sommige webpagina's laden zeer traag

Patjera · 8 januari 2012

hoi,

hier het nieuwe logje van combofix

ComboFix 12-01-07.03 - Patrick 08/01/2012 10:55:08.5.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.2046.974 [GMT 1:00]

Gestart vanuit: c:\users\Patrick\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Patrick\Desktop\CFScript.txt

AV: AVG Internet Security 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

FW: AVG Firewall *Disabled* {621CC794-9486-F902-D092-0484E8EA828B}

SP: AVG Internet Security 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-12-08 to 2012-01-08 ))))))))))))))))))))))))))))))

.

2012-01-08 10:09 . 2012-01-08 10:09 -------- d-----w- c:\users\Gast\AppData\Local\temp

2012-01-08 10:09 . 2012-01-08 10:09 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-01-08 10:09 . 2012-01-08 10:09 -------- d-----w- c:\users\_ocster_backup_\AppData\Local\temp

2012-01-07 17:08 . 2012-01-08 10:09 -------- d-----w- c:\users\Patrick\AppData\Local\temp

2012-01-04 13:38 . 2012-01-04 13:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-01-04 13:38 . 2011-12-10 14:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-01-04 13:17 . 2012-01-04 13:17 388096 ----a-r- c:\users\Patrick\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-01-04 11:23 . 2012-01-04 13:17 -------- d-----w- c:\program files\Trend Micro

2012-01-03 19:26 . 2012-01-03 19:26 -------- d-----w- c:\users\Patrick\AppData\Roaming\Malwarebytes

2012-01-03 19:26 . 2012-01-04 19:58 -------- d-----w- c:\programdata\Malwarebytes

2011-12-31 17:23 . 2012-01-07 22:39 -------- d-----w- c:\program files\Emsisoft Anti-Malware

2011-12-30 18:41 . 2010-11-28 09:41 72008 ----a-w- c:\windows\system32\rdboot32.exe

2011-12-30 15:58 . 2011-12-30 15:58 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll

2011-12-30 15:58 . 2011-12-30 15:58 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll

2011-12-30 15:58 . 2011-12-30 15:58 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll

2011-12-30 15:58 . 2011-12-30 15:58 43992 ----a-w- c:\program files\Mozilla Firefox\mozutils.dll

2011-12-30 08:41 . 2011-12-30 08:42 -------- d-----w- c:\programdata\SpeedMP3Downloader

2011-12-30 08:41 . 2011-12-30 08:41 -------- d-----w- c:\users\Patrick\AppData\Roaming\SpeedMP3Downloader

2011-12-30 08:41 . 2011-12-30 08:41 -------- d-----w- c:\program files\SpeedMP3Downloader

2011-12-28 09:07 . 2011-12-28 09:07 -------- d-----w- c:\users\Patrick\AppData\Local\HostBit.co

2011-12-25 09:17 . 2011-12-25 09:17 -------- d-----w- c:\program files\Photo Toolbox

2011-12-25 09:17 . 2011-12-25 09:17 -------- d-----w- c:\users\Patrick\AppData\Roaming\LifeSniffer

2011-12-21 09:06 . 2012-01-04 12:48 -------- d-----w- c:\program files\Sandboxie

2011-12-20 19:29 . 2011-12-20 19:29 -------- d-----w- c:\program files\Xenocode

2011-12-19 10:09 . 2009-08-24 20:08 28160 ----a-w- c:\windows\system32\DfSdkBt.exe

2011-12-18 09:52 . 2012-01-04 12:48 -------- d-----w- c:\program files\AVG Secure Search

2011-12-18 09:40 . 2011-12-14 11:46 21312 ----a-w- c:\windows\system32\authuitu.dll

2011-12-18 09:39 . 2011-12-14 11:46 28992 ----a-w- c:\windows\system32\uxtuneup.dll

2011-12-17 20:44 . 2011-12-17 20:44 -------- d-----w- c:\users\Patrick\AppData\Local\Photo Collage Slide

2011-12-17 19:59 . 2011-12-17 20:12 -------- d-----w- c:\users\Patrick\AppData\Roaming\PDF Software

2011-12-13 21:00 . 2011-12-13 21:00 -------- d-----w- c:\users\Patrick\AppData\Roaming\Zentimo

2011-12-13 20:59 . 2011-12-13 20:59 -------- d-----w- c:\programdata\ZentimoService

2011-12-13 20:59 . 2011-12-13 20:59 -------- d-----w- c:\program files\Zentimo

2011-12-13 19:45 . 2011-10-27 08:01 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-12-13 19:45 . 2011-10-27 08:01 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-12-13 19:45 . 2011-10-14 16:02 429056 ----a-w- c:\windows\system32\EncDec.dll

2011-12-13 19:45 . 2011-11-23 13:37 2043904 ----a-w- c:\windows\system32\win32k.sys

2011-12-13 19:44 . 2011-11-08 14:42 2048 ----a-w- c:\windows\system32\tzres.dll

2011-12-13 19:44 . 2011-10-25 15:56 49152 ----a-w- c:\windows\system32\csrsrv.dll

2011-12-12 13:58 . 2011-12-12 13:58 -------- d-----w- c:\program files\TomTom HOME 2

2011-12-12 13:28 . 2011-12-12 18:02 -------- d-----w- c:\program files\PopTray

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-14 11:47 . 2011-10-25 19:58 31552 ----a-w- c:\windows\system32\TURegOpt.exe

2011-11-24 17:00 . 2011-05-29 16:24 414368 ------w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-14 07:11 . 2011-11-14 07:11 45240 ------w- c:\windows\system32\drivers\UimBus.sys

2011-11-14 07:11 . 2011-11-14 07:11 441608 ------w- c:\windows\system32\drivers\Uim_IM.sys

2011-11-14 07:11 . 2011-11-14 07:11 306488 ------w- c:\windows\system32\drivers\UimFIO.sys

2011-11-14 07:11 . 2011-11-14 07:11 277576 ------w- c:\windows\system32\drivers\Uim_Vim.sys

2011-11-10 04:54 . 2010-10-31 18:15 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-10-24 13:29 . 2011-10-24 13:29 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2011-10-24 13:29 . 2011-10-24 13:29 69632 ----a-w- c:\windows\system32\QuickTime.qts

2011-10-19 21:16 . 2011-09-24 12:30 20312 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe

2011-12-30 15:58 . 2011-03-26 15:48 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

2000-01-01 00:00 . 2011-02-21 13:43 163840 ------w- c:\program files\mozilla firefox\components\XPBrowsealoudPlugin.dll

.

<pre>
c:\program files\ISP Monitor\isp  .exe
</pre>

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2011-12-18 17:32 1574240 ----a-w- c:\program files\AVG Secure Search\9.0.0.22\AVG Secure Search_toolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\9.0.0.22\AVG Secure Search_toolbar.dll" [2011-12-18 1574240]

.

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ------w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ------w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ------w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CuteReminder"="c:\program files\CuteReminder\CuteReminder.exe" [2008-03-18 1029120]

"bjb"="c:\program files\Blue Jet Button\bjb.exe" [2011-09-24 259072]

"HostBit.co Site Check"="e:\snelkoppelingen\websitetools\HostBit.co Site Check.exe" [2011-11-19 76288]

"Advanced SystemCare 5"="c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe" [2011-12-11 619352]

"Zentimo xStorage Manager"="c:\program files\Zentimo\Zentimo.exe" [2011-12-01 2068112]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2007-09-03 4702208]

"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2011-12-18 892768]

"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-01-24 563080]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"TOSHIBA Online Product Information"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]

.

c:\users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

avgtray.exe - Snelkoppeling.lnk - c:\program files\AVG\AVG10\avgtray.exe [2011-9-10 2338656]

HostBit.co Site Check.exe - Snelkoppeling.lnk - e:\snelkoppelingen\websitetools\HostBit.co Site Check.exe [2011-12-28 76288]

PopTray.lnk - c:\program files\PopTray\PopTray.exe [2006-9-16 1666048]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLinkedConnections"= 1 (0x1)

"HideFastUserSwitching"= 1 (0x1)

"DisableStartupSound"= 1 (0x1)

"DisableStatusMessages"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 0 (0x0)

"NoFileAssociate"= 0 (0x0)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"GreyMSIAds"= 0 (0x0)

"HideSCANetwork"= 1 (0x1)

"HideSCABattery"= 1 (0x1)

"DisableThumbnailsOnNetworkFolders"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders credssp.dll, msrdsyap.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blue Jet Button]

2011-09-24 13:40 259072 ------w- c:\program files\Blue Jet Button\bjb.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CuteReminder]

2008-03-18 21:17 1029120 ------w- c:\program files\CuteReminder\CuteReminder.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ITSecMng]

2009-07-22 11:40 83336 ------w- c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Office Outlook]

2011-08-03 16:18 12997488 ------w- c:\progra~1\MICROS~2\Office12\OUTLOOK.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PopTray.exe]

2006-09-16 13:01 1666048 ----a-w- c:\program files\PopTray\PopTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Toshiba TEMPRO]

2010-10-26 14:00 1050072 ------w- c:\program files\Toshiba TEMPRO\TemproTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]

2007-01-24 11:21 563080 ----a-w- c:\windows\WindowsMobile\wmdc.exe

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe"

"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe

"Firefox"=c:\program files\Mozilla Firefox\firefox.exe

"ehTray.exe"=c:\windows\ehome\ehTray.exe

"GBMLite8AgentLaCie"="c:\program files\LaCie\Genie Backup Assistant\GBMAgent.exe"

"Sidebar"=c:\program files\Windows Sidebar\sidebar.exe /autoRun

"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe"

"SpeedUpMyPC"="c:\program files\Uniblue\SpeedUpMyPC\launcher.exe" delay 20000

"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" delay 20000

"Microsoft Office Outlook"=c:\progra~1\MICROS~2\Office12\OUTLOOK.EXE /recycle

"Advanced SystemCare 5"="c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe" /Manual

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

"Ocster Backup"="c:\program files\Ocster Backup\bin\backupClient-ox.exe" --hidden

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

"QuickTime Plugin Install"=c:\program files\QuickTime\Plugins\DeleteMe1.exe

"GiMeSpace"=c:\program files\GiMeSpace Desktop Extender 3D\GiMeSpace.exe

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-810152066-308378670-3363130950-1000]

"EnableNotificationsRef"=dword:00000003

.

R3 a2acc;a2acc;c:\program files\EMSISOFT ANTI-MALWARE\a2accx86.sys [2011-11-02 51632]

R4 ADExchange;ArcSoft Exchange Service;c:\program files\Common Files\ArcSoft\esinter\Bin\eservutil.exe [2011-10-26 37280]

R4 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\IObit\Advanced SystemCare 5\ASCService.exe [2011-12-11 494424]

S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files\Emsisoft Anti-Malware\a2ddax86.sys [2011-05-19 17904]

S2 a2AntiMalware;Emsisoft Anti-Malware 6.0 - Service;c:\program files\Emsisoft Anti-Malware\a2service.exe [2012-01-04 2998832]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

bthsvcs REG_MULTI_SZ BthServ

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Inhoud van de 'Gedeelde Taken' map

.

2011-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-17 20:38]

.

2011-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-17 20:38]

.

2012-01-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-810152066-308378670-3363130950-1000Core.job

- c:\users\Patrick\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-30 12:22]

.

2012-01-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-810152066-308378670-3363130950-1000UA.job

- c:\users\Patrick\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-30 12:22]

.

2011-05-28 c:\windows\Tasks\RegistryBooster.job

- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2011-01-21 14:19]

.

2011-12-25 c:\windows\Tasks\SpeedUpMyPC.job

- c:\program files\Uniblue\SpeedUpMyPC\spmonitor.exe [2011-06-11 15:26]

.

2011-12-25 c:\windows\Tasks\Wise Disk Cleaner 4.job

- c:\program files\Wise Disk Cleaner\WiseDiskCleaner.exe [2009-11-04 19:06]

.

2011-12-25 c:\windows\Tasks\Wise Disk Cleaner Schedule Task.job

- c:\program files\Wise Disk Cleaner\WiseDiskCleaner.exe [2009-11-04 19:06]

.

2011-12-31 c:\windows\Tasks\Wise Registry Cleaner 4.job

- c:\program files\Wise Registry Cleaner\WiseRegistryCleaner.exe [2009-11-04 12:30]

.

2011-12-31 c:\windows\Tasks\Wise Registry Cleaner Schedule Task.job

- c:\program files\Wise Registry Cleaner\WiseRegistryCleaner.exe [2009-11-04 12:30]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Afbeelding verzenden naar &Bluetooth-apparaat... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Pagina verzenden naar &Bluetooth-apparaat... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: Translate this web page with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm

IE: Translate with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm

TCP: DhcpNameServer = 195.130.131.132 195.130.130.4

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll

FF - ProfilePath - c:\users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\b83d13z2.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.be/

FF - user.js: browser.blink_allowed - true

FF - user.js: browser.cache.memory.capacity - 65536

FF - user.js: browser.chrome.favicons - false

FF - user.js: browser.display.show_image_placeholders - true

FF - user.js: browser.search.openintab - false

FF - user.js: browser.tabs.closeButtons - 1

FF - user.js: browser.tabs.opentabfor.middleclick - true

FF - user.js: browser.tabs.tabMinWidth - 100

FF - user.js: browser.turbo.enabled - true

FF - user.js: browser.urlbar.autocomplete.enabled - true

FF - user.js: browser.urlbar.autoFill - true

FF - user.js: browser.xul.error_pages.enabled - true

FF - user.js: content.interrupt.parsing - true

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.maxtextrun - 8191

FF - user.js: content.notify.backoffcount - 5

FF - user.js: content.notify.interval - 600000

FF - user.js: content.notify.ontimer - true

FF - user.js: content.switch.threshold - 600000

FF - user.js: layout.spellcheckDefault - 1

FF - user.js: network.http.max-connections - 32

FF - user.js: network.http.max-connections-per-server - 8

FF - user.js: network.http.max-persistent-connections-per-proxy - 8

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: network.http.pipelining - true

FF - user.js: network.http.pipelining.firstrequest - true

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: network.http.proxy.pipelining - true

FF - user.js: network.http.request.max-start-delay - 0

FF - user.js: network.prefetch-next - true

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: plugin.expose_full_path - true

FF - user.js: ui.submenuDelay - 0

FF - user.js: browser.urlbar.hideGoButton - false

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-01-08 11:09

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,db,99,c5,ab,05,0e,3d,41,94,fb,07,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,db,99,c5,ab,05,0e,3d,41,94,fb,07,\

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'Explorer.exe'(3340)

c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

Voltooingstijd: 2012-01-08 11:15:01

ComboFix-quarantined-files.txt 2012-01-08 10:14

ComboFix2.txt 2012-01-07 17:08

ComboFix3.txt 2012-01-07 11:57

ComboFix4.txt 2012-01-07 09:34

ComboFix5.txt 2012-01-08 09:51

.

Pre-Run: 29.948.866.560 bytes beschikbaar

Post-Run: 29.707.190.272 bytes beschikbaar

.

- - End Of File - - 773011AFBAB37722E29D2C84D88DAC42

keygans zijn een risoco...dat weet ik wel. Wat emosoft vindt zijn keygens die opgeslagen zijn, maar niet meer gebruikt worden. Mischien moet ik die ik heb laten staan ook maar deleten. Ga nog wat opkuiswerk doen.

Ben nog steeds niet 100 percent tevreden over firefox...mischien moet ik overwegen om hem te deinstaleren met revo en dan terug te installeren. Had daarnet opnieuw het probleempje met Wapper vzw - We zien je graag sporten - Sportclub voor personen met een motorische handicap. eerst een foto op een verkeerde plaats en nadat ik op vernieuwen drukte stond het juist. Daarna weer geen probleem meer.

Mijn eigen website laadde eerst traag en nu weer niet meer coach Patrick's boccia site

dit zijn de aanwijzingen die ik opvolgde

[TIP] FF .09 Ubersnel Maken !!

1. Type "about:config" in the adress field.

2. Set the value of network.http.pipelining to "true".

3. Set the value of network.http.pipelining.maxrequests to "100".

4. Set the value of network.http.proxy.pipelining to "true"

5. Set the value of nglayout.initialpaint.delay to "0"

Kan dit met een of andere instelling in firefox te maken hebben...heb hier wel wat zitten tweeken.

Heb je nog ideeen ?

kape · 9 januari 2012

Dit programma c:\program files\ISP Monitor blijft voor problemen zorgen. Best dat je dat uninstalled en daarna opnieuw download.En dan zou ik inderdaad de keuze maken om de huidige FF te verwijderen en opnieuw clean te downloaden en te installeren. De aanpassingen om hem sneller te maken worden wel meer voorgesteld, maar heb zo mijn twijfels over hun impact.

Patjera · 9 januari 2012

heb even moeten nadenken wat ispmonitor nu weer was. Ik herinner me nu dat ik dat vroeger gebruikte om mijn verbruik bij telenet te volgen. Had het programma vroeger al verwijderd. Er zijn dus nog restanten. Heb opnieuw gedownload en geinstalleeerd en verwijderd met revo uninstaller. Hopenlijk heb ik nu alle restjes weg. Ik zal zodra ik tijd heb die combofix nog eens laten draaien. Vandaag liep mijn computer in elk geval al stukken vlotter. Al het werk moet dus vruchten aan het afwerpen zijn. Dat is wel bemoedigend;

Weet nog niet of ik firefox zal herinstalleren. Het is een hoop gedoe omdat ik vele site's heb met wachtwoorden die ik dan allemaal opnieuw moet gaan zoeken. Daar ga ik nog eens over nadenken.

Wanneer ik combofix nog eens heb laten lopen zal ik het logje er nog eens opzetten. Kan je zien of er daar nog iets moet gebeuren. Alvast bedankt...er zijn toch wel resultaten merkbaar.

kape · 10 januari 2012

Ok, bekijk het maar ... en dan lezen we je bevindingen hier wel ;-)

Patjera · 11 januari 2012

hoi,

heb firefox dan toch maar gedeinstalleers. eerst heb ik de keuze gemaakt om de favorieten en instellingen te laten staan. Dit leverde niet veel op...zelfste probleem. daarna opnieuw gedeinstalleerd en en niks laten staan. Dit had blijkbaar wel effect. Problemen weg en firefox reageert weer normaal. 't moet dus toch iets te maken hebben gehad met dingen die ik in het verleden in firefox had geinstalleerd. Een hele bedoening om alle favorieten en hun wachtwoorden er terug in te zetten, maar toch tevreden met het resultaat.

Met alle handelingen van tevoren is m'n pc in elk geval ook terug wat schoner. Ook die reageert sneller als daarvoor. Dat is dus ook nuttig geweest.

Ik geef hier een laatste logje van combofix. Als je denkt dat ik nog iets moet doen, dan laat je me het maar weten. Alvast bedankt voor de goede service. Dit kan ik zeker aanbevelen.

ComboFix 12-01-10.02 - Patrick 10/01/2012 19:48:27.7.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.2046.983 [GMT 1:00]

Gestart vanuit: c:\users\Patrick\Desktop\ComboFix.exe

AV: AVG Internet Security 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

FW: AVG Firewall *Disabled* {621CC794-9486-F902-D092-0484E8EA828B}

SP: AVG Internet Security 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Patrick\AppData\Roaming\vso_ts_preview.xml

c:\windows\iun6002.exe

c:\windows\system32\drivers\etc\hosts.ics

.

Besmet exemplaar van c:\windows\system32\userinit.exe werd aangetroffen en gedesinfecteerd

Hersteld exemplaar van - c:\combofix\HarddiskVolumeShadowCopy6_!Windows!System32!userinit.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-12-10 to 2012-01-10 ))))))))))))))))))))))))))))))

.

2012-01-10 19:01 . 2012-01-10 19:01 -------- d-----w- c:\users\Gast\AppData\Local\temp

2012-01-10 19:01 . 2012-01-10 19:01 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-01-10 19:01 . 2012-01-10 19:01 -------- d-----w- c:\users\_ocster_backup_\AppData\Local\temp

2012-01-07 17:08 . 2012-01-10 19:09 -------- d-----w- c:\users\Patrick\AppData\Local\temp

2012-01-04 13:38 . 2012-01-04 13:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-01-04 13:38 . 2011-12-10 14:24 20464 ------w- c:\windows\system32\drivers\mbam.sys

2012-01-04 13:17 . 2012-01-04 13:17 388096 ------r- c:\users\Patrick\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-01-04 11:23 . 2012-01-04 13:17 -------- d-----w- c:\program files\Trend Micro

2012-01-03 19:26 . 2012-01-03 19:26 -------- d-----w- c:\users\Patrick\AppData\Roaming\Malwarebytes

2012-01-03 19:26 . 2012-01-04 19:58 -------- d-----w- c:\programdata\Malwarebytes

2011-12-30 18:41 . 2010-11-28 09:41 72008 ------w- c:\windows\system32\rdboot32.exe

2011-12-30 08:41 . 2011-12-30 08:42 -------- d-----w- c:\programdata\SpeedMP3Downloader

2011-12-30 08:41 . 2011-12-30 08:41 -------- d-----w- c:\users\Patrick\AppData\Roaming\SpeedMP3Downloader

2011-12-30 08:41 . 2011-12-30 08:41 -------- d-----w- c:\program files\SpeedMP3Downloader

2011-12-28 09:07 . 2011-12-28 09:07 -------- d-----w- c:\users\Patrick\AppData\Local\HostBit.co

2011-12-25 09:17 . 2011-12-25 09:17 -------- d-----w- c:\program files\Photo Toolbox

2011-12-25 09:17 . 2011-12-25 09:17 -------- d-----w- c:\users\Patrick\AppData\Roaming\LifeSniffer

2011-12-23 10:00 . 2011-12-23 10:00 159744 ------w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll

2011-12-23 10:00 . 2011-12-23 10:00 159744 ------w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll

2011-12-23 10:00 . 2011-12-23 10:00 159744 ------w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll

2011-12-23 10:00 . 2011-12-23 10:00 159744 ------w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll

2011-12-23 10:00 . 2011-12-23 10:00 159744 ------w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll

2011-12-23 10:00 . 2011-12-23 10:00 159744 ------w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll

2011-12-23 10:00 . 2011-12-23 10:00 159744 ------w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll

2011-12-21 09:06 . 2012-01-04 12:48 -------- d-----w- c:\program files\Sandboxie

2011-12-20 19:29 . 2011-12-20 19:29 -------- d-----w- c:\program files\Xenocode

2011-12-19 10:09 . 2009-08-24 20:08 28160 ------w- c:\windows\system32\DfSdkBt.exe

2011-12-18 09:52 . 2012-01-04 12:48 -------- d-----w- c:\program files\AVG Secure Search

2011-12-18 09:40 . 2011-12-14 11:46 21312 ------w- c:\windows\system32\authuitu.dll

2011-12-18 09:39 . 2011-12-14 11:46 28992 ------w- c:\windows\system32\uxtuneup.dll

2011-12-17 20:44 . 2011-12-17 20:44 -------- d-----w- c:\users\Patrick\AppData\Local\Photo Collage Slide

2011-12-17 19:59 . 2011-12-17 20:12 -------- d-----w- c:\users\Patrick\AppData\Roaming\PDF Software

2011-12-13 21:00 . 2011-12-13 21:00 -------- d-----w- c:\users\Patrick\AppData\Roaming\Zentimo

2011-12-13 20:59 . 2011-12-13 20:59 -------- d-----w- c:\programdata\ZentimoService

2011-12-13 20:59 . 2011-12-13 20:59 -------- d-----w- c:\program files\Zentimo

2011-12-13 19:45 . 2011-10-27 08:01 3602816 ------w- c:\windows\system32\ntkrnlpa.exe

2011-12-13 19:45 . 2011-10-27 08:01 3550080 ------w- c:\windows\system32\ntoskrnl.exe

2011-12-13 19:45 . 2011-10-14 16:02 429056 ------w- c:\windows\system32\EncDec.dll

2011-12-13 19:45 . 2011-11-23 13:37 2043904 ------w- c:\windows\system32\win32k.sys

2011-12-13 19:44 . 2011-11-08 14:42 2048 ------w- c:\windows\system32\tzres.dll

2011-12-13 19:44 . 2011-10-25 15:56 49152 ------w- c:\windows\system32\csrsrv.dll

2011-12-12 13:58 . 2011-12-12 13:58 -------- d-----w- c:\program files\TomTom HOME 2

2011-12-12 13:28 . 2011-12-12 18:02 -------- d-----w- c:\program files\PopTray

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-14 11:47 . 2011-10-25 19:58 31552 ------w- c:\windows\system32\TURegOpt.exe

2011-11-24 17:00 . 2011-05-29 16:24 414368 ------w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-14 07:11 . 2011-11-14 07:11 45240 ------w- c:\windows\system32\drivers\UimBus.sys

2011-11-14 07:11 . 2011-11-14 07:11 441608 ------w- c:\windows\system32\drivers\Uim_IM.sys

2011-11-14 07:11 . 2011-11-14 07:11 306488 ------w- c:\windows\system32\drivers\UimFIO.sys

2011-11-14 07:11 . 2011-11-14 07:11 277576 ------w- c:\windows\system32\drivers\Uim_Vim.sys

2011-11-10 04:54 . 2010-10-31 18:15 472808 ------w- c:\windows\system32\deployJava1.dll

2011-10-24 13:29 . 2011-10-24 13:29 94208 ------w- c:\windows\system32\QuickTimeVR.qtx

2011-10-24 13:29 . 2011-10-24 13:29 69632 ------w- c:\windows\system32\QuickTime.qts

2011-10-19 21:16 . 2011-09-24 12:30 20312 ------w- c:\windows\system32\RegistryDefragBootTime.exe

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2011-12-18 17:32 1574240 ------w- c:\program files\AVG Secure Search\9.0.0.22\AVG Secure Search_toolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\9.0.0.22\AVG Secure Search_toolbar.dll" [2011-12-18 1574240]

.

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ------w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ------w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ------w- c:\users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"bjb"="c:\program files\Blue Jet Button\bjb.exe" [2011-09-24 259072]

"Advanced SystemCare 5"="c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe" [2011-12-11 619352]

"CuteReminder"="c:\program files\CuteReminder\CuteReminder.exe" [2008-03-18 1029120]

"Zentimo xStorage Manager"="c:\program files\Zentimo\Zentimo.exe" [2011-12-01 2068112]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]

"Ashampoo WinOptimizer Live-Tuner"="c:\program files\Ashampoo\Ashampoo WinOptimizer 8\LiveTuner.exe" [2011-09-28 2656680]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"TOSHIBA Online Product Information"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2009-03-16 6158240]

.

c:\users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

avgtray.exe - Snelkoppeling.lnk - c:\program files\AVG\AVG10\avgtray.exe [2011-9-10 2338656]

PopTray.lnk - c:\program files\PopTray\PopTray.exe [2006-9-16 1666048]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLinkedConnections"= 1 (0x1)

"HideFastUserSwitching"= 1 (0x1)

"DisableStartupSound"= 1 (0x1)

"DisableStatusMessages"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 0 (0x0)

"NoFileAssociate"= 0 (0x0)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"GreyMSIAds"= 0 (0x0)

"HideSCANetwork"= 1 (0x1)

"HideSCABattery"= 1 (0x1)

"DisableThumbnailsOnNetworkFolders"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders credssp.dll, msrdsyap.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blue Jet Button]

2011-09-24 13:40 259072 ------w- c:\program files\Blue Jet Button\bjb.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CuteReminder]

2008-03-18 21:17 1029120 ------w- c:\program files\CuteReminder\CuteReminder.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ITSecMng]

2009-07-22 11:40 83336 ------w- c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Office Outlook]

2011-08-03 16:18 12997488 ------w- c:\progra~1\MICROS~2\Office12\OUTLOOK.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PopTray.exe]

2006-09-16 13:01 1666048 ------w- c:\program files\PopTray\PopTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]

2007-09-03 10:39 4702208 ------w- c:\windows\RtHDVCpl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Toshiba TEMPRO]

2010-10-26 14:00 1050072 ------w- c:\program files\Toshiba TEMPRO\TemproTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vProt]

2011-12-18 17:32 892768 ------w- c:\program files\AVG Secure Search\vprot.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]

2007-01-24 11:21 563080 ------w- c:\windows\WindowsMobile\wmdc.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zentimo xStorage Manager]

2011-12-01 16:18 2068112 ------w- c:\program files\Zentimo\Zentimo.exe

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe"

"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe

"ehTray.exe"=c:\windows\ehome\ehTray.exe

"GBMLite8AgentLaCie"="c:\program files\LaCie\Genie Backup Assistant\GBMAgent.exe"

"Sidebar"=c:\program files\Windows Sidebar\sidebar.exe /autoRun

"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe"

"SpeedUpMyPC"="c:\program files\Uniblue\SpeedUpMyPC\launcher.exe" delay 20000

"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" delay 20000

"Microsoft Office Outlook"=c:\progra~1\MICROS~2\Office12\OUTLOOK.EXE /recycle

"Advanced SystemCare 5"="c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe" /Manual

"HostBit.co Site Check"=e:\snelkoppelingen\websitetools\HostBit.co Site Check.exe