20 177672 ----a-w- c:\windows\system32\xactengine3_2.dll

2011-05-17 16:36 . 2008-07-30 05:20 238088 ----a-w- c:\windows\SysWow64\xactengine3_2.dll

2011-05-17 16:35 . 2011-05-17 16:36 -------- d--h--w- c:\windows\msdownld.tmp

2011-05-17 06:39 . 2011-05-17 06:40 -------- d-----w- c:\users\HP\AppData\Local\{1B8B193C-3283-4E83-AE34-6C1976D22A4A}

2011-05-16 06:06 . 2011-05-16 06:06 -------- d-----w- c:\users\HP\AppData\Local\{D350EB92-48B9-46BC-B4F1-62BD0C73656D}

2011-05-15 13:48 . 2011-05-15 13:48 -------- d-----w- c:\users\HP\AppData\Local\{A4714AFD-FD39-4E66-A107-414CB5250052}

2011-05-14 14:00 . 2011-05-14 14:01 -------- d-----w- c:\users\HP\AppData\Local\{DBE0E335-DAD7-4786-9D9A-A8F851394EC0}

2011-05-13 21:24 . 2011-05-13 21:24 -------- d-----w- c:\users\HP\AppData\Local\{C056A354-02A8-4211-9590-DF35527D22A6}

2011-05-13 06:29 . 2011-05-13 06:29 -------- d-----w- c:\users\HP\AppData\Local\{CDDADB75-662C-4F61-9169-9B6A42FF4CC6}

2011-05-12 15:07 . 2011-05-12 15:44 -------- d-----w- c:\program files (x86)\DVDFab 8 Qt

2011-05-12 14:08 . 2011-05-12 14:09 -------- d-----w- c:\users\HP\AppData\Local\{B341AA55-EE28-4D2E-84AF-341719B85B1D}

2011-05-11 21:46 . 2011-04-09 06:45 5509504 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-05-11 21:46 . 2011-04-09 06:13 3957632 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2011-05-11 21:46 . 2011-04-09 06:13 3901824 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2011-05-11 21:46 . 2011-03-29 03:32 324608 ----a-w- c:\windows\system32\drivers\usbport.sys

2011-05-11 21:46 . 2011-03-29 03:32 52224 ----a-w- c:\windows\system32\drivers\usbehci.sys

2011-05-11 21:46 . 2011-03-29 03:32 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys

2011-05-11 21:46 . 2011-03-29 03:32 99328 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2011-05-11 21:46 . 2011-03-29 03:32 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys

2011-05-11 21:46 . 2011-03-29 03:32 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys

2011-05-11 21:46 . 2011-03-29 03:32 7936 ----a-w- c:\windows\system32\drivers\usbd.sys

2011-05-11 19:02 . 2011-05-11 19:03 -------- d-----w- c:\users\HP\AppData\Local\{116A1A1A-3C7C-4091-8DE7-23FC66522F8C}

2011-05-10 20:00 . 2011-05-10 20:00 -------- d-----w- c:\users\HP\AppData\Local\{7ECE7B9B-2ED6-43D2-B513-A4361B61CACB}

2011-05-10 19:59 . 2011-05-10 19:59 -------- d-----w- c:\users\HP\AppData\Local\{48E3030D-C67F-429C-BA9F-9349CA7450FF}

2011-05-10 10:07 . 2011-05-10 10:07 145184 ----a-w- c:\windows\SysWow64\Minecraft.exe

2011-05-09 06:47 . 2011-05-09 06:48 -------- d-----w- c:\users\HP\AppData\Local\{6970D11B-85F7-41FE-85A1-86BBE0EE8197}

2011-05-08 18:47 . 2011-05-08 18:47 -------- d-----w- c:\users\HP\AppData\Local\{E0C462D2-1A5C-4AF6-BC55-C086BB7B4ABC}

2011-05-07 12:58 . 2011-05-07 12:58 -------- d-----w- c:\programdata\Bandoo

2011-05-07 12:47 . 2011-05-07 12:47 -------- d-----w- c:\users\HP\AppData\Local\{D83B26B0-81C1-4021-A005-E67EBDAC7B92}

2011-05-07 11:04 . 2011-05-07 11:05 -------- d-----w- c:\users\HP\AppData\Local\{CFB79C90-6D8C-4611-BABC-0FCDF031B50A}

2011-05-06 17:11 . 2011-05-06 17:11 -------- d-----w- c:\windows\.jagex_cache_32

2011-05-05 04:20 . 2011-05-05 04:20 286720 ----a-w- c:\windows\iun507.exe

2011-05-05 04:20 . 1994-12-06 02:30 12800 ----a-w- c:\windows\system\WING32.DLL

2011-05-04 20:35 . 2011-05-04 20:35 -------- d-----w- c:\users\HP\AppData\Local\{D08C824D-A30F-4115-9CA9-B1B85B9D1BEA}

2011-05-04 16:44 . 2011-05-04 16:44 -------- d-----w- c:\programdata\vsosdk

2011-05-04 16:04 . 2011-05-07 12:40 -------- d-----w- c:\program files (x86)\DVDFab 8

2011-05-04 07:09 . 2011-05-04 07:10 -------- d-----w- c:\users\HP\AppData\Local\{4CE6B3A3-06FC-418C-86D6-9FB10DE2C62E}

2011-05-03 18:13 . 2011-05-03 18:14 -------- d-----w- c:\users\HP\AppData\Local\{6B36D440-5021-4391-8B62-560EC601DADC}

2011-05-02 17:42 . 2011-05-02 17:42 -------- d-----w- c:\users\HP\AppData\Local\{EC7B6221-14E6-4137-9726-911AC2C033A2}

2011-05-01 15:00 . 2011-05-24 10:14 -------- d-----w- c:\program files (x86)\uTorrentBar_NL

2011-05-01 08:42 . 2011-05-01 08:43 -------- d-----w- c:\users\HP\AppData\Local\{EA0A230F-5332-41D9-9EC8-A59715D2FC86}

2011-04-30 16:28 . 2011-04-30 16:28 -------- d-----w- c:\users\HP\AppData\Local\{1373E36D-5BF7-421E-85A2-889C554EF8C5}

2011-04-27 18:55 . 2011-04-27 18:55 -------- d-----w- c:\users\HP\AppData\Local\{BBE0B354-8246-4764-857E-A48AAA788423}

2011-04-26 17:08 . 2011-04-26 17:08 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird

2011-04-26 17:03 . 2011-04-26 17:03 -------- d-----w- c:\users\HP\AppData\Local\{7BB1555A-B933-4D26-8B4A-FD65C87FC1B8}

2011-04-25 18:39 . 2011-04-25 18:40 -------- d-----w- c:\users\HP\AppData\Local\MediaGet2

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-05-24 18:36 . 2010-11-12 19:54 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll

2011-05-10 12:10 . 2011-04-23 17:04 40112 ----a-w- c:\windows\avastSS.scr

2011-05-10 12:10 . 2011-04-23 17:04 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe

2011-05-10 12:10 . 2011-04-23 17:05 253888 ----a-w- c:\windows\system32\aswBoot.exe

2011-05-10 12:04 . 2011-04-23 17:05 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-05-10 12:04 . 2011-04-23 17:05 287576 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-05-10 12:02 . 2011-04-23 17:05 53592 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-05-10 11:59 . 2011-04-23 17:05 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-05-10 11:59 . 2011-04-23 17:05 64344 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2011-05-10 11:59 . 2011-04-23 17:05 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2011-04-16 16:08 . 2011-04-16 16:07 199 ----a-w- c:\users\HP\AppData\Local\GLFEE6D.tmp

2011-04-14 10:38 . 2011-04-14 10:38 52 ----a-w- c:\users\HP\AppData\Local\GLF722D.tmp

2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\SysWow64\GPhotos.scr

2011-04-02 10:41 . 2011-04-02 10:41 86016 ----a-w- c:\windows\SysWow64\frapsvid.dll

2011-04-02 10:41 . 2011-04-02 10:41 84992 ----a-w- c:\windows\system32\frapsv64.dll

2011-03-11 06:19 . 2011-04-15 20:17 1395712 ----a-w- c:\windows\system32\mfc42.dll

2011-03-11 06:19 . 2011-04-15 20:17 1359872 ----a-w- c:\windows\system32\mfc42u.dll

2011-03-11 05:40 . 2011-04-15 20:17 1137664 ----a-w- c:\windows\SysWow64\mfc42.dll

2011-03-11 05:40 . 2011-04-15 20:17 1164288 ----a-w- c:\windows\SysWow64\mfc42u.dll

2011-03-08 19:27 . 2010-06-24 10:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-03-08 06:14 . 2011-04-15 20:17 976896 ----a-w- c:\windows\system32\inetcomm.dll

2011-03-08 05:38 . 2011-04-15 20:17 740864 ----a-w- c:\windows\SysWow64\inetcomm.dll

2011-03-04 06:17 . 2011-04-28 10:13 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2011-03-04 06:17 . 2011-04-28 10:13 347648 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2011-03-03 06:17 . 2011-04-15 20:17 182272 ----a-w- c:\windows\system32\dnsrslvr.dll

2011-03-03 06:14 . 2011-04-15 20:17 30208 ----a-w- c:\windows\system32\dnscacheugc.exe

2011-03-03 05:27 . 2011-04-15 20:17 28672 ----a-w- c:\windows\SysWow64\dnscacheugc.exe

2011-03-03 03:58 . 2011-04-15 20:17 3133440 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Firefox Preloader.lnk - c:\program files (x86)\FirefoxPreloader\FirefoxPreloader.exe [2011-4-15 98304]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-01-12 227896]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-09-02 225280]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

S3 WSDPrintDevice;WSD-ondersteuning voor afdrukken via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]

2009-07-14 01:14 301568 ----a-w- c:\windows\System32\cmd.exe

.

Inhoud van de 'Gedeelde Taken' map

.

2011-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1561261077-3936807583-1715766741-1000Core.job

- c:\users\HP\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-23 16:29]

.

2011-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1561261077-3936807583-1715766741-1000UA.job

- c:\users\HP\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-23 16:29]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-05-10 12:10 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-23 16334368]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x1

.

------- Bijkomende Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.be/

uDefault_Search_URL = hxxp://www.google.com/ie

mLocal Page = c:\windows\SysWOW64\blank.htm

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xporteren naar Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Free YouTube Download - c:\users\HP\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm

IE: Free YouTube to Mp3 Converter - c:\users\HP\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

FF - ProfilePath - c:\users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\lsq3wa7u.default\

FF - prefs.js: browser.startup.homepage - Google

.

- - - - ORPHANS VERWIJDERD - - - -

.

Toolbar-10 - (no file)

Toolbar-!{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)

Toolbar-!{87775fdb-6972-41f9-ae51-8326e38cb206} - (no file)

Toolbar-!{99079a25-328f-4bd4-be04-00955acaa0a7} - (no file)

Toolbar-10 - (no file)

Toolbar-!{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)

Toolbar-!{87775fdb-6972-41f9-ae51-8326e38cb206} - (no file)

Toolbar-!{99079a25-328f-4bd4-be04-00955acaa0a7} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{2D8D9ACC-F6D7-4362-8876-A275CA929591} - (no file)

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Voltooingstijd: 2011-05-25 13:30:06

ComboFix-quarantined-files.txt 2011-05-25 11:30

.

Pre-Run: 254.848.737.280 bytes beschikbaar

Post-Run: 254.609.391.616 bytes beschikbaar

.

- - End Of File - - 934F1B5A4B9FFA762D82D0CA16B494A4

kape · 25 mei 2011

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\msdownld.tmp

c:\users\HP\AppData\Local\GLFEE6D.tmp

c:\users\HP\AppData\Local\GLF722D.tmp

Folder::

c:\users\HP\AppData\Local\{61FF7C8E-0090-49DF-9242-71BD835F8ACF}

c:\users\HP\AppData\Local\{E083AD87-CF8E-4B30-B863-A86F73BA2589}

c:\users\HP\AppData\Local\{C009657E-48D6-4202-9E5E-9F541A6B96B1}

c:\users\HP\AppData\Local\{56C688FC-F70F-44DB-8D13-CCE17ACD118A}

c:\users\HP\AppData\Local\{96C6F470-E644-493F-B61C-E96130E6C50E}

c:\users\HP\AppData\Local\{3B213BA0-996F-49E5-8498-3D4D637E3F81}

c:\users\HP\AppData\Local\{CB7CBE90-BB28-4DD0-8F74-8069AB82A0AA}

c:\users\HP\AppData\Local\{9DA34129-3E20-4C5B-846F-28938FB898EE}

c:\users\HP\AppData\Local\{1B8B193C-3283-4E83-AE34-6C1976D22A4A}

c:\users\HP\AppData\Local\{D350EB92-48B9-46BC-B4F1-62BD0C73656D}

c:\users\HP\AppData\Local\{A4714AFD-FD39-4E66-A107-414CB5250052}

c:\users\HP\AppData\Local\{DBE0E335-DAD7-4786-9D9A-A8F851394EC0}

c:\users\HP\AppData\Local\{C056A354-02A8-4211-9590-DF35527D22A6}

c:\users\HP\AppData\Local\{CDDADB75-662C-4F61-9169-9B6A42FF4CC6}

c:\users\HP\AppData\Local\{B341AA55-EE28-4D2E-84AF-341719B85B1D}

c:\users\HP\AppData\Local\{116A1A1A-3C7C-4091-8DE7-23FC66522F8C}

c:\users\HP\AppData\Local\{7ECE7B9B-2ED6-43D2-B513-A4361B61CACB}

c:\users\HP\AppData\Local\{48E3030D-C67F-429C-BA9F-9349CA7450FF}

c:\users\HP\AppData\Local\{6970D11B-85F7-41FE-85A1-86BBE0EE8197}

c:\users\HP\AppData\Local\{E0C462D2-1A5C-4AF6-BC55-C086BB7B4ABC}

c:\programdata\Bandoo

c:\users\HP\AppData\Local\{D83B26B0-81C1-4021-A005-E67EBDAC7B92}

c:\users\HP\AppData\Local\{CFB79C90-6D8C-4611-BABC-0FCDF031B50A}

c:\users\HP\AppData\Local\{D08C824D-A30F-4115-9CA9-B1B85B9D1BEA}

c:\users\HP\AppData\Local\{4CE6B3A3-06FC-418C-86D6-9FB10DE2C62E}

c:\users\HP\AppData\Local\{6B36D440-5021-4391-8B62-560EC601DADC}

c:\users\HP\AppData\Local\{EC7B6221-14E6-4137-9726-911AC2C033A2}

c:\program files (x86)\uTorrentBar_NL

c:\users\HP\AppData\Local\{EA0A230F-5332-41D9-9EC8-A59715D2FC86}

c:\users\HP\AppData\Local\{1373E36D-5BF7-421E-85A2-889C554EF8C5}

c:\users\HP\AppData\Local\{BBE0B354-8246-4764-857E-A48AAA788423}

c:\users\HP\AppData\Local\{7BB1555A-B933-4D26-8B4A-FD65C87FC1B8}

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

Thuurke · 25 mei 2011

Dit is van comboFix:

ComboFix 11-05-24.05 - HP 25/05/2011 17:53:21.2.2 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.32.1043.18.4063.2689 [GMT 2:00]

Gestart vanuit: c:\users\HP\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\HP\Desktop\CFScript.txt..txt

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\users\HP\AppData\Local\GLF722D.tmp"

"c:\users\HP\AppData\Local\GLFEE6D.tmp"

"c:\windows\msdownld.tmp"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\uTorrentBar_NL

c:\program files (x86)\uTorrentBar_NL\GottenAppsContextMenu.xml

c:\program files (x86)\uTorrentBar_NL\OtherAppsContextMenu.xml

c:\program files (x86)\uTorrentBar_NL\SharedAppsContextMenu.xml

c:\program files (x86)\uTorrentBar_NL\toolbar.cfg

c:\program files (x86)\uTorrentBar_NL\ToolbarContextMenu.xml

c:\program files (x86)\uTorrentBar_NL\UNWISE.EXE

c:\program files (x86)\uTorrentBar_NL\uTorrentBar_NLToolbarHelper.exe

c:\programdata\Bandoo

c:\programdata\Bandoo\config.xml

c:\programdata\Bandoo\CrashReportInfo.xml

c:\programdata\Bandoo\WPSubsystems.xml

c:\users\HP\AppData\Local\{116A1A1A-3C7C-4091-8DE7-23FC66522F8C}

c:\users\HP\AppData\Local\{1373E36D-5BF7-421E-85A2-889C554EF8C5}

c:\users\HP\AppData\Local\{1B8B193C-3283-4E83-AE34-6C1976D22A4A}

c:\users\HP\AppData\Local\{3B213BA0-996F-49E5-8498-3D4D637E3F81}

c:\users\HP\AppData\Local\{48E3030D-C67F-429C-BA9F-9349CA7450FF}

c:\users\HP\AppData\Local\{4CE6B3A3-06FC-418C-86D6-9FB10DE2C62E}

c:\users\HP\AppData\Local\{56C688FC-F70F-44DB-8D13-CCE17ACD118A}

c:\users\HP\AppData\Local\{61FF7C8E-0090-49DF-9242-71BD835F8ACF}

c:\users\HP\AppData\Local\{6970D11B-85F7-41FE-85A1-86BBE0EE8197}

c:\users\HP\AppData\Local\{6B36D440-5021-4391-8B62-560EC601DADC}

c:\users\HP\AppData\Local\{7BB1555A-B933-4D26-8B4A-FD65C87FC1B8}

c:\users\HP\AppData\Local\{7ECE7B9B-2ED6-43D2-B513-A4361B61CACB}

c:\users\HP\AppData\Local\{96C6F470-E644-493F-B61C-E96130E6C50E}

c:\users\HP\AppData\Local\{9DA34129-3E20-4C5B-846F-28938FB898EE}

c:\users\HP\AppData\Local\{A4714AFD-FD39-4E66-A107-414CB5250052}

c:\users\HP\AppData\Local\{B341AA55-EE28-4D2E-84AF-341719B85B1D}

c:\users\HP\AppData\Local\{BBE0B354-8246-4764-857E-A48AAA788423}

c:\users\HP\AppData\Local\{C009657E-48D6-4202-9E5E-9F541A6B96B1}

c:\users\HP\AppData\Local\{C056A354-02A8-4211-9590-DF35527D22A6}

c:\users\HP\AppData\Local\{CB7CBE90-BB28-4DD0-8F74-8069AB82A0AA}

c:\users\HP\AppData\Local\{CDDADB75-662C-4F61-9169-9B6A42FF4CC6}

c:\users\HP\AppData\Local\{CFB79C90-6D8C-4611-BABC-0FCDF031B50A}

c:\users\HP\AppData\Local\{D08C824D-A30F-4115-9CA9-B1B85B9D1BEA}

c:\users\HP\AppData\Local\{D350EB92-48B9-46BC-B4F1-62BD0C73656D}

c:\users\HP\AppData\Local\{D83B26B0-81C1-4021-A005-E67EBDAC7B92}

c:\users\HP\AppData\Local\{DBE0E335-DAD7-4786-9D9A-A8F851394EC0}

c:\users\HP\AppData\Local\{E083AD87-CF8E-4B30-B863-A86F73BA2589}

c:\users\HP\AppData\Local\{E0C462D2-1A5C-4AF6-BC55-C086BB7B4ABC}

c:\users\HP\AppData\Local\{EA0A230F-5332-41D9-9EC8-A59715D2FC86}

c:\users\HP\AppData\Local\{EC7B6221-14E6-4137-9726-911AC2C033A2}

c:\users\HP\AppData\Local\GLF722D.tmp

c:\users\HP\AppData\Local\GLFEE6D.tmp

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-04-25 to 2011-05-25 ))))))))))))))))))))))))))))))

.

2011-05-25 16:10 . 2011-05-25 16:10 -------- d-----w- c:\users\Henri\AppData\Local\temp

2011-05-25 16:10 . 2011-05-25 16:10 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-05-25 14:26 . 2011-05-25 14:26 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl