Kan recycler470a1245 niet vinden op externe harde schijf

[Acdafan]

ComboFix 12-01-21.02 - FritsB 22-01-2012 19:10:22.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.8103.5811 [GMT 1:00]

Gestart vanuit: c:\users\FritsB\Desktop\ComboFix.exe

AV: Trend Micro Titanium Internet Security *Enabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}

SP: Trend Micro Titanium Internet Security *Enabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\FullRemove.exe

c:\programdata\Roaming

F:\Autorun.inf

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-12-22 to 2012-01-22 ))))))))))))))))))))))))))))))

.

.

2012-01-22 11:16 . 2011-12-10 14:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-01-22 11:16 . 2012-01-22 11:16 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-01-21 15:25 . 2012-01-21 15:25 -------- d-----w- c:\program files (x86)\Trend Micro

2012-01-21 15:18 . 2012-01-21 15:18 -------- d-----w- c:\programdata\Malwarebytes

2012-01-21 15:14 . 2012-01-21 15:14 -------- d-----w- c:\program files (x86)\Common Files\Java

2012-01-21 15:14 . 2012-01-21 15:14 673688 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2012-01-21 15:14 . 2012-01-21 15:14 586128 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-01-21 15:14 . 2012-01-21 15:14 -------- d-----w- c:\program files (x86)\Java

2012-01-20 21:04 . 2012-01-20 21:04 -------- d-----w- c:\programdata\Sonos

2012-01-20 21:04 . 2012-01-20 21:04 -------- d-----w- c:\program files (x86)\Sonos

2012-01-20 21:01 . 2012-01-20 21:01 -------- d-----w- c:\program files (x86)\Mp3tag

2012-01-16 21:19 . 2012-01-16 21:19 -------- d-----w- c:\program files\Canon

2012-01-16 20:33 . 2012-01-16 20:33 -------- d-----w- c:\program files\Common Files\CANON

2012-01-16 20:29 . 2007-05-14 06:50 151040 ----a-w- c:\windows\system32\CNMN6UI.DLL

2012-01-16 20:29 . 2007-05-14 06:50 251392 ----a-w- c:\windows\system32\CNMN6PPM.DLL

2012-01-16 20:28 . 2012-01-16 21:20 -------- d-----w- c:\program files (x86)\Canon

2012-01-16 18:02 . 2012-01-16 21:00 -------- d-----w- C:\PM Toolbox

2012-01-15 13:14 . 2012-01-15 13:14 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-01-15 13:14 . 2012-01-15 13:14 -------- d-----w- c:\windows\system32\Macromed

2012-01-13 13:52 . 2012-01-13 13:52 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help

2012-01-13 10:35 . 2012-01-13 10:45 -------- d-----w- c:\programdata\VirtualizedApplications

2012-01-11 21:26 . 2012-01-11 21:26 -------- d-----w- c:\programdata\CanonBJ

2012-01-11 21:26 . 2008-10-09 04:00 82944 ----a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPP9D.DLL

2012-01-11 21:26 . 2008-10-09 04:00 27648 ----a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPD9D.DLL

2012-01-11 21:26 . 2012-01-11 21:26 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information

2012-01-11 21:26 . 2008-10-09 04:00 279040 ----a-w- c:\windows\system32\CNMLM9D.DLL

2012-01-11 21:26 . 2009-12-11 12:19 1354240 ----a-w- c:\windows\system32\CNC620C.DLL

2012-01-11 21:26 . 2009-12-11 12:19 92672 ----a-w- c:\windows\system32\CNC620I.DLL

2012-01-11 21:26 . 2009-11-30 15:40 293888 ----a-w- c:\windows\system32\CNC620L.DLL

2012-01-11 21:26 . 2007-03-15 13:13 229888 ----a-w- c:\windows\system32\CNC620O.DLL

2012-01-11 21:15 . 2012-01-11 22:12 -------- d-----w- c:\program files (x86)\Microsoft Application Virtualization Client

2012-01-11 20:55 . 2012-01-11 20:55 -------- d-----w- c:\program files (x86)\Microsoft Synchronization Services

2012-01-11 20:55 . 2012-01-11 20:55 -------- d-----w- c:\program files (x86)\Microsoft Sync Framework

2012-01-11 20:53 . 2012-01-11 20:53 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8

2012-01-11 20:53 . 2012-01-11 20:53 -------- d-----w- c:\program files (x86)\Microsoft Analysis Services

2012-01-11 20:52 . 2012-01-13 13:55 -------- d-----w- c:\programdata\Microsoft Help

2012-01-11 20:52 . 2012-01-11 20:52 -------- d-----r- C:\MSOCache

2012-01-11 11:58 . 2011-10-26 05:25 1572864 ----a-w- c:\windows\system32\quartz.dll

2012-01-11 11:58 . 2011-10-26 05:25 366592 ----a-w- c:\windows\system32\qdvd.dll

2012-01-11 11:58 . 2011-10-26 04:32 514560 ----a-w- c:\windows\SysWow64\qdvd.dll

2012-01-11 11:58 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\SysWow64\quartz.dll

2012-01-11 11:58 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll

2012-01-11 11:58 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll

2012-01-11 11:58 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll

2012-01-11 11:58 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll

2012-01-09 12:45 . 2012-01-09 12:45 -------- d-----r- c:\program files (x86)\Skype

2012-01-09 12:45 . 2012-01-09 12:45 -------- d-----w- c:\programdata\Skype

2012-01-09 11:52 . 2012-01-09 11:52 -------- d-----w- c:\program files (x86)\MSSOAP

2012-01-09 11:52 . 2012-01-09 11:52 -------- d-----w- c:\program files (x86)\Webroot

2012-01-07 17:25 . 2012-01-07 17:25 -------- d-----w- c:\program files\Ext2Fsd

2012-01-07 17:25 . 2011-07-09 00:32 769816 ----a-w- c:\windows\system32\drivers\ext2fsd.sys

2012-01-07 14:13 . 2012-01-07 14:13 -------- d-----w- c:\program files (x86)\MSXML 4.0

2012-01-06 22:08 . 2012-01-06 22:08 -------- d-----w- c:\program files (x86)\Common Files\Nero

2012-01-06 22:07 . 2012-01-06 22:12 -------- d-----w- c:\program files (x86)\Nero

2012-01-06 22:07 . 2012-01-06 22:12 -------- d-----w- c:\programdata\Nero

2012-01-06 22:04 . 2012-01-06 22:04 -------- d-----w- c:\users\Public\CyberLink

2012-01-06 21:38 . 2012-01-11 20:55 -------- d-----w- c:\program files (x86)\Microsoft.NET

2012-01-06 21:36 . 2009-09-04 16:29 1974616 ----a-w- c:\windows\SysWow64\D3DCompiler_42.dll

2012-01-06 21:35 . 2009-09-04 16:29 1892184 ----a-w- c:\windows\SysWow64\D3DX9_42.dll

2012-01-06 21:35 . 2008-10-15 05:22 4379984 ----a-w- c:\windows\SysWow64\D3DX9_40.dll

2012-01-06 21:34 . 2007-07-19 17:14 3727720 ----a-w- c:\windows\SysWow64\d3dx9_35.dll

2012-01-06 21:33 . 2007-05-16 15:45 3497832 ----a-w- c:\windows\SysWow64\d3dx9_34.dll

2012-01-06 19:04 . 2012-01-06 19:04 -------- d-----w- c:\windows\nl

2012-01-06 19:03 . 2012-01-06 19:03 -------- d-----w- c:\windows\en

2012-01-06 19:03 . 2012-01-06 19:03 -------- d-----w- c:\windows\el

2012-01-06 19:03 . 2012-01-06 19:03 -------- d-----w- c:\windows\es

2012-01-06 19:03 . 2012-01-06 19:03 -------- d-----w- c:\windows\fr

2012-01-06 19:03 . 2012-01-06 19:03 -------- d-----w- c:\windows\he

2012-01-06 19:03 . 2012-01-06 19:03 -------- d-----w- c:\windows\it

2012-01-06 19:02 . 2012-01-06 19:02 -------- d-----w- c:\windows\de

2012-01-06 19:02 . 2012-01-06 19:02 -------- d-----w- c:\windows\ru

2012-01-06 19:02 . 2012-01-06 19:02 -------- d-----w- c:\windows\ar

2012-01-06 18:59 . 2012-01-06 18:59 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2012-01-06 18:55 . 2012-01-06 18:55 15712 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\c86346f41cccca401\MeshBetaRemover.exe

2012-01-06 17:53 . 2012-01-06 17:53 -------- d-----w- c:\program files\CCleaner

2012-01-06 17:44 . 2012-01-06 17:44 -------- d-----w- c:\program files (x86)\QuickPar

2012-01-06 06:46 . 2012-01-06 06:46 -------- d-----w- c:\program files (x86)\GrabIt

2012-01-05 21:06 . 2012-01-05 21:06 -------- d-----w- C:\temp

2012-01-05 20:37 . 2012-01-05 20:37 -------- d-----w- c:\windows\SysWow64\Wat

2012-01-05 20:37 . 2012-01-05 20:37 -------- d-----w- c:\windows\system32\Wat

2012-01-01 11:53 . 2011-06-15 10:02 212992 ----a-w- c:\windows\system32\odbctrac.dll

2012-01-01 11:52 . 2011-07-09 02:46 288768 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2012-01-01 11:51 . 2011-06-23 05:43 5561216 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-12-31 15:31 . 2011-12-31 15:31 -------- d-----w- C:\aws

2011-12-31 13:40 . 2011-12-31 13:40 -------- d-----w- c:\programdata\FolderView

2011-12-31 13:40 . 2011-12-31 13:42 -------- d-----w- C:\ASUS.DAT

2011-12-31 13:40 . 2011-12-31 13:41 -------- d-----w- c:\users\FritsB

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-22 16:37 . 2011-10-10 19:13 45056 ----a-w- c:\windows\system32\acovcnt.exe

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]

"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2011-04-13 2018032]

"ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe" [2011-02-23 731472]

"SonicMasterTray"="c:\program files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-10 984400]

"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]

"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]

"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]

"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-23 1601536]

"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

"NBAgent"="c:\program files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2011-04-08 1406248]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-09-30 252296]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-4-13 549040]

FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe [2011-10-10 12862]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-13 135664]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-02 183560]

R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-13 135664]

R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [x]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]

R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-05-02 340240]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [x]

R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [x]

S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-05-26 17536]

S1 Ext2Fsd;Linux ext2 file system driver; [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]

S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]

S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-03-29 598312]

S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-10 2009704]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]

S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [x]

S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]

S2 TurboBoost;Intel® Turbo Boost Technology Monitor;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-04-16 134928]

S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]

S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]

S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

.

.

Inhoud van de 'Gedeelde Taken' map

.

2012-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-13 02:33]

.

2012-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-13 02:33]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

2010-09-02 08:41 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

@="{64174815-8D98-4CE6-8646-4C039977D808}"

[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

2010-09-02 08:41 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2011-10-08 1111568]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-10 167960]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-10 391704]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-10 418328]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-05-17 2226280]

"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 1935120]

"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]

"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-02-10 197152]

"CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 2114376]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x1

"AppInit_DLLs"=c:\windows\System32\nvinitx.dll

.

------- Bijkomende Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.telegraaf.nl/

mStart Page = hxxp://asus.msn.com

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: &Verzenden naar OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: E&xporteren naar Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1 192.168.1.1

.

- - - - ORPHANS VERWIJDERD - - - -

.

Toolbar-Locked - (no file)

Toolbar-Locked - (no file)

HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe

HKLM-Run-Setwallpaper - c:\programdata\SetWallpaper.cmd

.

.

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Voltooingstijd: 2012-01-22 19:15:13

ComboFix-quarantined-files.txt 2012-01-22 18:15

.

Pre-Run: 198.792.822.784 bytes beschikbaar

Post-Run: 200.759.922.688 bytes beschikbaar

.

- - End Of File - - 2B0687973EAEFCFBA29F4E8501547529

[kape]

Je hebt te maken met een USB-infectie. Mogelijk zijn je USB-apparaten dus ook geïnfecteerd.

Download Flash_Disinfector naar je bureaublad.

Indien je tijdens de aanwezigheid van deze infectie USB-apparaten hebt gebruikt, sluit deze dan aan op je pc, zodat de tool deze ook kan desïnfecteren.

Dubbelklik vervolgens op Flash_Disinfector.exe om de tool te starten.

Je bureaublad en icoontjes zullen even verdwijnen. Dit is normaal.

Nadat de tool zijn werk heeft uitgevoerd, herstart je computer.

En laat dan eens weten hoe de toestand nu is ?

[Acdafan]

Beste Kape, ik ben nu niet thuis dus kan het niet proberen. Inmiddels ben ik dankzij u zover dat ik in ieder geval mijn bestanden op de externe harde schijf weer kan benaderen en bewerken. Heb gelijk even een extra backup gemaakt. Tot zover heel hartelijk bedankt. Thuis zal ik Flash Disinfector over mijn schijven halen. Ik laat u weten hoe het afloopt. Vriendelijke groeten, Acdafan

Je hebt te maken met een USB-infectie. Mogelijk zijn je USB-apparaten dus ook geïnfecteerd.

Download Flash_Disinfector naar je bureaublad.

Indien je tijdens de aanwezigheid van deze infectie USB-apparaten hebt gebruikt, sluit deze dan aan op je pc, zodat de tool deze ook kan desïnfecteren.

Dubbelklik vervolgens op Flash_Disinfector.exe om de tool te starten.

Je bureaublad en icoontjes zullen even verdwijnen. Dit is normaal.

Nadat de tool zijn werk heeft uitgevoerd, herstart je computer.

En laat dan eens weten hoe de toestand nu is ?

[Acdafan]

Beste Kape, ik heb geprobeerd Flash_Disinfector te installeren, maar hij start niet op. Ik maak gebruik van Windows 7, dus heb nog gezocht naar een versie voor dit besturingssysteem. Het lukt me echter niet. Zoals ik al zei kanik mijn bestanden op de externe wel weer benaderen. Ik zie dat de oude 'snelstart'icoontjes ook nog bestaan. Kan ik die zonder problemen verwijderen?

[kape]

Het is die worm die ervoor heeft gezorgd dat er snelkoppelingen werden aangemaakt en je eigenlijke mappen werden verborgen.

Ga even naar Start > Zoekopdracht en typ cmd

command prompt zal openen.

Typ het volgende erin en klik enter:

attrib -h -r -s /s /d f:\*.*

Daarna kan je de 'shortcuts' verwijderen.

[Acdafan]

Hij begint steeds met de regel : toegang geweigerd. Is dat erg? En kan het zijn dat dit erg lang duurt?

[kape]

Je topic is "gesloten" ? Wil dit zeggen dat het gelukt is ?

[Acdafan]

Beste Kape, in zoverre is het probleem opgelost dat ik de bestanden weer kan benaderen en bewerken. Het laatste progje is me niet gelukt eroverheen te halen. Ik ben zeer gelukkig dat ik weer bij mijn bestanden kan en wil u heel heel hartelijk danken voor uw fantastische hulp. Weet dat u iemand erg gelukkig heeft gemaakt!!

[kape]

Problemen van de baan, dan is het tijd voor de “grote schoonmaak” : verwijderen van gebruikte programma’s, een cleaning en het verwijderen van de besmette herstelpunten.

Unhide en Flash_Disinfector mag je verwijderen (indien nog aanwezig).

Verwijder Combofix: Start -> Uitvoeren/Zoekopdracht en typ: ComboFix /Uninstall

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Indien aanwezig mag je de map C:\Qoobox manueel verwijderen.

Download CCleaner.

Klik op “Download Latest Version” en dan start de download van CCleaner automatisch en gratis op.

Installeer het en start CCleaner op. Klik in de linkse kolom op “Cleaner”. Klik achtereenvolgens op ‘Analyseren’ en 'Schoonmaken'. Soms is 1 analyse niet voldoende. Deze procedure mag je herhalen tot de analyse geen fouten meer aangeeft. Klik vervolgens in de linkse kolom op “Register” en klik op ‘Scan naar problemen”. Als er fouten gevonden worden klik je op ”Herstel geselecteerde problemen” en ”OK”. Dan krijg je de vraag om een back-up te maken. Klik op “JA”. Kies dan “Herstel alle geselecteerde fouten”. Sluit hierna CCleaner terug af.

Wil je dit uitgebreid in beeld bekijken, klik dan hier voor de handleiding.

Het is aangewezen om de bestaande herstelpunten te verwijderen (daar zitten besmette herstelpunten tussen die je eventueel zou kunnen terugzetten) door systeemherstel tijdelijk uit te schakelen. Doe dit

• via Start -> Configuratiescherm -> Systeem -> Systeembeveiliging -> schakel nu systeemherstel uit door de gewenste schijf te selecteren en op "configureren" te klikken.

• Klik nu op "verwijderen" om alle herstelpunten te verwijderen.

• Klik op "Toepassen" en "OK".

• Herstart nu de PC.

En als dit allemaal probleemloos verlopen is, mag je hieronder - nu definitief - op "markeer als opgelost" tokkelen

26 januari 2012 aangepast door kape