Vastlopen computer

[kape]

Helaas nog geen positief resultaat. In "veilige modus" is dit al uitgevoerd, maar ook als "administrator" ? Want de aangeduide items zitten jammer genoeg ook nog in dit nieuwe logje.

[brus]

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 14:36:31, on 2-1-2012

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.19170)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\SYSTEM32\taskeng.exe

C:\Windows\RtHDVCpl.exe

C:\Windows\WindowsMobile\wmdSync.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\PROGRAM FILES\UTORRENT\UTORRENT.EXE

C:\PROGRAM FILES\WINDOWS LIVE\MESSENGER\MSNMSGR.EXE

C:\PROGRAM FILES\INCREDIMAIL\BIN\INCMAIL.EXE

C:\PROGRAM FILES\SOPHOS\AUTOUPDATE\ALMON.EXE

C:\PROGRAM FILES\ADOBE\PHOTOSHOP ALBUM STARTER EDITION\3.0\APPS\APDPROXY.EXE

C:\Program Files\WINDOWS DEFENDER\MSASCUI.EXE

C:\PROGRAM FILES\HP\DIGITAL IMAGING\BIN\HPQTRA08.EXE

C:\Program Files\IncrediMail\Bin\ImApp.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe

C:\Windows\system32\conime.exe

C:\Windows\system32\Macromed\Flash\FlashUtil11c_ActiveX.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Analysis of program downloads scanned for viruses and spyware.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Analysis of program downloads scanned for viruses and spyware.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Analysis of program downloads scanned for viruses and spyware.

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [skytel] Skytel.exe

O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe

O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

O4 - HKCU\..\Run: [Advanced SystemCare 5] "C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll

O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\programdata\sophos\web intelligence\swi_ifslsp.dll

O10 - Unknown file in Winsock LSP: c:\programdata\sophos\web intelligence\swi_ifslsp.dll

O10 - Unknown file in Winsock LSP: c:\programdata\sophos\web intelligence\swi_ifslsp.dll

O10 - Unknown file in Winsock LSP: c:\programdata\sophos\web intelligence\swi_ifslsp.dll

O10 - Unknown file in Winsock LSP: c:\programdata\sophos\web intelligence\swi_ifslsp.dll

O10 - Unknown file in Winsock LSP: c:\programdata\sophos\web intelligence\swi_ifslsp.dll

O10 - Unknown file in Winsock LSP: c:\programdata\sophos\web intelligence\swi_ifslsp.dll

O10 - Unknown file in Winsock LSP: c:\programdata\sophos\web intelligence\swi_ifslsp.dll

O10 - Unknown file in Winsock LSP: c:\programdata\sophos\web intelligence\swi_ifslsp.dll

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

O16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsVista.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: toolbarchrome - (no CLSID) - (no file)

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O20 - AppInit_DLLs: C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Advanced SystemCare Service 5 (AdvancedSystemCareService5) - IObit - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe

O23 - Service: Google Updateservice (gupdate1c98f818b700589) (gupdate1c98f818b700589) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Limited - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe

O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Limited - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe

O23 - Service: Sophos AutoUpdate Service - Sophos Limited - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

O23 - Service: Sophos Web Intelligence Service (swi_service) - Sophos Limited - C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

O23 - Service: Sophos Web Intelligence Update (swi_update) - Sophos Limited - C:\ProgramData\Sophos\Web Intelligence\swi_update.exe

--

End of file - 8995 bytes

Heb hijackthis nog een paar keer uitgevoerd maar haalt niet alles weg.

Sommige bestanden zie ik niet terug inde lijst:R1-HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Analysis of program downloads scanned for viruses and spyware.

R1-HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Analysis of program downloads scanned for viruses and spyware.

R0-HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Analysis of program downloads scanned for viruses and spyware.

[kape]

We zijn alvast een flinke stap verder ... een aantal problematische bestanden zijn nu wel verwijderd. Even een volgende stap dan :

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:

Klik hier

2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.

3. Dubbelklik op "Combofix.exe" om de tool te starten.

4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion", herstart dan de computer.

5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

[brus]

ComboFix 12-01-02.01 - Wim Brusselers 02-01-2012 16:08:34.2.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.3070.1907 [GMT 1:00]

Gestart vanuit: c:\users\Wim Brusselers\Favorites\Downloads\ComboFix.exe

AV: Sophos Anti-Virus *Disabled/Updated* {65FBD860-96D8-75EF-C7ED-7BE27E6C498A}

SP: Sophos Anti-Virus *Disabled/Updated* {DE9A3984-B0E2-7A61-FD5D-409005EB0337}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\utorrent\utorrent.exe

c:\programdata\ntuser.dat

c:\users\Wim Brusselers\AppData\Roaming\8jup.exe

c:\windows\bwUnin-6.1.4.68-8876480L.exe

c:\windows\IsUn0413.exe

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-12-02 to 2012-01-02 ))))))))))))))))))))))))))))))

.

.

2012-01-02 16:10 . 2012-01-02 16:10 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-01-02 11:56 . 2012-01-02 14:55 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8245EA3B-6C24-4600-A278-24586166B200}\offreg.dll

2012-01-02 11:29 . 2012-01-02 11:32 1696 ----a-w- c:\windows\system32\ASOROSet.bin

2012-01-02 11:00 . 2012-01-02 11:00 -------- d-----w- c:\users\Wim Brusselers\AppData\Roaming\Malwarebytes

2012-01-02 11:00 . 2012-01-02 11:00 -------- d-----w- c:\programdata\Malwarebytes

2012-01-02 11:00 . 2012-01-02 11:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-01-02 11:00 . 2011-12-10 14:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-31 15:22 . 2011-12-31 15:23 388096 ----a-r- c:\users\Wim Brusselers\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-12-31 15:22 . 2011-12-31 15:22 -------- d-----w- c:\program files\Trend Micro

2011-12-31 15:18 . 2011-12-31 15:18 -------- d-----w- c:\users\Wim Brusselers\AppData\Roaming\NVIDIA

2011-12-31 15:17 . 2011-12-31 15:17 -------- d-----w- c:\program files\Speccy

2011-12-31 14:42 . 2012-01-02 11:34 -------- d-----w- c:\users\Wim Brusselers\AppData\Roaming\Systweak

2011-12-31 14:42 . 2011-11-19 10:52 17280 ----a-w- c:\windows\system32\roboot.exe

2011-12-31 13:13 . 2011-12-31 13:13 -------- d-----w- c:\program files\Photo Notifier and Animation Creator

2011-12-30 13:39 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8245EA3B-6C24-4600-A278-24586166B200}\mpengine.dll

2011-12-29 14:09 . 2011-12-29 14:09 -------- d-----w- c:\programdata\WindowsSearch

2011-12-28 12:39 . 2011-12-28 12:39 -------- d-----w- c:\programdata\NVIDIA

2011-12-28 12:33 . 2011-10-15 08:53 123712 ----a-w- c:\windows\system32\nvshext.dll

2011-12-28 12:33 . 2011-10-15 08:53 3074368 ----a-w- c:\windows\system32\nvsvcr.dll

2011-12-28 12:33 . 2011-10-15 08:53 1136448 ----a-w- c:\windows\system32\nvvsvc.exe

2011-12-28 12:33 . 2011-10-15 08:53 3840320 ----a-w- c:\windows\system32\nvsvc.dll

2011-12-28 12:33 . 2011-10-15 08:53 6350144 ----a-w- c:\windows\system32\nvcpl.dll

2011-12-28 12:33 . 2011-10-15 08:53 203072 ----a-w- c:\windows\system32\nvmctray.dll

2011-12-28 12:33 . 2011-10-15 08:53 602432 ----a-w- c:\windows\system32\easyupdatusapiu.dll

2011-12-28 12:31 . 2011-12-28 12:31 -------- d-----w- c:\programdata\NVIDIA Corporation

2011-12-28 12:10 . 2011-12-28 12:10 -------- d-----w- c:\users\Wim Brusselers\{8813c7a5-f2d2-415c-82c8-679ba3bcfc94}

2011-12-28 12:01 . 2011-10-15 08:53 61248 ----a-w- c:\windows\system32\OpenCL.dll

2011-12-28 12:01 . 2011-10-15 08:53 7041856 ----a-w- c:\windows\system32\nvwgf2um.dll

2011-12-28 12:01 . 2011-10-15 08:53 18871616 ----a-w- c:\windows\system32\nvoglv32.dll

2011-12-28 12:01 . 2011-10-15 08:53 10327360 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys

2011-12-28 12:01 . 2011-10-15 08:53 877376 ----a-w- c:\windows\system32\nvgenco32.dll

2011-12-28 12:01 . 2011-10-15 08:53 919872 ----a-w- c:\windows\system32\nvdispco32.dll

2011-12-28 12:01 . 2011-10-15 08:53 2401088 ----a-w- c:\windows\system32\nvcuvid.dll

2011-12-28 12:01 . 2011-10-15 08:53 2099520 ----a-w- c:\windows\system32\nvcuvenc.dll

2011-12-28 12:01 . 2011-10-15 08:53 13205312 ----a-w- c:\windows\system32\nvd3dum.dll

2011-12-28 12:01 . 2011-10-15 08:53 5578560 ----a-w- c:\windows\system32\nvcuda.dll

2011-12-28 12:01 . 2011-10-15 08:53 2458432 ----a-w- c:\windows\system32\nvapi.dll

2011-12-28 12:01 . 2011-10-15 08:53 17248576 ----a-w- c:\windows\system32\nvcompiler.dll

2011-12-28 11:30 . 2011-12-28 11:30 -------- d-----w- c:\program files\SystemRequirementsLab

2011-12-28 11:21 . 2011-12-28 12:32 -------- d-----w- c:\program files\NVIDIA Corporation

2011-12-23 10:02 . 2011-12-23 10:02 -------- d-----w- c:\program files\Common Files\Cisco Systems

2011-12-23 10:02 . 2011-12-23 10:00 30744 ----a-w- c:\windows\system32\SophosBootTasks.exe

2011-12-23 10:00 . 2011-12-23 10:00 33696 ----a-w- c:\windows\system32\drivers\sdcfilter.sys

2011-12-23 09:59 . 2011-12-23 09:59 123680 ----a-w- c:\windows\system32\drivers\savonaccess.sys

2011-12-06 18:34 . 2011-10-19 21:16 20312 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe

2011-12-04 19:06 . 2011-12-04 19:06 -------- d-----w- c:\programdata\IObit

2011-12-04 19:05 . 2011-12-07 07:03 -------- d-----w- c:\users\Wim Brusselers\AppData\Roaming\IObit

2011-12-04 19:05 . 2011-12-04 19:05 -------- d-----w- c:\program files\IObit

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-26 13:33 . 2011-11-26 13:33 31736 ----a-w- c:\windows\system32\drivers\skmscan.sys

2011-11-26 13:33 . 2011-11-26 13:33 131824 ----a-w- c:\windows\system32\sdccoinstaller.dll

2011-11-26 13:32 . 2011-11-26 13:32 22536 ----a-w- c:\windows\system32\drivers\SophosBootDriver.sys

2011-11-02 15:29 . 2011-06-30 20:18 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-14 23:54 . 2011-10-14 23:54 321856 ----a-w- c:\windows\system32\nvStreaming.exe

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2009-03-25 1840424]

"Advanced SystemCare 5"="c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe" [2011-11-12 1647448]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-10 39408]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2008-08-27 6281760]

"Skytel"="Skytel.exe" [2008-08-27 1833504]

"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Sophos\SOPHOS~1\sophos_detoured.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]

@="service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

2005-07-14 13:09 57344 ----a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]

2010-08-20 11:03 33120 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]

2008-01-21 02:25 125952 ----a-w- c:\windows\ehome\ehtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]

2011-12-31 13:19 366024 ----a-w- c:\program files\IncrediMail\bin\IncMail.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA]

2009-03-25 11:30 1840424 ----a-w- c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2011-05-13 14:03 4283256 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sophos AutoUpdate Monitor]

2011-12-23 10:00 900120 ----a-w- c:\program files\Sophos\AutoUpdate\ALMon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

2009-02-10 21:16 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

2008-01-21 02:23 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"WindowsWelcomeCenter"=rundll32.exe oobefldr.dll,ShowWelcomeCenter

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate1c98f818b700589;Google Updateservice (gupdate1c98f818b700589);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-15 133104]

R2 swi_update;Sophos Web Intelligence Update;c:\programdata\Sophos\Web Intelligence\swi_update.exe [2011-12-23 1443864]

R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]

R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]

R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-10-25 36640]

R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-15 133104]

R3 sdcfilter;sdcfilter;c:\windows\system32\DRIVERS\sdcfilter.sys [2011-12-23 33696]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R4 SophosBootDriver;SophosBootDriver;c:\windows\system32\DRIVERS\SophosBootDriver.sys [2011-11-26 22536]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-07-09 436792]

S1 SAVOnAccess;SAVOnAccess;c:\windows\system32\DRIVERS\savonaccess.sys [2011-12-23 123680]

S1 SKMScan;SKMScan;c:\windows\system32\DRIVERS\skmscan.sys [2011-11-26 31736]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]

S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\IObit\Advanced SystemCare 5\ASCService.exe [2011-11-10 490840]

S2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [2011-12-23 212504]

S2 SAVService;Sophos Anti-Virus;c:\program files\Sophos\Sophos Anti-Virus\SavService.exe [2011-12-23 139800]

S2 swi_service;Sophos Web Intelligence Service;c:\program files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [2011-12-23 2790936]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Inhoud van de 'Gedeelde Taken' map

.

2012-01-02 c:\windows\Tasks\GlaryInitialize.job

- c:\program files\Glary Utilities\initialize.exe [2010-06-25 08:01]

.

2012-01-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-15 15:24]

.

2012-01-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-15 15:24]

.

2012-01-02 c:\windows\Tasks\User_Feed_Synchronization-{0C36FFAF-A8C0-449B-9CE5-03524DAC7724}.job

- c:\windows\system32\msfeedssync.exe [2011-12-15 04:44]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.msn.nl/

mStart Page = hxxp://downloads.phpnuke.org/nl/index.php?rvs=google

uInternet Settings,ProxyOverride = localhost

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

LSP: c:\programdata\Sophos\Web Intelligence\swi_ifslsp.dll

TCP: DhcpNameServer = 192.168.0.1

.

- - - - ORPHANS VERWIJDERD - - - -

.

WebBrowser-{2BAE58C2-79F9-45D1-A286-81F911301C3A} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{5B291E6C-9A74-4034-971B-A4B007A0B315} - (no file)

WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)

WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)

WebBrowser-{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - (no file)

WebBrowser-{B9D63C58-90CC-428B-8D3B-CBB88EB07E7E} - (no file)

WebBrowser-{F230D1CD-647F-4856-8538-8C0D39E5ECF2} - (no file)

WebBrowser-{87775FDB-6972-41F9-AE51-8326E38CB206} - (no file)

WebBrowser-{95324E44-4B0A-47A9-8F77-9C6415E51C29} - (no file)

MSConfigStartUp-µTorrent - c:\program files\utorrent\utorrent.exe

AddRemove-{3CB05291-F546-458E-A796-B5BCF5A3CDC4} - c:\program files\InstallShield Installation Information\{3CB05291-F546-458E-A796-B5BCF5A3CDC4}\Setup2.exeiles\InstallShield Installation Information\{3CB05291-F546-458E-A796-B5BCF5A3CDC4}\Setup.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-01-02 17:10

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

.

c:\users\Wim Brusselers\AppData\Roaming\Microsoft\Windows\Cookies\GBFF6M0W.txt 1591 bytes

.

Scan succesvol afgerond

verborgen bestanden: 1

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Voltooingstijd: 2012-01-02 17:16:07

ComboFix-quarantined-files.txt 2012-01-02 16:16

.

Pre-Run: 447.493.967.872 bytes beschikbaar

Post-Run: 447.411.474.432 bytes beschikbaar

.

- - End Of File - - DE554B34F0845DFAE2079C0327F15681

[kape]

Deze map mag je nog verwijderen c:\users\Wim Brusselers\{8813c7a5-f2d2-415c-82c8-679ba3bcfc94}. En hoe is de toestand van de PC nu ?

[brus]

Zal hem vandaag eens testen en laat ik het morgen weten ,tot nu toe is hij in iedergeval niet meer vastgelopen of uitgevallen dus heb goeie hoop

Gr brus

[brus]

tot nu toe geen problemen meer, kijk het nog even af

Gr brus

[kape]

OK, bekijk het maar ... en als je zeker bent van het resultaat, lezen we het hier wel !

[brus]

Het probleem is nu zodra ik hem opstart is er niets aan de hand maar na een poosje wordt hij steeds trager en dan loopt hij weer vast ra ra

[kape]

Mag je zeker dit al doen :

Verwijder Combofix: Start -> Uitvoeren/Zoekopdracht en typ: ComboFix /Uninstall

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Indien aanwezig mag je de map C:\Qoobox manueel verwijderen.

Download CCleaner.

Klik op “Download Latest Version” en dan start de download van CCleaner automatisch en gratis op.

Installeer het en start CCleaner op. Klik in de linkse kolom op “Cleaner”. Klik achtereenvolgens op ‘Analyseren’ en 'Schoonmaken'. Soms is 1 analyse niet voldoende. Deze procedure mag je herhalen tot de analyse geen fouten meer aangeeft. Klik vervolgens in de linkse kolom op “Register” en klik op ‘Scan naar problemen”. Als er fouten gevonden worden klik je op ”Herstel geselecteerde problemen” en ”OK”. Dan krijg je de vraag om een back-up te maken. Klik op “JA”. Kies dan “Herstel alle geselecteerde fouten”. Sluit hierna CCleaner terug af.

Wil je dit uitgebreid in beeld bekijken, klik dan hier voor de handleiding.