vista 7 SP1

pandora6040 · 28 juni 2011

Hallo Kweezie

Jammer weggemoeten, maar nu terug.

Ik heb dit terug uitgevoerd als gevraagd, maar denk dat je er terug niet veel zal aan hebben omdat ik vermoed dat het toch het zelfde zal zijn, omdat ik terug zelfde probleem heb maar nu dat ander bestand gemist wordt, nl: pev.cfxxe en ze melding zullen geven als probleem is opgelost. Is dan terug gestart en hieronder het log.

Eronder zal ik ook HT log plaatsen.

Die problemen ondervind ik toch sedert het opnieuw inst; met 2é link of de updates die hij doet.

Meschien toch terug verwijderen en met 1é link werken?

ComboFix 11-06-27.04 - Eigenaar 28/06/2011 19:16:47.13.4 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.32.1043.18.4023.2213 [GMT 2:00]

Gestart vanuit: c:\users\Eigenaar\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Eigenaar\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-05-28 to 2011-06-28 ))))))))))))))))))))))))))))))

.

2011-06-28 17:30 . 2011-06-28 17:30 -------- d-----w- c:\users\Gast\AppData\Local\temp

2011-06-28 17:30 . 2011-06-28 17:30 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-06-28 07:23 . 2011-06-28 07:24 -------- d-----w- c:\users\Eigenaar\AppData\Local\{B52487C3-65BB-4A0D-BD05-FAD84C017871}

2011-06-27 19:22 . 2011-06-27 19:23 -------- d-----w- c:\users\Eigenaar\AppData\Local\{F814101D-1356-4A1C-B680-6B6CAED48534}

2011-06-27 07:13 . 2011-06-27 07:13 -------- d-----w- c:\users\Eigenaar\AppData\Local\{68CF0F54-7924-43AD-8494-0813EDC3DC0E}

2011-06-26 19:11 . 2011-06-26 19:12 -------- d-----w- c:\users\Eigenaar\AppData\Local\{DE25DD5D-4B45-4D77-9493-7387871FB6A5}

2011-06-26 07:04 . 2011-06-26 07:04 -------- d-----w- c:\users\Eigenaar\AppData\Local\{4D46885E-4A9B-4147-8116-648A2FFD1999}

2011-06-25 19:04 . 2011-06-25 19:04 -------- d-----w- c:\users\Eigenaar\AppData\Local\{CB94869A-D736-4C56-BA81-D15C7DF44195}

2011-06-25 16:50 . 2011-06-25 16:50 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared

2011-06-25 07:03 . 2011-06-25 07:03 -------- d-----w- c:\users\Eigenaar\AppData\Local\{70C080E4-DAAA-4857-8F5A-4B693EECD0D4}

2011-06-24 19:03 . 2011-06-24 19:03 -------- d-----w- c:\users\Eigenaar\AppData\Local\{9917CE4B-4910-4D22-8F58-8EAEC564C7CE}

2011-06-24 07:01 . 2011-06-24 07:02 -------- d-----w- c:\users\Eigenaar\AppData\Local\{E0A66694-EF23-4FD7-908B-B9E785B4D890}

2011-06-23 10:01 . 2011-06-23 10:01 -------- d-----w- c:\program files (x86)\Common Files\Java

2011-06-23 09:43 . 2011-06-23 09:44 -------- d-----w- c:\users\Eigenaar\AppData\Local\{5B0A638F-741C-47BD-8852-4668B8C07FA4}

2011-06-22 21:43 . 2011-06-22 21:43 -------- d-----w- c:\users\Eigenaar\AppData\Local\{BCB00099-C6AE-4C2A-A4AA-05BEEDD1D3F2}

2011-06-22 21:37 . 2011-06-22 21:37 -------- d-----w- c:\users\Eigenaar\AppData\Local\{BC485C62-5B90-4AF4-8022-A869F5BBA0D9}

2011-06-22 07:45 . 2011-06-22 07:45 -------- d-----w- c:\users\Eigenaar\AppData\Local\{90A83CF9-6867-44D9-ADDD-ED69092EFF25}

2011-06-21 19:44 . 2011-06-21 19:44 -------- d-----w- c:\users\Eigenaar\AppData\Local\{295024DE-282A-4397-A49E-8511D2CC3E84}

2011-06-21 10:48 . 2011-06-21 10:48 -------- d-----w- c:\users\Eigenaar\AppData\Local\{242CC70E-AE49-43AA-9533-69C1A8B0CDD3}

2011-06-20 22:52 . 2011-06-20 22:52 -------- d-----w- c:\users\Eigenaar\AppData\Local\{96525F85-8084-46D7-AFDD-63218454AFBD}

2011-06-20 22:48 . 2011-06-20 22:48 -------- d-----w- c:\users\Eigenaar\AppData\Local\{C21C4CF0-A5AC-4F5C-B0D1-D3720D1816EA}

2011-06-20 20:02 . 2011-06-22 13:49 -------- d-----w- C:\backups

2011-06-20 18:34 . 2011-06-20 16:08 388608 ----a-w- C:\HijackThis.exe

2011-06-20 15:18 . 2011-06-20 15:18 -------- d-----w- c:\program files\CCleaner

2011-06-20 10:48 . 2011-06-20 10:48 -------- d-----w- c:\users\Eigenaar\AppData\Local\{DB6D856F-74CF-4C13-BCAF-A2E11EA51340}

2011-06-19 22:47 . 2011-06-19 22:47 -------- d-----w- c:\users\Eigenaar\AppData\Local\{514555E4-EF1A-4825-A7BA-1C04F3F369E7}

2011-06-19 14:49 . 2009-10-10 03:17 14336 ----a-w- c:\windows\system32\drivers\sffp_sd.sys

2011-06-19 14:49 . 2009-10-10 02:41 109056 ----a-w- c:\windows\system32\drivers\sdbus.sys

2011-06-19 10:46 . 2011-06-19 10:47 -------- d-----w- c:\users\Eigenaar\AppData\Local\{AA448307-6D7E-4537-8AAF-669985540453}

2011-06-18 17:50 . 2011-06-18 17:50 -------- d-----w- c:\users\Eigenaar\AppData\Local\{4512965C-6F16-43E3-962F-E2EFE4613904}

2011-06-18 11:53 . 2011-06-18 11:53 -------- d-----w- c:\windows\system32\SPReview

2011-06-18 11:04 . 2011-06-18 11:04 -------- d-----w- c:\users\Eigenaar\AppData\Roaming\Malwarebytes

2011-06-18 11:03 . 2011-06-18 11:03 -------- d-----w- c:\programdata\Malwarebytes

2011-06-18 11:03 . 2010-12-20 16:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-06-18 11:03 . 2011-06-18 11:03 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2011-06-18 11:03 . 2010-12-20 16:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-18 05:48 . 2011-06-18 05:49 -------- d-----w- c:\users\Eigenaar\AppData\Local\{CFCB4094-B2A3-4930-B7FB-DE1AFAE4286C}

2011-06-17 02:10 . 2011-06-17 14:10 -------- d-----w- c:\users\Eigenaar\AppData\Local\{3D5EE115-D78C-4B8F-B388-16DFC6BC213D}

2011-06-16 14:29 . 2011-06-16 14:29 -------- d-----w- c:\windows\CheckSur

2011-06-16 14:10 . 2011-06-16 14:10 -------- d-----w- c:\users\Eigenaar\AppData\Local\{878106AD-0210-4036-B1D3-F1F99B927DEB}

2011-06-16 09:52 . 2011-06-16 09:52 -------- d-----w- c:\windows\system32\EventProviders

2011-06-16 00:58 . 2011-04-23 01:19 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-06-16 00:58 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2011-06-16 00:58 . 2011-04-25 16:41 174384 ----a-w- c:\program files\Internet Explorer\sqmapi.dll

2011-06-16 00:58 . 2011-04-25 15:29 141104 ----a-w- c:\program files (x86)\Internet Explorer\sqmapi.dll

2011-06-16 00:57 . 2011-04-23 01:29 2303488 ----a-w- c:\windows\system32\jscript9.dll

2011-06-16 00:57 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\SysWow64\jscript9.dll

2011-06-16 00:11 . 2011-06-16 00:13 -------- d-----w- c:\users\Eigenaar\AppData\Local\{F20B115B-6EAE-4252-88B8-953A78EB94CB}

2011-06-15 22:52 . 2011-06-28 17:32 -------- d-----w- c:\windows\system32\wbem\repository

2011-06-14 16:04 . 2011-06-14 16:04 -------- d-----w- c:\users\Eigenaar\AppData\Local\{83E662ED-690E-45B5-87A8-A22ADD58DCFD}

2011-06-13 07:57 . 2011-06-13 08:11 -------- d-----w- c:\users\Eigenaar\AppData\Local\{535700F7-39E4-4A7A-A47D-A56255190172}

2011-06-12 12:11 . 2011-06-12 12:21 -------- d-----w- c:\users\Eigenaar\AppData\Local\{3B14A23A-45FC-4D8C-9385-CBE5CE07C661}

2011-06-12 09:01 . 2011-06-12 09:01 -------- d-----w- c:\users\Eigenaar\AppData\Local\{D393EE50-2B6A-45A3-8AD8-177382FE84D7}

2011-06-11 11:32 . 2011-06-11 11:32 -------- d-----w- c:\users\Eigenaar\AppData\Local\{FC34AD28-525E-4E39-AFFD-63285F49CBAD}

2011-06-10 19:04 . 2011-06-10 19:09 -------- d-----w- c:\users\Eigenaar\AppData\Local\{2177E62F-C202-44C4-88F7-FCCCA3F381F6}

2011-06-10 07:00 . 2011-06-10 07:01 -------- d-----w- c:\users\Eigenaar\AppData\Local\{466ECE7F-7AC7-419F-AD31-9C4B1222CC4E}

2011-06-09 15:40 . 2011-06-09 15:40 -------- d-----w- c:\users\Eigenaar\AppData\Local\{EB8E160A-D526-4EE7-9274-79C78C61BBB2}

2011-06-08 10:51 . 2011-06-08 10:52 -------- d-----w- c:\users\Eigenaar\AppData\Local\{E837E523-918D-4A7D-A080-FEF289FC1F33}

2011-06-07 15:17 . 2011-06-07 15:17 -------- d-----w- c:\users\Eigenaar\AppData\Local\{42F4808E-245E-43A5-BADB-D0054A4977B5}

2011-06-06 14:31 . 2011-06-06 14:32 -------- d-----w- c:\users\Eigenaar\AppData\Local\{2EC24D65-12B9-4FA2-BA40-58E7D1121530}

2011-06-05 10:19 . 2011-06-05 10:20 -------- d-----w- c:\users\Eigenaar\AppData\Local\{D3A4B2CF-4EFD-47E4-BE0F-3B03DBFDB686}

2011-06-04 18:48 . 2011-06-04 18:50 -------- d-----w- c:\users\Eigenaar\AppData\Local\{839BED9D-1302-49FA-A26C-857A3D2485EC}

2011-06-01 05:36 . 2011-06-01 05:36 -------- d-----w- c:\users\Eigenaar\AppData\Local\{2A88517A-4744-4687-93C7-90C759C34213}

2011-05-31 15:14 . 2011-05-31 15:16 -------- d-----w- c:\users\Eigenaar\AppData\Local\{5DFB41B8-41FF-4DB6-BF46-D8682B065C74}

2011-05-29 20:35 . 2011-05-30 15:13 -------- d-----w- c:\users\Eigenaar\AppData\Local\{221651DD-9948-474A-9364-CF312D23F0C0}

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-18 13:06 . 2009-07-14 02:36 152064 ----a-w- c:\windows\SysWow64\msclmd.dll

2011-06-18 13:06 . 2009-07-14 02:36 175104 ----a-w- c:\windows\system32\msclmd.dll

2011-06-07 17:10 . 2011-06-27 19:32 8873296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7D9D5C38-67B5-431C-BAA9-2A7D8F28EA32}\mpengine.dll

2011-06-07 17:10 . 2010-10-12 06:55 8873296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-05-13 16:58 . 2011-05-13 16:58 17720 ----a-w- c:\windows\system32\HPMDPCoInst12.dll

2011-05-13 16:58 . 2009-07-08 12:49 30008 ----a-w- c:\windows\system32\drivers\hpdskflt.sys

2011-05-13 16:58 . 2011-05-13 16:58 30520 ----a-w- c:\windows\system32\hpservice.exe

2011-05-13 16:58 . 2011-05-13 16:58 20792 ----a-w- c:\windows\system32\accelerometerdll.DLL

2011-05-13 16:57 . 2011-05-13 16:57 43320 ----a-w- c:\windows\system32\drivers\Accelerometer.sys

2011-05-13 05:16 . 2011-05-13 05:16 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-05-12 20:00 . 2010-10-03 10:39 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll

2011-05-12 18:57 . 2010-10-03 10:39 704320 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2011-05-04 02:52 . 2010-04-25 07:22 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll

2011-04-22 20:18 . 2011-05-25 11:27 27008 ----a-w- c:\windows\system32\drivers\Diskdump.sys

2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\SysWow64\GPhotos.scr

2011-04-09 06:58 . 2011-05-13 15:49 142336 ----a-w- c:\windows\system32\poqexec.exe

2011-04-09 06:45 . 2011-05-12 18:58 5509504 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-04-09 06:13 . 2011-05-12 18:58 3957632 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2011-04-09 06:13 . 2011-05-12 18:58 3901824 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2011-04-09 05:56 . 2011-05-13 15:49 123904 ----a-w- c:\windows\SysWow64\poqexec.exe

.

((((((((((((((((((((((((((((( SnapShot@2011-06-28_11.02.05 )))))))))))))))))))))))))))))))))))))))))

.

- 2009-07-14 05:10 . 2011-06-28 11:02 64612 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

+ 2009-07-14 05:10 . 2011-06-28 17:35 64612 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

+ 2009-07-13 23:25 . 2009-07-14 01:41 12288 c:\windows\servicing\wrpintapi.dll

+ 2010-03-06 09:45 . 2010-02-02 08:39 49664 c:\windows\servicing\GC64\tzupd.exe

+ 2009-07-13 23:35 . 2009-07-14 01:40 28672 c:\windows\servicing\CbsMsg.dll

+ 2009-07-13 23:35 . 2009-07-14 01:40 19456 c:\windows\servicing\CbsApi.dll

+ 2010-03-06 09:37 . 2011-06-11 11:33 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2009-07-14 04:46 . 2011-06-19 15:35 82184 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat

+ 2010-10-03 10:38 . 2011-03-20 10:13 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat

+ 2010-10-03 10:38 . 2011-03-20 10:13 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat

+ 2010-10-03 10:38 . 2011-03-20 10:13 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat

+ 2010-03-06 09:37 . 2011-06-11 11:33 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2010-03-06 09:37 . 2011-06-11 11:33 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2011-06-28 10:56 . 2011-06-28 10:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2011-06-28 17:31 . 2011-06-28 17:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2011-06-28 10:56 . 2011-06-28 10:56 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2011-06-28 17:31 . 2011-06-28 17:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2009-07-13 23:35 . 2009-07-14 01:39 194048 c:\windows\servicing\TrustedInstaller.exe

+ 2010-03-06 09:37 . 2010-08-12 09:29 262144 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat

- 2009-07-14 05:01 . 2011-06-28 10:55 324900 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2009-07-14 05:01 . 2011-06-28 17:30 324900 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2009-07-14 04:45 . 2011-06-19 14:59 7103170 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat

+ 2009-07-14 02:34 . 2011-06-28 11:17 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat

- 2009-07-14 02:34 . 2011-06-28 07:35 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat

- 2010-02-27 16:07 . 2011-06-28 10:55 10090044 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2696175809-2240157295-830168338-1000-8192.dat

+ 2010-02-27 16:07 . 2011-06-28 17:30 10090044 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2696175809-2240157295-830168338-1000-8192.dat

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{d1a1c8f1-e3d9-48df-802f-20201061ef61}]

2010-06-13 17:10 2734688 ----a-w- c:\program files (x86)\Messenger_Plus_Live_Belgium\tbMess.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{d1a1c8f1-e3d9-48df-802f-20201061ef61}"= "c:\program files (x86)\Messenger_Plus_Live_Belgium\tbMess.dll" [2010-06-13 2734688]

.

[HKEY_CLASSES_ROOT\clsid\{d1a1c8f1-e3d9-48df-802f-20201061ef61}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HPADVISOR"="c:\program files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-09-29 1685048]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Corel File Shell Monitor"="c:\program files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2009-08-25 15544]

"HPCam_Menu"="c:\program files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"QuickTime Task"="c:\program files (x86)\QuickTime\qttask.exe" [2006-09-01 282624]

"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-08-20 322104]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2009-09-02 60464]

"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]

"WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)

.

[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 AGCoreService;AG Core Services;c:\program files (x86)\AGI\core\4.2.0.10753\AGCoreService.exe [2010-03-18 20480]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Updateservice (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-15 136176]

R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-15 136176]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]

R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe [2009-03-02 89600]

S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 27136]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2010-10-14 92216]

S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]

S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [x]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]

S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

ezSharedSvc

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2009-08-20 12:24 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

Inhoud van de 'Gedeelde Taken' map

.

2011-06-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-26 20:06]

.

2011-06-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-26 20:06]

.

2011-06-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2696175809-2240157295-830168338-1000Core.job

- c:\users\Eigenaar\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-13 20:00]

.

2011-06-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2696175809-2240157295-830168338-1000UA.job

- c:\users\Eigenaar\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-13 20:00]

.

2011-06-27 c:\windows\Tasks\Norton Security Scan for Eigenaar.job

- c:\program files (x86)\Norton Security Scan\Engine\2.7.6.13\Nss.exe [2011-05-18 00:27]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-03 16395880]

"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [bU]

"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2009-08-25 610872]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-11 171520]

"fssui"="c:\program files (x86)\Windows Live\Family Safety\fsui.exe" [2010-09-22 884584]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 2184520]

"CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]

"Logitech Download Assistant"="c:\windows\system32\rundll32.exe" [2009-07-14 45568]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 1436224]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-03-23 487424]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/

uLocal Page = c:\windows\system32\blank.htm

uDefault_Search_URL = hxxp://www.google.com/ie

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xporteren naar Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Free YouTube Download - c:\users\Eigenaar\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\Eigenaar\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

TCP: DhcpNameServer = 195.130.131.5 195.130.130.133

DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab

FF - ProfilePath - c:\users\Eigenaar\AppData\Roaming\Mozilla\Firefox\Profiles\77pds0yv.default\

FF - prefs.js: browser.search.defaulturl - hxxp://plasmoo.com/index.htm?SearchMashine=true&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Plasmoo

FF - prefs.js: browser.startup.homepage - hxxp://plasmoo.com

FF - prefs.js: keyword.URL - hxxp://plasmoo.com/index.htm?SearchMashine=true&q=

FF - prefs.js: network.proxy.type - 0

.

- - - - ORPHANS VERWIJDERD - - - -

.

URLSearchHooks-{0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)

WebBrowser-{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - (no file)

WebBrowser-{D1A1C8F1-E3D9-48DF-802F-20201061EF61} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)

WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)

WebBrowser-{46735DEE-F862-49D1-876D-6382794DC625} - (no file)

WebBrowser-{3AD798D0-4642-4C55-BC14-CFE7DD19E0D1} - (no file)

WebBrowser-{D1FCE654-5FD1-48AD-B13C-5064736120B7} - (no file)

WebBrowser-{7B13EC3E-999A-4B70-B9CB-2617B8323822} - (no file)

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files (x86)\Windows Live\Family Safety\fsssvc.exe

c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE

c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe

c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

c:\program files (x86)\CyberLink\Shared files\RichVideo.exe

c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files (x86)\Hewlett-Packard\Media\Live TV\TVAgent.exe

c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

.

**************************************************************************

.

Voltooingstijd: 2011-06-28 19:44:12 - machine werd herstart

ComboFix-quarantined-files.txt 2011-06-28 17:44

ComboFix2.txt 2011-06-28 11:10

.

Pre-Run: 370.421.280.768 bytes beschikbaar

Post-Run: 370.867.777.536 bytes beschikbaar

.

- - End Of File - - D5F76116EEB13E6F102A8073D8683D10

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 22:23:15, on 28/06/2011

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v9.00 (9.00.8112.16421)

Boot mode: Normal

Running processes:

c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\TVAgent.exe

c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe

C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe

C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe

C:\Program Files (x86)\QuickTime\qttask.exe

C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe

C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Windows Live\Mail\wlmail.exe

C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

C:\Users\Eigenaar\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Aanmeldhulp voor Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Messenger Plus Live Belgium Toolbar - {d1a1c8f1-e3d9-48df-802f-20201061ef61} - C:\Program Files (x86)\Messenger_Plus_Live_Belgium\tbMess.dll

O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Messenger Plus Live Belgium Toolbar - {d1a1c8f1-e3d9-48df-802f-20201061ef61} - C:\Program Files (x86)\Messenger_Plus_Live_Belgium\tbMess.dll

O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll

O3 - Toolbar: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll

O4 - HKLM\..\Run: [Corel File Shell Monitor] C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe

O4 - HKLM\..\Run: [HPCam_Menu] "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam" UpdateWithCreateOnce "Software\Hewlett-Packard\Media\Webcam"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Free YouTube Download - C:\Users\Eigenaar\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Eigenaar\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/nl/uno1/GAME_UNO1.cab

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab

O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game.zylom.com/activex/zylomgamesplayer.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ismaili

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ismaili

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ismaili

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe

O23 - Service: AG Core Services (AGCoreService) - AG Interactive - C:\Program Files (x86)\AGI\core\4.2.0.10753\AGCoreService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HP Health Check Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\STacSV64.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 13689 bytes

Nu echt moeten zoeken hoe HJT op te slaan. Aanvaard aut toegewezen pad niet, maar moet gewoon documenten

kweezie wabbit · 29 juni 2011

Blader met de verkenner naar c:\program files (x86) en verwijder de map conduitEngine

Open een kladblokbestand.

Kopieer de onderstaande vetgedrukte tekst en en plak deze in het kladblok

RD /S /Q c:\users\Eigenaar\AppData\Local\{B52487C3-65BB-4A0D-BD05-FAD84C017871}

RD /S /Q c:\users\Eigenaar\AppData\Local\{F814101D-1356-4A1C-B680-6B6CAED48534}

RD /S /Q c:\users\Eigenaar\AppData\Local\{68CF0F54-7924-43AD-8494-0813EDC3DC0E}

RD /S /Q c:\users\Eigenaar\AppData\Local\{DE25DD5D-4B45-4D77-9493-7387871FB6A5}

RD /S /Q c:\users\Eigenaar\AppData\Local\{4D46885E-4A9B-4147-8116-648A2FFD1999}

RD /S /Q c:\users\Eigenaar\AppData\Local\{CB94869A-D736-4C56-BA81-D15C7DF44195}

RD /S /Q c:\users\Eigenaar\AppData\Local\{70C080E4-DAAA-4857-8F5A-4B693EECD0D4}

RD /S /Q c:\users\Eigenaar\AppData\Local\{9917CE4B-4910-4D22-8F58-8EAEC564C7CE}

RD /S /Q c:\users\Eigenaar\AppData\Local\{E0A66694-EF23-4FD7-908B-B9E785B4D890}

RD /S /Q c:\users\Eigenaar\AppData\Local\{5B0A638F-741C-47BD-8852-4668B8C07FA4}

RD /S /Q c:\users\Eigenaar\AppData\Local\{BCB00099-C6AE-4C2A-A4AA-05BEEDD1D3F2}

RD /S /Q c:\users\Eigenaar\AppData\Local\{BC485C62-5B90-4AF4-8022-A869F5BBA0D9}

RD /S /Q c:\users\Eigenaar\AppData\Local\{90A83CF9-6867-44D9-ADDD-ED69092EFF25}

RD /S /Q c:\users\Eigenaar\AppData\Local\{295024DE-282A-4397-A49E-8511D2CC3E84}

RD /S /Q c:\users\Eigenaar\AppData\Local\{242CC70E-AE49-43AA-9533-69C1A8B0CDD3}

RD /S /Q c:\users\Eigenaar\AppData\Local\{96525F85-8084-46D7-AFDD-63218454AFBD}

RD /S /Q c:\users\Eigenaar\AppData\Local\{C21C4CF0-A5AC-4F5C-B0D1-D3720D1816EA}

RD /S /Q c:\users\Eigenaar\AppData\Local\{DB6D856F-74CF-4C13-BCAF-A2E11EA51340}

RD /S /Q c:\users\Eigenaar\AppData\Local\{514555E4-EF1A-4825-A7BA-1C04F3F369E7}

RD /S /Q c:\users\Eigenaar\AppData\Local\{AA448307-6D7E-4537-8AAF-669985540453}

RD /S /Q c:\users\Eigenaar\AppData\Local\{4512965C-6F16-43E3-962F-E2EFE4613904}

RD /S /Q c:\users\Eigenaar\AppData\Local\{CFCB4094-B2A3-4930-B7FB-DE1AFAE4286C}

RD /S /Q c:\users\Eigenaar\AppData\Local\{3D5EE115-D78C-4B8F-B388-16DFC6BC213D}

RD /S /Q c:\users\Eigenaar\AppData\Local\{878106AD-0210-4036-B1D3-F1F99B927DEB}

RD /S /Q c:\users\Eigenaar\AppData\Local\{F20B115B-6EAE-4252-88B8-953A78EB94CB}

RD /S /Q c:\users\Eigenaar\AppData\Local\{83E662ED-690E-45B5-87A8-A22ADD58DCFD}

RD /S /Q c:\users\Eigenaar\AppData\Local\{535700F7-39E4-4A7A-A47D-A56255190172}

RD /S /Q c:\users\Eigenaar\AppData\Local\{3B14A23A-45FC-4D8C-9385-CBE5CE07C661}

RD /S /Q c:\users\Eigenaar\AppData\Local\{D393EE50-2B6A-45A3-8AD8-177382FE84D7}

RD /S /Q c:\users\Eigenaar\AppData\Local\{FC34AD28-525E-4E39-AFFD-63285F49CBAD}

RD /S /Q c:\users\Eigenaar\AppData\Local\{2177E62F-C202-44C4-88F7-FCCCA3F381F6}

RD /S /Q c:\users\Eigenaar\AppData\Local\{466ECE7F-7AC7-419F-AD31-9C4B1222CC4E}

RD /S /Q c:\users\Eigenaar\AppData\Local\{EB8E160A-D526-4EE7-9274-79C78C61BBB2}

RD /S /Q c:\users\Eigenaar\AppData\Local\{E837E523-918D-4A7D-A080-FEF289FC1F33}

RD /S /Q c:\users\Eigenaar\AppData\Local\{42F4808E-245E-43A5-BADB-D0054A4977B5}

RD /S /Q c:\users\Eigenaar\AppData\Local\{2EC24D65-12B9-4FA2-BA40-58E7D1121530}

RD /S /Q c:\users\Eigenaar\AppData\Local\{D3A4B2CF-4EFD-47E4-BE0F-3B03DBFDB686}

RD /S /Q c:\users\Eigenaar\AppData\Local\{839BED9D-1302-49FA-A26C-857A3D2485EC}

RD /S /Q c:\users\Eigenaar\AppData\Local\{2A88517A-4744-4687-93C7-90C759C34213}

RD /S /Q c:\users\Eigenaar\AppData\Local\{5DFB41B8-41FF-4DB6-BF46-D8682B065C74}

RD /S /Q c:\users\Eigenaar\AppData\Local\{221651DD-9948-474A-9364-CF312D23F0C0}

Sla dit bestand op je bureaublad op als Wissen.bat (kies bij bestandstype voor "alle bestanden")

Klik met de rechter muisknop op het bestand Wissen.bat en kies voor "uitvoeren als administrator".

Je zal even een zwart venster zien dat snel weer verdwijnt.

Als dit venster weer verdwenen is, mag je combofix nog eens uitvoeren en het logje plaatsen.

pandora6040 · 29 juni 2011

Hallo

Heb de map Conduit

Is dit hetzelfde als coduitEngine

kweezie wabbit · 29 juni 2011

Ja, dat is dezelfde.

Die malware gebruikt soms verschillende namen om de scanners op een dwaalspoor te brengen.

pandora6040 · 29 juni 2011

Terug vermelding dat pev.cfxxe ontbreekt en dan hersteld alles zich in de vorige toestand zeker?

ComboFix 11-06-27.04 - Eigenaar 29/06/2011 14:42:24.14.4 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.32.1043.18.4023.2505 [GMT 2:00]

Gestart vanuit: c:\users\Eigenaar\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-05-28 to 2011-06-29 ))))))))))))))))))))))))))))))

.

2011-06-29 12:49 . 2011-06-29 12:49 -------- d-----w- c:\users\Gast\AppData\Local\temp

2011-06-29 12:49 . 2011-06-29 12:49 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-06-29 11:35 . 2011-06-29 11:35 -------- d-----w- c:\users\Eigenaar\AppData\Local\{E0185CB9-455B-40AC-A4D5-19092E21B2ED}

2011-06-28 19:40 . 2011-06-28 19:40 388096 ----a-r- c:\users\Eigenaar\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-06-28 19:40 . 2011-06-28 19:40 -------- d-----w- c:\program files (x86)\Trend Micro

2011-06-28 19:24 . 2011-06-28 19:24 -------- d-----w- c:\users\Eigenaar\AppData\Local\{18400348-44C9-43DE-96EC-575FEEAEB638}

2011-06-25 16:50 . 2011-06-25 16:50 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared

2011-06-23 10:01 . 2011-06-23 10:01 -------- d-----w- c:\program files (x86)\Common Files\Java

2011-06-20 20:02 . 2011-06-22 13:49 -------- d-----w- C:\backups

2011-06-20 18:34 . 2011-06-20 16:08 388608 ----a-w- C:\HijackThis.exe

2011-06-20 15:18 . 2011-06-28 20:32 -------- d-----w- c:\program files\CCleaner