Conhost.exe 2

[signer]

Heb ongeveer hetzelfde probleem denk ik.

Bij AVS komt er elke keer een warning over conhost.exe in temp files,wanneer ik deze zoek vind ik deze niet teug.

Heb voor de eerste maal hijack gedownload en hier eveneens bijgevoegd.

Weet niet of ik het juist heb gedaan of er teveel heb opgezet.A

lvast bedankt voor nuttige info.Mo

est ik het posten op een andere topic laat het me eveneens weten.

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 13:34:07, on 28/08/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\Program Files\AVG\AVG8\avgrsx.exe

C:\windows\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\windows\system32\CTsvcCDA.exe

C:\windows\system32\svchost.exe

C:\Program Files\Google\Update\1.3.21.65\GoogleCrashHandler.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\windows\System32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Belgium Identity Card\beid35gui.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Labtec\Desktop\V5.1\moffice.exe

C:\Program Files\Labtec\Desktop\V5.1\kbdap32a.exe

C:\Program Files\Labtec\Desktop\V5.1\MOUSE32A.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\windows\RTHDCPL.EXE

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\windows\system32\ctfmon.exe

C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files\PC-Doctor for Windows\pcdr5cuiw32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\windows\system32\taskmgr.exe

C:\Program Files\SpyNoMore\SNM.exe

C:\windows\explorer.exe

C:\Program Files\Mozilla Thunderbird 3 Beta 2\thunderbird.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://decopains.be/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=iron&s={searchTerms}&f=4

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

R3 - URLSearchHook: (no name) - *{3ad798d0-4642-4c55-bc14-cfe7dd19e0d1} - (no file)

R3 - URLSearchHook: Softonic Netherlands Toolbar - {65ca59ee-9920-4d7f-8c41-bfa12403261a} - C:\Program Files\Softonic_Netherlands\prxtbSoft.dll

R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll

O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (file missing)

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Softonic Netherlands - {65ca59ee-9920-4d7f-8c41-bfa12403261a} - C:\Program Files\Softonic_Netherlands\prxtbSoft.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (file missing)

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

O3 - Toolbar: Softonic Netherlands Toolbar - {65ca59ee-9920-4d7f-8c41-bfa12403261a} - C:\Program Files\Softonic_Netherlands\prxtbSoft.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [updateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"

O4 - HKLM\..\Run: [beid] "C:\Program Files\Belgium Identity Card\beid35gui.exe" /startup

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Labtec\Desktop\V5.1\moffice.exe

O4 - HKLM\..\Run: [OFFICEKB] C:\Program Files\Labtec\Desktop\V5.1\kbdap32a.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.1\apdproxy.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\windows\system32\NeroCheck.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

O4 - HKLM\..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [sNM] C:\Program Files\SpyNoMore\SNM.exe /startup

O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [8DDYX0ZBPZ] C:\windows\TEMP\Lmx.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [89DGCM7LPJ] C:\windows\TEMP\Lmw.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll

O9 - Extra 'Tools' menuitem: &Instellingen voor Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll

O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\windows\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\windows\system32\browseui.dll

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe (file missing)

O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG8\Toolbar\ToolbarBroker.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\windows\system32\CTsvcCDA.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.17\bin\httpd.exe

O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.5.8\bin\mysqld.exe

O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.17\bin\httpd.exe

O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.5.8\bin\mysqld.exe

--

End of file - 12997 bytes

[Jean-Pierre]

Ik heb je een eigen topic aangemaakt dit om het overzichtelijk te houden.;-)

Afgesplitst van DIT topic.

[Asus]

Ik verwittig de malware-experts, wordt vervolgd zodra ze online komen... ;-)

[signer]

Alvast bedankt

[kape]

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc stop ASKUpgrade

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc delete ASKUpgrade

Druk op Enter.

Start Hijackthis op. Selecteer “Scan”. Selecteer alleen de items die hieronder zijn genoemd:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=iron&s={searchTerms}&f=4

R3 - URLSearchHook: (no name) - *{3ad798d0-4642-4c55-bc14-cfe7dd19e0d1} - (no file)

R3 - URLSearchHook: Softonic Netherlands Toolbar - {65ca59ee-9920-4d7f-8c41-bfa12403261a} - C:\Program Files\Softonic_Netherlands\prxtbSoft.dll

R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (file missing)

O2 - BHO: Softonic Netherlands - {65ca59ee-9920-4d7f-8c41-bfa12403261a} - C:\Program Files\Softonic_Netherlands\prxtbSoft.dll

O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (file missing)

O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

O3 - Toolbar: Softonic Netherlands Toolbar - {65ca59ee-9920-4d7f-8c41-bfa12403261a} - C:\Program Files\Softonic_Netherlands\prxtbSoft.dll

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKUS\S-1-5-18\..\Run: [8DDYX0ZBPZ] C:\windows\TEMP\Lmx.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [89DGCM7LPJ] C:\windows\TEMP\Lmw.exe (User 'SYSTEM')

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

Klik op 'Fix checked' om de items te verwijderen.

Verwijder Ask Toolbar of AskBarDis bij Software (indien aanwezig) of verwijder anders volgende vetgedrukte map : C:\Program Files\AskBarDis

Download MBAM (Malwarebytes Anti-Malware)

Dubbelklik op mbam-setup.exe om het programma te installeren.

Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Start Malwarebytes' Anti-Malware, Klik daarna op "Voltooien".

Indien een update gevonden werd, zal die gedownload en geïnstalleerd worden.

Wanneer het programma volledig up to date is, selecteer dan in het tabblad Scanner : "Snelle Scan", daarna klik op Scan.

Het scannen kan een tijdje duren, dus wees geduldig.

Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.

Zorg ervoor dat daar alles aangevinkt is, daarna klik op: Verwijder geselecteerde.

Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie verder).

Indien er de rootkit (TDSS) aanwezig is, zal MBAM vragen te herstarten. Doe dit dan ook.

MBAM zal na de herstart opnieuw scannen en de rootkit verwijderen.

Het log wordt automatisch bewaard door MBAM en kan je terugvinden door op de "Logs" tab te klikken in het programma.

Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken. Daarna zal het vragen om de computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.

Plak de inhoud van het logje in je volgende bericht, samen met een nieuw HijackThis log.

[signer]

Hallo,

Sry vr de late reactie doch werken..

Heb dus alles zoals gevraagd afgehandeld en moet heel stillll:adore:melden dat AVS ondertussen niks meer gemeld heeft over conhost.exe.

Is het weg,ik weet het niet.

Hieronder de logbestandjes van beide.

Grtz & thx

Malwarebytes' Anti-Malware 1.51.1.1800

Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Databaseversie: 7606

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

29/08/2011 21:33:43

mbam-log-2011-08-29 (21-33-43).txt

Scantype: Snelle scan

Objecten gescand: 181350

Verstreken tijd: 9 minuut/minuten, 17 seconde(n)

Geheugenprocessen geïnfecteerd: 0

Geheugenmodulen geïnfecteerd: 0

Registersleutels geïnfecteerd: 0

Registerwaarden geïnfecteerd: 0

Registerdata geïnfecteerd: 0

Mappen geïnfecteerd: 0

Bestanden geïnfecteerd: 0

Geheugenprocessen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registersleutels geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Registerdata geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Bestanden geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 21:39:31, on 29/08/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\windows\system32\CTsvcCDA.exe

C:\windows\system32\svchost.exe

C:\Program Files\Google\Update\1.3.21.65\GoogleCrashHandler.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\windows\System32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\svchost.exe

C:\windows\Explorer.EXE

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Belgium Identity Card\beid35gui.exe

C:\Program Files\Labtec\Desktop\V5.1\moffice.exe

C:\Program Files\Labtec\Desktop\V5.1\kbdap32a.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\windows\RTHDCPL.EXE

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\SpyNoMore\SNM.exe

C:\windows\system32\ctfmon.exe

C:\Program Files\Labtec\Desktop\V5.1\MOUSE32A.EXE

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Thunderbird 3 Beta 2\thunderbird.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\windows\TEMP\conhost.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\windows\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://decopains.be/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [updateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"

O4 - HKLM\..\Run: [beid] "C:\Program Files\Belgium Identity Card\beid35gui.exe" /startup

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Labtec\Desktop\V5.1\moffice.exe

O4 - HKLM\..\Run: [OFFICEKB] C:\Program Files\Labtec\Desktop\V5.1\kbdap32a.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.1\apdproxy.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\windows\system32\NeroCheck.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

O4 - HKLM\..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [sNM] C:\Program Files\SpyNoMore\SNM.exe /startup

O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll

O9 - Extra 'Tools' menuitem: &Instellingen voor Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll

O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\windows\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\windows\system32\browseui.dll

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG8\Toolbar\ToolbarBroker.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\windows\system32\CTsvcCDA.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.17\bin\httpd.exe

O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.5.8\bin\mysqld.exe

--

End of file - 10776 bytes

[kape]

Dit klinkt goed, maar doe nog even dit (voor de zekerheid) :

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:

Klik hier

Als het je niet lukt om ze uit te schakelen, ga dan gewoon door naar de volgende stap.

2. Dubbelklik op ComboFix.exe en volg de meldingen op het scherm.

3. ComboFix zal controleren of dat de Microsoft Windows Recovery Console reeds is geïnstalleerd.

**Let op: Als de Microsoft Windows Recovery Console al is geïnstalleerd, dan krijg je de volgende schermen niet te zien en zal ComboFix automatisch verder gaan met het scannen naar malware.

4. Volg de meldingen op het scherm om ComboFix de Microsoft Windows Recovery Console te laten downloaden en installeren.

Je krijgt de volgende melding te zien wanneer ComboFix de Microsoft Windows Recovery Console succesvol heeft geïnstalleerd:

Klik op Ja om verder te gaan met het scannen naar malware.

5. Wanneer ComboFix klaar is, zal het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

[signer]

Onder het logbestand van ComboFix.

Vroeger avondonderwijs webdesign gevolgd,zal er eens eentje moeten volgen PC probs solver

Thx iedereen voor het vlug oplossen voor mijn conhost.exe probleem (hopelijk zie ik dit nooit meer terug)

Zonder jullie was het niet gelukt en de helft wat ik gedaan heb is latijn for me.

Bedankt

ComboFix 11-08-29.03 - HP_Administrator 29/08/2011 22:35:55.1.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.1015.140 [GMT 2:00]

Gestart vanuit: c:\documents and settings\HP_Administrator\Bureaublad\ComboFix.exe

AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Norton Internet Security *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

.

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\Gast\Application Data\facemoods.com

c:\documents and settings\HP_Administrator\Application Data\facemoods.com

c:\documents and settings\HP_Administrator\Application Data\PriceGong

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\1.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\a.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\b.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\c.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\d.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\e.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\f.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\g.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\h.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\i.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\J.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\k.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\l.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\m.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\n.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\o.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\p.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\q.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\r.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\s.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\t.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\u.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\v.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\w.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\x.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\y.xml

c:\documents and settings\HP_Administrator\Application Data\PriceGong\Data\z.xml

c:\documents and settings\HP_Administrator\System

c:\documents and settings\HP_Administrator\System\win_qs8.jqx

c:\documents and settings\HP_Administrator\WINDOWS

c:\documents and settings\NetworkService\Application Data\facemoods.com

c:\documents and settings\NetworkService\Application Data\PriceGong

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\1.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\a.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\b.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\c.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\d.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\e.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\f.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\g.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\h.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\i.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\j.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\k.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\l.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\m.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\n.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\o.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\p.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\q.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\r.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\s.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\t.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\u.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\v.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\w.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\wlu.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\x.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\y.txt

c:\documents and settings\NetworkService\Application Data\PriceGong\Data\z.txt

c:\program files\AA Antimalware

c:\program files\AA Antimalware\AdwareAway_Scan_Result_20110827_130910.log

c:\program files\AA Antimalware\debug.log

c:\program files\AA Antimalware\LastScanResult.log

c:\windows\system32\config\systemprofile\Application Data\facemoods.com

c:\windows\system32\config\systemprofile\Application Data\PriceGong

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\1.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\a.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\b.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\c.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\d.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\e.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\f.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\g.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\h.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\i.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\j.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\k.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\l.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\m.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\n.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\o.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\p.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\q.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\r.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\s.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\t.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\u.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\v.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\w.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\wlu.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\x.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\y.txt

c:\windows\system32\config\systemprofile\Application Data\PriceGong\Data\z.txt

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_DIAGNOSTICSCAN

-------\Legacy_SSHNAS

-------\Legacy_START1DRIVER

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-07-28 to 2011-08-30 ))))))))))))))))))))))))))))))

.

.

2011-08-29 20:24 . 2011-08-29 20:24 -------- d-----w- C:\$AVG8.VAULT$

2011-08-29 18:52 . 2011-08-29 18:52 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Malwarebytes

2011-08-29 18:52 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-08-29 18:52 . 2011-08-29 18:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-08-29 18:52 . 2011-08-29 18:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-08-29 18:52 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-28 20:12 . 2011-08-29 18:49 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Sammsoft

2011-08-28 11:29 . 2011-08-28 11:29 388096 ----a-r- c:\documents and settings\HP_Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-08-28 11:29 . 2011-08-28 11:29 -------- d-----w- c:\program files\Trend Micro

2011-08-28 10:43 . 2011-08-28 10:43 1152 ----a-w- c:\windows\system32\windrv.sys

2011-08-28 10:43 . 2011-08-28 11:58 -------- d-----w- c:\program files\SpyNoMore

2011-08-28 10:35 . 2011-08-28 10:42 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\GetRightToGo

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-08-27 06:19 . 2011-06-03 05:04 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-07-15 13:29 . 2009-01-12 06:27 456320 ------w- c:\windows\system32\drivers\mrxsmb.sys

2011-07-08 14:02 . 2009-01-12 06:27 10496 ------w- c:\windows\system32\drivers\ndistapi.sys

2011-06-28 17:37 . 2011-02-15 16:54 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2011-06-28 17:37 . 2011-02-15 16:54 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys

2011-06-24 14:10 . 2009-01-21 06:39 139656 ------w- c:\windows\system32\drivers\rdpwd.sys

2011-06-23 18:31 . 2009-01-12 06:27 916480 ----a-w- c:\windows\system32\wininet.dll

2011-06-23 18:31 . 2009-01-12 06:27 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-06-23 18:31 . 2009-01-12 06:27 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-06-23 12:05 . 2009-01-12 06:27 385024 ----a-w- c:\windows\system32\html.iec

2011-06-20 17:44 . 2009-01-12 06:27 293888 ----a-w- c:\windows\system32\winsrv.dll

2011-06-06 11:35 . 2009-01-12 06:27 1859072 ----a-w- c:\windows\system32\win32k.sys

2011-08-27 09:20 . 2011-07-17 14:30 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2011-03-18 06:11 2471240 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-10-26 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-10-26 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-10-26 137752]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]

"beid"="c:\program files\Belgium Identity Card\beid35gui.exe" [2009-06-04 2056192]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]

"FLMOFFICE4DMOUSE"="c:\program files\Labtec\Desktop\V5.1\moffice.exe" [2009-06-30 958464]

"OFFICEKB"="c:\program files\Labtec\Desktop\V5.1\kbdap32a.exe" [2009-06-30 387584]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-12-11 286720]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-17 2048352]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]

"RTHDCPL"="RTHDCPL.EXE" [2008-10-26 17021440]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-01-12 49208]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]

"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]

"SNM"="c:\program files\SpyNoMore\SNM.exe" [2010-07-12 1067984]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

.

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-10-12 110592]

HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2008-6-5 479232]

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqcopy2.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqsudi.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqpsapp.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqpse.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqgplgtupl.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqgpc01.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqusgm.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqusgh.exe"=

"c:\\Program Files\\Hp\\HP Software Update\\hpwucli.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\Smart Web Printing\\SmartWebPrintExe.exe"=

"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=

"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=

"c:\\wamp\\bin\\apache\\Apache2.2.17\\bin\\httpd.exe"=

"c:\\Program Files\\GIMPshop\\lib\\gimp\\2.0\\plug-ins\\script-fu.exe"=

.

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [13/09/2009 8:25 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [13/09/2009 8:25 108552]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [15/02/2011 18:54 136360]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [13/09/2009 8:25 297752]

R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [20/01/2009 8:56 712704]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [20/01/2011 14:44 136176]

S3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\drivers\a38usb.sys [24/03/2006 19:14 33536]

S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG8\Toolbar\ToolbarBroker.exe [5/11/2010 10:48 947528]

S3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [20/01/2011 14:44 136176]

S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19/02/2010 13:37 517096]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Inhoud van de 'Gedeelde Taken' map

.

2011-06-25 c:\windows\Tasks\AdobeAAMUpdater-1.0-UW-3223ECC21047-HP_Administrator.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-06-25 15:42]

.

2011-08-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-20 12:44]

.

2011-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-20 12:44]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://decopains.be/

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

Trusted Zone: taxonweb.be

TCP: DhcpNameServer = 192.168.1.1 192.168.123.254

Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\6pac91jj.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=

FF - prefs.js: browser.search.selectedEngine - SweetIM Search

FF - prefs.js: browser.startup.homepage - hxxp://www.google.be/

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2603445&q=

.

- - - - ORPHANS VERWIJDERD - - - -

.

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

WebBrowser-{65CA59EE-9920-4D7F-8C41-BFA12403261A} - (no file)

HKCU-Run-Polar Sync - (no file)

HKLM-Run-Adobe Photo Downloader - c:\program files\Adobe\Adobe Photoshop Lightroom 1.1\apdproxy.exe

AddRemove-CrossTrak - c:\program files\H&M Riley Consulting

AddRemove-FoxTab PDF Converter - c:\program files\FoxTabPDFConverter\\ftpdf_inst.exe

AddRemove-Hard Disk Low Level Format Tool_is1 - c:\program files\HDDGURU LLF Tool\unins000.exe

AddRemove-HP Solution Center & Imaging Support Tools - c:\program files\HP\Digital Imaging\eSupport\hpzscr01.exe

AddRemove-SpyNoMore - c:\program files\SpyNoMore\uninst.exe

AddRemove-Van Welden & Partners Profielstaal_is1 - c:\program files\Van Welden & Partners Profielstaal\unins000.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-08-30 07:58

Windows 5.1.2600 Service Pack 3 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Polar Sync = ?:\program files\polar\polar sync\?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,22,02,91,99,7c,1d,9c,47,8e,16,97,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,22,02,91,99,7c,1d,9c,47,8e,16,97,\

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'explorer.exe'(3936)

c:\program files\SmartFTP Client\en-US\sfShellTools.dll.mui

c:\program files\Labtec\Desktop\V5.1\MOUDL32A.DLL

c:\windows\system32\webcheck.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\windows\System32\SCardSvr.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\windows\system32\CTsvcCDA.exe

c:\program files\Google\Update\1.3.21.65\GoogleCrashHandler.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\windows\TEMP\conhost.exe

c:\windows\system32\igfxsrvc.exe

c:\program files\Labtec\Desktop\V5.1\MOUSE32A.EXE

c:\windows\RTHDCPL.EXE

c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe

c:\program files\HP\Digital Imaging\bin\hpqbam08.exe

c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe

c:\program files\Common Files\Java\Java Update\jucheck.exe

.

**************************************************************************

.

Voltooingstijd: 2011-08-30 08:07:31 - machine werd herstart

ComboFix-quarantined-files.txt 2011-08-30 06:07

.

Pre-Run: 42.814.668.800 bytes beschikbaar

Post-Run: 44.321.755.136 bytes beschikbaar

.

- - End Of File - - 50C78F603FD3250B625866D7D5D62C0B

[kape]

Je bent er nog niet helemaal !

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Firefox::

FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\6pac91jj.default\

FF - prefs.js: browser.search.defaulturl –

FF - prefs.js: browser.search.selectedEngine –

FF - prefs.js: keyword.URL –

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Download TDSSKiller en plaats het op je bureaublad.

Pak de bestanden in tdsskiller.zip uit.

Open de map tdsskiller en dubbelklik op TDSSKiller.exe om de tool te starten.

Windows 7 en Windows Vista gebruikers:

Rechtsklik op TDSSKiller.exe -> Uitvoeren als Administrator om de tool te starten.

Als TDSSKiller bericht geeft van een beschikbare update, dan voer je deze eerst uit.

Klik op de knop "Start Scan" en volg de instructies.

Wanneer de scan klaar is klik je op de knop "Report".

Er opent een kladblokbestand. Post de inhoud van dit bestand.

Herstart de pc als TDSSKiller die optie geeft. (Reboot now)

Wanneer er een herstart nodig was, vind je de logfile in C:\TDSSKiller.[Version]_[Date]_[Time]_log.txt

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met logje van TDSS.

[signer]

Srry,was al weer eens veel te vlug:embarassed:

Hieronder de logjes.

2011/08/30 14:28:59.0765 2284 TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57

2011/08/30 14:28:59.0953 2284 ================================================================================

2011/08/30 14:28:59.0953 2284 SystemInfo:

2011/08/30 14:28:59.0953 2284

2011/08/30 14:28:59.0953 2284 OS Version: 5.1.2600 ServicePack: 3.0

2011/08/30 14:28:59.0953 2284 Product type: Workstation

2011/08/30 14:28:59.0953 2284 ComputerName: UW-3223ECC21047

2011/08/30 14:28:59.0953 2284 UserName: HP_Administrator

2011/08/30 14:28:59.0953 2284 Windows directory: C:\windows

2011/08/30 14:28:59.0953 2284 System windows directory: C:\windows

2011/08/30 14:28:59.0953 2284 Processor architecture: Intel x86

2011/08/30 14:28:59.0953 2284 Number of processors: 2

2011/08/30 14:28:59.0953 2284 Page size: 0x1000

2011/08/30 14:28:59.0953 2284 Boot type: Normal boot

2011/08/30 14:28:59.0953 2284 ================================================================================

2011/08/30 14:29:01.0265 2284 Initialize success

2011/08/30 14:29:03.0765 2320 ================================================================================

2011/08/30 14:29:03.0765 2320 Scan started

2011/08/30 14:29:03.0765 2320 Mode: Manual;

2011/08/30 14:29:03.0765 2320 ================================================================================

2011/08/30 14:29:04.0906 2320 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\windows\system32\drivers\abp480n5.sys

2011/08/30 14:29:04.0953 2320 ACPI (02273a448ba21a7d447daeb47810d40c) C:\windows\system32\DRIVERS\ACPI.sys

2011/08/30 14:29:05.0046 2320 ACPIEC (63f517b1a87dabf3f5acb8a7952fc1d1) C:\windows\system32\drivers\ACPIEC.sys

2011/08/30 14:29:05.0109 2320 ACSSCR (b6a0f723a54884e77fce0f69083f90c9) C:\windows\system32\DRIVERS\a38usb.sys

2011/08/30 14:29:05.0187 2320 adpu160m (9a11864873da202c996558b2106b0bbc) C:\windows\system32\drivers\adpu160m.sys

2011/08/30 14:29:05.0296 2320 aec (8bed39e3c35d6a489438b8141717a557) C:\windows\system32\drivers\aec.sys

2011/08/30 14:29:05.0375 2320 AFD (355556d9e580915118cd7ef736653a89) C:\windows\System32\drivers\afd.sys

2011/08/30 14:29:05.0484 2320 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\windows\system32\drivers\Aha154x.sys

2011/08/30 14:29:05.0531 2320 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\windows\system32\drivers\aic78u2.sys

2011/08/30 14:29:05.0546 2320 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\windows\system32\drivers\aic78xx.sys

2011/08/30 14:29:05.0609 2320 AliIde (1140ab9938809700b46bb88e46d72a96) C:\windows\system32\drivers\AliIde.sys

2011/08/30 14:29:05.0656 2320 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\windows\system32\drivers\amsint.sys

2011/08/30 14:29:05.0718 2320 asc (62d318e9a0c8fc9b780008e724283707) C:\windows\system32\drivers\asc.sys

2011/08/30 14:29:05.0734 2320 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\windows\system32\drivers\asc3350p.sys

2011/08/30 14:29:05.0781 2320 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\windows\system32\drivers\asc3550.sys

2011/08/30 14:29:05.0859 2320 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\windows\system32\DRIVERS\asyncmac.sys

2011/08/30 14:29:05.0906 2320 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\windows\system32\DRIVERS\atapi.sys

2011/08/30 14:29:05.0968 2320 Atmarpc (9916c1225104ba14794209cfa8012159) C:\windows\system32\DRIVERS\atmarpc.sys

2011/08/30 14:29:06.0015 2320 audstub (d9f724aa26c010a217c97606b160ed68) C:\windows\system32\DRIVERS\audstub.sys

2011/08/30 14:29:06.0093 2320 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys

2011/08/30 14:29:06.0171 2320 AvgLdx86 (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\windows\System32\Drivers\avgldx86.sys

2011/08/30 14:29:06.0234 2320 AvgMfx86 (5903d729d4f0c5bca74123c96a1b29e0) C:\windows\System32\Drivers\avgmfx86.sys

2011/08/30 14:29:06.0265 2320 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\windows\system32\DRIVERS\avgntflt.sys

2011/08/30 14:29:06.0296 2320 AvgTdiX (92d8e1e8502e649b60e70074eb29c380) C:\windows\System32\Drivers\avgtdix.sys

2011/08/30 14:29:06.0359 2320 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\windows\system32\DRIVERS\avipbb.sys

2011/08/30 14:29:06.0406 2320 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\windows\system32\drivers\Beep.sys

2011/08/30 14:29:06.0671 2320 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\windows\system32\drivers\cbidf2k.sys

2011/08/30 14:29:06.0703 2320 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\windows\system32\drivers\cd20xrnt.sys

2011/08/30 14:29:06.0750 2320 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\windows\system32\drivers\Cdaudio.sys

2011/08/30 14:29:06.0781 2320 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\windows\system32\drivers\Cdfs.sys

2011/08/30 14:29:06.0843 2320 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\windows\system32\DRIVERS\cdrom.sys

2011/08/30 14:29:06.0890 2320 Changer (2a5815ca6fff24b688c01f828b96819c) C:\windows\system32\drivers\Changer.sys

2011/08/30 14:29:06.0968 2320 CmdIde (026ba1f2d9c9f742ec3823d0214cd67c) C:\windows\system32\drivers\CmdIde.sys

2011/08/30 14:29:07.0046 2320 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\windows\system32\drivers\Cpqarray.sys

2011/08/30 14:29:07.0109 2320 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\windows\system32\drivers\dac2w2k.sys

2011/08/30 14:29:07.0156 2320 dac960nt (683789caa3864eb46125ae86ff677d34) C:\windows\system32\drivers\dac960nt.sys

2011/08/30 14:29:07.0234 2320 Disk (044452051f3e02e7963599fc8f4f3e25) C:\windows\system32\DRIVERS\disk.sys

2011/08/30 14:29:07.0296 2320 dmboot (dec123e0c75971d0cc7a6c6a75e28429) C:\windows\system32\drivers\dmboot.sys

2011/08/30 14:29:07.0375 2320 dmio (7268e66259722f6228c730685b201092) C:\windows\system32\drivers\dmio.sys

2011/08/30 14:29:07.0406 2320 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\windows\system32\drivers\dmload.sys

2011/08/30 14:29:07.0468 2320 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\windows\system32\drivers\DMusic.sys

2011/08/30 14:29:07.0531 2320 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\windows\system32\drivers\dpti2o.sys

2011/08/30 14:29:07.0578 2320 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\windows\system32\drivers\drmkaud.sys

2011/08/30 14:29:07.0718 2320 Fastfat (38d332a6d56af32635675f132548343e) C:\windows\system32\drivers\Fastfat.sys

2011/08/30 14:29:07.0781 2320 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\windows\system32\drivers\Fdc.sys

2011/08/30 14:29:07.0812 2320 Fips (8bfffb5ac954e19dfdb96d56512aa518) C:\windows\system32\drivers\Fips.sys

2011/08/30 14:29:07.0859 2320 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\windows\system32\drivers\Flpydisk.sys

2011/08/30 14:29:07.0906 2320 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\windows\system32\DRIVERS\fltMgr.sys

2011/08/30 14:29:07.0968 2320 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\windows\system32\drivers\Fs_Rec.sys

2011/08/30 14:29:08.0015 2320 Ftdisk (fa8ca22e70245c81ff29c36af56292fc) C:\windows\system32\DRIVERS\ftdisk.sys

2011/08/30 14:29:08.0062 2320 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\windows\system32\DRIVERS\msgpc.sys

2011/08/30 14:29:08.0156 2320 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\windows\system32\DRIVERS\HDAudBus.sys

2011/08/30 14:29:08.0281 2320 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\windows\system32\DRIVERS\hidusb.sys

2011/08/30 14:29:08.0328 2320 hpn (b028377dea0546a5fcfba928a8aefae0) C:\windows\system32\drivers\hpn.sys

2011/08/30 14:29:08.0390 2320 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\windows\system32\DRIVERS\HPZid412.sys

2011/08/30 14:29:08.0421 2320 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\windows\system32\DRIVERS\HPZipr12.sys

2011/08/30 14:29:08.0484 2320 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\windows\system32\DRIVERS\HPZius12.sys

2011/08/30 14:29:08.0531 2320 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\windows\system32\Drivers\HTTP.sys

2011/08/30 14:29:08.0593 2320 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\windows\system32\drivers\i2omgmt.sys

2011/08/30 14:29:08.0640 2320 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\windows\system32\drivers\i2omp.sys

2011/08/30 14:29:08.0687 2320 i8042prt (c43372d0682f8e32e4ec21117e089ec0) C:\windows\system32\DRIVERS\i8042prt.sys

2011/08/30 14:29:08.0921 2320 ialm (48846b31be5a4fa662ccfde7a1ba86b9) C:\windows\system32\DRIVERS\igxpmp32.sys

2011/08/30 14:29:09.0171 2320 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\windows\system32\DRIVERS\imapi.sys

2011/08/30 14:29:09.0234 2320 ini910u (4a40e045faee58631fd8d91afc620719) C:\windows\system32\drivers\ini910u.sys

2011/08/30 14:29:09.0406 2320 IntcAzAudAddService (bd4d6e6f708aa8503653e2be9d53459b) C:\windows\system32\drivers\RtkHDAud.sys

2011/08/30 14:29:09.0562 2320 IntelIde (72c63ad984d427d34bd5b9db838d88eb) C:\windows\system32\drivers\IntelIde.sys

2011/08/30 14:29:09.0593 2320 intelppm (2d2254fac267e6b1c7865e8ebef60c6d) C:\windows\system32\DRIVERS\intelppm.sys

2011/08/30 14:29:09.0625 2320 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\windows\system32\DRIVERS\Ip6Fw.sys

2011/08/30 14:29:09.0656 2320 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\windows\system32\DRIVERS\ipfltdrv.sys

2011/08/30 14:29:09.0687 2320 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\windows\system32\DRIVERS\ipinip.sys

2011/08/30 14:29:09.0750 2320 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\windows\system32\DRIVERS\ipnat.sys

2011/08/30 14:29:09.0812 2320 IPSec (23c74d75e36e7158768dd63d92789a91) C:\windows\system32\DRIVERS\ipsec.sys

2011/08/30 14:29:09.0937 2320 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\windows\system32\DRIVERS\irenum.sys

2011/08/30 14:29:10.0000 2320 isapnp (0b78e1a31340e1fb1e389d5633f7c3a0) C:\windows\system32\DRIVERS\isapnp.sys

2011/08/30 14:29:10.0062 2320 Jukebox3 (6c24d3878f44c271d94ea6cab1acd739) C:\windows\system32\DRIVERS\ctpdusb.sys

2011/08/30 14:29:10.0125 2320 Kbdclass (380397621e94b32c744e7b2cc1330390) C:\windows\system32\DRIVERS\kbdclass.sys

2011/08/30 14:29:10.0187 2320 kbdhid (b833b70fe639f01fb36cedabe57ef031) C:\windows\system32\DRIVERS\kbdhid.sys

2011/08/30 14:29:10.0421 2320 kmixer (692bcf44383d056aed41b045a323d378) C:\windows\system32\drivers\kmixer.sys

2011/08/30 14:29:10.0609 2320 KSecDD (b467646c54cc746128904e1654c750c1) C:\windows\system32\drivers\KSecDD.sys

2011/08/30 14:29:10.0687 2320 lbrtfdc (406598827a1b5f77954de11dde115ced) C:\windows\system32\drivers\lbrtfdc.sys

2011/08/30 14:29:10.0781 2320 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\windows\system32\drivers\mnmdd.sys

2011/08/30 14:29:10.0828 2320 Modem (8114eeac353f549331ab73e9af4219ed) C:\windows\system32\drivers\Modem.sys

2011/08/30 14:29:10.0890 2320 Mouclass (1a4e2214dd63e4a876463d3427ee8261) C:\windows\system32\DRIVERS\mouclass.sys

2011/08/30 14:29:10.0937 2320 mouhid (18017899254e01371e1a39754d6bf98c) C:\windows\system32\DRIVERS\mouhid.sys

2011/08/30 14:29:10.0968 2320 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\windows\system32\drivers\MountMgr.sys

2011/08/30 14:29:11.0093 2320 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\windows\system32\drivers\mraid35x.sys

2011/08/30 14:29:11.0140 2320 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\windows\system32\DRIVERS\mrxdav.sys

2011/08/30 14:29:11.0203 2320 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\windows\system32\DRIVERS\mrxsmb.sys

2011/08/30 14:29:11.0296 2320 Msfs (c941ea2454ba8350021d774daf0f1027) C:\windows\system32\drivers\Msfs.sys

2011/08/30 14:29:11.0343 2320 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\windows\system32\drivers\MSKSSRV.sys

2011/08/30 14:29:11.0390 2320 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\windows\system32\drivers\MSPCLOCK.sys

2011/08/30 14:29:11.0421 2320 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\windows\system32\drivers\MSPQM.sys

2011/08/30 14:29:11.0484 2320 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\windows\system32\DRIVERS\mssmbios.sys

2011/08/30 14:29:11.0531 2320 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\windows\system32\drivers\Mup.sys

2011/08/30 14:29:11.0609 2320 NDIS (1df7f42665c94b825322fae71721130d) C:\windows\system32\drivers\NDIS.sys

2011/08/30 14:29:11.0656 2320 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\windows\system32\DRIVERS\ndistapi.sys

2011/08/30 14:29:11.0703 2320 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\windows\system32\DRIVERS\ndisuio.sys

2011/08/30 14:29:11.0750 2320 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\windows\system32\DRIVERS\ndiswan.sys

2011/08/30 14:29:11.0781 2320 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\windows\system32\drivers\NDProxy.sys

2011/08/30 14:29:11.0828 2320 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\windows\system32\DRIVERS\netbios.sys

2011/08/30 14:29:11.0890 2320 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\windows\system32\DRIVERS\netbt.sys

2011/08/30 14:29:12.0000 2320 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\windows\system32\drivers\Npfs.sys

2011/08/30 14:29:12.0078 2320 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\windows\system32\drivers\Ntfs.sys

2011/08/30 14:29:12.0203 2320 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\windows\system32\drivers\Null.sys

2011/08/30 14:29:12.0265 2320 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\windows\system32\DRIVERS\nwlnkflt.sys

2011/08/30 14:29:12.0281 2320 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\windows\system32\DRIVERS\nwlnkfwd.sys

2011/08/30 14:29:12.0343 2320 Parport (e3934ccc20a4d24f1924e13d36d2a5bd) C:\windows\system32\drivers\Parport.sys

2011/08/30 14:29:12.0421 2320 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\windows\system32\drivers\PartMgr.sys

2011/08/30 14:29:12.0468 2320 ParVdm (1eade28746a64c21e0a808bb12a63326) C:\windows\system32\drivers\ParVdm.sys

2011/08/30 14:29:12.0531 2320 PCI (3b166f9f753c21aedaa9a6bd76b49655) C:\windows\system32\DRIVERS\pci.sys

2011/08/30 14:29:12.0593 2320 PCIIde (b31edeba4da28283f6b8dc4756fb9585) C:\windows\system32\DRIVERS\pciide.sys

2011/08/30 14:29:12.0640 2320 Pcmcia (2137ffd65f8e609a3a5acd487c56cce0) C:\windows\system32\drivers\Pcmcia.sys

2011/08/30 14:29:12.0796 2320 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\windows\system32\drivers\perc2.sys

2011/08/30 14:29:12.0828 2320 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\windows\system32\drivers\perc2hib.sys

2011/08/30 14:29:12.0953 2320 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\windows\system32\DRIVERS\raspptp.sys

2011/08/30 14:29:12.0984 2320 PSched (09298ec810b07e5d582cb3a3f9255424) C:\windows\system32\DRIVERS\psched.sys

2011/08/30 14:29:13.0031 2320 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\windows\system32\DRIVERS\ptilink.sys

2011/08/30 14:29:13.0078 2320 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\windows\system32\Drivers\PxHelp20.sys

2011/08/30 14:29:13.0140 2320 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\windows\system32\drivers\ql1080.sys

2011/08/30 14:29:13.0171 2320 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\windows\system32\drivers\Ql10wnt.sys

2011/08/30 14:29:13.0218 2320 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\windows\system32\drivers\ql12160.sys

2011/08/30 14:29:13.0375 2320 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\windows\system32\drivers\ql1240.sys

2011/08/30 14:29:13.0421 2320 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\windows\system32\drivers\ql1280.sys

2011/08/30 14:29:13.0468 2320 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\windows\system32\DRIVERS\rasacd.sys

2011/08/30 14:29:13.0531 2320 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\windows\system32\DRIVERS\rasl2tp.sys

2011/08/30 14:29:13.0609 2320 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\windows\system32\DRIVERS\raspppoe.sys

2011/08/30 14:29:13.0671 2320 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\windows\system32\DRIVERS\raspti.sys

2011/08/30 14:29:13.0734 2320 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\windows\system32\DRIVERS\rdbss.sys

2011/08/30 14:29:13.0765 2320 RDPCDD (4912d5b403614ce99c28420f75353332) C:\windows\system32\DRIVERS\RDPCDD.sys

2011/08/30 14:29:13.0843 2320 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\windows\system32\drivers\RDPWD.sys

2011/08/30 14:29:13.0890 2320 redbook (4173bc66e485fd77a03c4819f60bd0da) C:\windows\system32\DRIVERS\redbook.sys

2011/08/30 14:29:14.0015 2320 RT80x86 (ed36e76a08971e133c3c5e2440bfbe84) C:\windows\system32\DRIVERS\RT2860.sys

2011/08/30 14:29:14.0062 2320 RTLE8023xp (f0a21c62b9b835e1c96268eaae31d239) C:\windows\system32\DRIVERS\Rtenicxp.sys

2011/08/30 14:29:14.0156 2320 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\windows\system32\DRIVERS\secdrv.sys

2011/08/30 14:29:14.0250 2320 Serial (92c21762653bb2ce51147eb8a9aa654f) C:\windows\system32\drivers\Serial.sys

2011/08/30 14:29:14.0312 2320 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\windows\system32\drivers\Sfloppy.sys

2011/08/30 14:29:14.0421 2320 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\windows\system32\drivers\Sparrow.sys

2011/08/30 14:29:14.0468 2320 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\windows\system32\drivers\splitter.sys

2011/08/30 14:29:14.0531 2320 sr (64d2a7640e0767ecd3bcb38d3200e7ce) C:\windows\system32\DRIVERS\sr.sys

2011/08/30 14:29:14.0593 2320 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\windows\system32\DRIVERS\srv.sys

2011/08/30 14:29:14.0656 2320 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\windows\system32\DRIVERS\ssmdrv.sys

2011/08/30 14:29:14.0718 2320 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\windows\system32\DRIVERS\swenum.sys

2011/08/30 14:29:14.0765 2320 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\windows\system32\drivers\swmidi.sys

2011/08/30 14:29:14.0828 2320 symc810 (1ff3217614018630d0a6758630fc698c) C:\windows\system32\drivers\symc810.sys

2011/08/30 14:29:14.0859 2320 symc8xx (070e001d95cf725186ef8b20335f933c) C:\windows\system32\drivers\symc8xx.sys

2011/08/30 14:29:14.0906 2320 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\windows\system32\drivers\sym_hi.sys

2011/08/30 14:29:14.0937 2320 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\windows\system32\drivers\sym_u3.sys

2011/08/30 14:29:14.0984 2320 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\windows\system32\drivers\sysaudio.sys

2011/08/30 14:29:15.0078 2320 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\windows\system32\DRIVERS\tcpip.sys

2011/08/30 14:29:15.0125 2320 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\windows\system32\drivers\TDPIPE.sys

2011/08/30 14:29:15.0156 2320 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\windows\system32\drivers\TDTCP.sys

2011/08/30 14:29:15.0203 2320 TermDD (88155247177638048422893737429d9e) C:\windows\system32\DRIVERS\termdd.sys

2011/08/30 14:29:15.0281 2320 TosIde (5bc2144ab4f6090f12e49e9648b5a702) C:\windows\system32\drivers\TosIde.sys

2011/08/30 14:29:15.0359 2320 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\windows\system32\drivers\Udfs.sys

2011/08/30 14:29:15.0421 2320 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\windows\system32\drivers\ultra.sys

2011/08/30 14:29:15.0468 2320 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\windows\system32\DRIVERS\update.sys

2011/08/30 14:29:15.0562 2320 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\windows\system32\DRIVERS\usbccgp.sys

2011/08/30 14:29:15.0625 2320 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\windows\system32\DRIVERS\usbehci.sys

2011/08/30 14:29:15.0656 2320 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\windows\system32\DRIVERS\usbhub.sys

2011/08/30 14:29:15.0718 2320 usbprint (a717c8721046828520c9edf31288fc00) C:\windows\system32\DRIVERS\usbprint.sys

2011/08/30 14:29:15.0750 2320 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\windows\system32\DRIVERS\usbscan.sys

2011/08/30 14:29:15.0796 2320 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\windows\system32\DRIVERS\usbser.sys

2011/08/30 14:29:15.0859 2320 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\windows\system32\DRIVERS\USBSTOR.SYS

2011/08/30 14:29:15.0906 2320 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\windows\system32\DRIVERS\usbuhci.sys

2011/08/30 14:29:15.0953 2320 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\windows\System32\drivers\vga.sys

2011/08/30 14:29:16.0000 2320 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\windows\system32\drivers\ViaIde.sys

2011/08/30 14:29:16.0046 2320 VolSnap (8ab662b3c4691e6ddf61c96bb5b7d103) C:\windows\system32\drivers\VolSnap.sys

2011/08/30 14:29:16.0156 2320 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\windows\system32\DRIVERS\wanarp.sys

2011/08/30 14:29:16.0250 2320 wdmaud (6768acf64b18196494413695f0c3a00f) C:\windows\system32\drivers\wdmaud.sys

2011/08/30 14:29:16.0468 2320 MBR (0x1B8) (326b1b82aff839009448e346f5d9ac45) \Device\Harddisk0\DR0

2011/08/30 14:29:16.0609 2320 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR3

2011/08/30 14:29:16.0656 2320 Boot (0x1200) (7f95df88909490bb0600e5854c337a93) \Device\Harddisk0\DR0\Partition0

2011/08/30 14:29:16.0718 2320 Boot (0x1200) (0202d0a0837c799bff628e1f9e740a55) \Device\Harddisk0\DR0\Partition1

2011/08/30 14:29:16.0765 2320 Boot (0x1200) (d9494b52412302b6d824720c6f3a432d) \Device\Harddisk1\DR3\Partition0

2011/08/30 14:29:16.0781 2320 ================================================================================

2011/08/30 14:29:16.0781 2320 Scan finished

2011/08/30 14:29:16.0781 2320 ================================================================================

2011/08/30 14:29:16.0812 1712 Detected object count: 0

2011/08/30 14:29:16.0812 1712 Actual detected object count: 0

ComboFix 11-08-30.01 - HP_Administrator 30/08/2011 14:13:00.2.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.1015.216 [GMT 2:00]

Gestart vanuit: c:\documents and settings\HP_Administrator\Bureaublad\ComboFix.exe

AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Norton Internet Security *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

.

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\Gast\Mijn documenten\~WRL1230.tmp

c:\documents and settings\Gast\Mijn documenten\~WRL1916.tmp

c:\documents and settings\Gast\Mijn documenten\~WRL2093.tmp

c:\documents and settings\Gast\Mijn documenten\~WRL3297.tmp

c:\documents and settings\Gast\Mijn documenten\120.doc

c:\windows\system32\Thumbs.db

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-07-28 to 2011-08-30 ))))))))))))))))))))))))))))))

.

.

2011-08-29 18:52 . 2011-08-29 18:52 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Malwarebytes

2011-08-29 18:52 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-08-29 18:52 . 2011-08-29 18:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-08-29 18:52 . 2011-08-29 18:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-08-29 18:52 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-28 20:12 . 2011-08-29 18:49 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Sammsoft

2011-08-28 11:29 . 2011-08-28 11:29 388096 ----a-r- c:\documents and settings\HP_Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-08-28 11:29 . 2011-08-28 11:29 -------- d-----w- c:\program files\Trend Micro

2011-08-28 10:43 . 2011-08-28 10:43 1152 ----a-w- c:\windows\system32\windrv.sys

2011-08-28 10:43 . 2011-08-28 11:58 -------- d-----w- c:\program files\SpyNoMore

2011-08-28 10:35 . 2011-08-28 10:42 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\GetRightToGo

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-08-27 06:19 . 2011-06-03 05:04 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-07-15 13:29 . 2009-01-12 06:27 456320 ------w- c:\windows\system32\drivers\mrxsmb.sys

2011-07-08 14:02 . 2009-01-12 06:27 10496 ------w- c:\windows\system32\drivers\ndistapi.sys

2011-06-28 17:37 . 2011-02-15 16:54 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2011-06-28 17:37 . 2011-02-15 16:54 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys

2011-06-24 14:10 . 2009-01-21 06:39 139656 ------w- c:\windows\system32\drivers\rdpwd.sys

2011-06-23 18:31 . 2009-01-12 06:27 916480 ----a-w- c:\windows\system32\wininet.dll

2011-06-23 18:31 . 2009-01-12 06:27 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-06-23 18:31 . 2009-01-12 06:27 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-06-23 12:05 . 2009-01-12 06:27 385024 ----a-w- c:\windows\system32\html.iec

2011-06-20 17:44 . 2009-01-12 06:27 293888 ----a-w- c:\windows\system32\winsrv.dll

2011-06-06 11:35 . 2009-01-12 06:27 1859072 ----a-w- c:\windows\system32\win32k.sys

2011-08-27 09:20 . 2011-07-17 14:30 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((( SnapShot@2011-08-30_05.59.28 )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-08-30 11:58 . 2011-08-30 11:58 16384 c:\windows\Temp\Perflib_Perfdata_55c.dat

+ 2009-01-12 06:27 . 2011-08-30 09:53 91118 c:\windows\system32\perfc013.dat

+ 2009-01-12 06:27 . 2011-08-30 09:53 71478 c:\windows\system32\perfc009.dat

+ 2009-01-12 06:27 . 2011-08-30 09:53 509046 c:\windows\system32\perfh013.dat

+ 2009-01-12 06:27 . 2011-08-30 09:53 441160 c:\windows\system32\perfh009.dat

+ 2011-08-30 07:52 . 2011-08-30 07:52 807936 c:\windows\Installer\2590525.msi

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2011-03-18 06:11 2471240 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-10-26 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-10-26 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-10-26 137752]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]

"beid"="c:\program files\Belgium Identity Card\beid35gui.exe" [2009-06-04 2056192]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]

"FLMOFFICE4DMOUSE"="c:\program files\Labtec\Desktop\V5.1\moffice.exe" [2009-06-30 958464]

"OFFICEKB"="c:\program files\Labtec\Desktop\V5.1\kbdap32a.exe" [2009-06-30 387584]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-12-11 286720]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-17 2048352]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]

"RTHDCPL"="RTHDCPL.EXE" [2008-10-26 17021440]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-01-12 49208]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]

"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]

"SNM"="c:\program files\SpyNoMore\SNM.exe" [2010-07-12 1067984]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

.

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-10-12 110592]

HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2008-6-5 479232]

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqcopy2.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqsudi.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqpsapp.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqpse.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqgplgtupl.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqgpc01.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqusgm.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqusgh.exe"=

"c:\\Program Files\\Hp\\HP Software Update\\hpwucli.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\Smart Web Printing\\SmartWebPrintExe.exe"=

"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=

"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=

"c:\\wamp\\bin\\apache\\Apache2.2.17\\bin\\httpd.exe"=

"c:\\Program Files\\GIMPshop\\lib\\gimp\\2.0\\plug-ins\\script-fu.exe"=

.

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [13/09/2009 8:25 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [13/09/2009 8:25 108552]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [15/02/2011 18:54 136360]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [13/09/2009 8:25 297752]

R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [20/01/2009 8:56 712704]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [20/01/2011 14:44 136176]

S3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\drivers\a38usb.sys [24/03/2006 19:14 33536]

S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG8\Toolbar\ToolbarBroker.exe [5/11/2010 10:48 947528]

S3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [20/01/2011 14:44 136176]

S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19/02/2010 13:37 517096]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Inhoud van de 'Gedeelde Taken' map

.

2011-06-25 c:\windows\Tasks\AdobeAAMUpdater-1.0-UW-3223ECC21047-HP_Administrator.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-06-25 15:42]

.

2011-08-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-20 12:44]

.

2011-08-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-20 12:44]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://decopains.be/

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

Trusted Zone: taxonweb.be

TCP: DhcpNameServer = 192.168.1.1 192.168.123.254

Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\6pac91jj.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=

FF - prefs.js: browser.search.selectedEngine - SweetIM Search

FF - prefs.js: browser.startup.homepage - hxxp://www.google.be/

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2603445&q=

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-08-30 14:24

Windows 5.1.2600 Service Pack 3 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,22,02,91,99,7c,1d,9c,47,8e,16,97,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,22,02,91,99,7c,1d,9c,47,8e,16,97,\

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'winlogon.exe'(756)

c:\windows\system32\CLBCATQ.DLL

.

Voltooingstijd: 2011-08-30 14:27:40

ComboFix-quarantined-files.txt 2011-08-30 12:27

ComboFix2.txt 2011-08-30 06:07

.

Pre-Run: 44.253.048.832 bytes beschikbaar

Post-Run: 44.252.524.544 bytes beschikbaar

.

- - End Of File - - F47E6BDA99974D79C2EFBADAD89D5DB3