partner37

kape · 13 juli 2012

Unzip het programma naar een door u bepaalde locatie.

Windows XP

Klik op mvps.bat en kies voor “uitvoeren” om mvps.bat op te starten (*).

Druk op toets om door te gaan.

Van het bestaande bestand HOSTS op de standaardlocatie C:\windows\system32\drivers\etc wordt een backup gemaakt met de naam HOSTS.MVP

Dan wordt het bestand vervangen door de actuele MVPS Hosts-versie.

(*) Windows Vista en Windows 7 gebruikers moeten rechtsklikken op mvps.bat en kiezen voor ”uitvoeren als administrator” om mvps.bat op te starten.

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Firefox::

FF - ProfilePath - c:\users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kqtonk2o.default\

FF - prefs.js: keyword.URL -

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112059

FF - user.js: extensions.BabylonToolbar_i.babExt -

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar_i.id - ce50de3d0000000000000015af4350b4

FF - user.js: extensions.BabylonToolbar_i.hardId - ce50de3d0000000000000015af4350b4

FF - user.js: extensions.BabylonToolbar_i.instlDay - 15497

FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1717:02

FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar_i.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar_i.tlbrId - base

FF - user.js: extensions.BabylonToolbar_i.instlRef – sst

Sla dit bestand op je bureaublad op als CFScript.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht.

In je logje zijn ook verschillende AV-programma's (of sporen ervan) aanwezig (AVG, Bitdefender, GData, o.m.). Dat is niet meteen een goed idee, want deze durven elkaar wel eens tegenwerken en voor problemen zorgen. Best dat je een keuze maakt en de andere scanners definitief van de PC verwijdert.

Franky.H · 13 juli 2012

Ga bitdefender houden, probeer de andere te verwijderen.

Hierbij de nieuwe logfile:

ComboFix 12-07-13.01 - Frank 13/07/2012 13:04:40.2.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.2045.888 [GMT 2:00]

Gestart vanuit: c:\users\Frank\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Frank\Desktop\CFScript.txt

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

AV: Bitdefender Antivirus *Disabled/Updated* {50909708-FF80-02AF-F814-B28405891E92}

FW: Bitdefender Firewall *Enabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9}

SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Bitdefender Antispyware *Disabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F}

SP: Spybot - Search and Destroy *Enabled/Updated* {1EAF1D03-5480-F3B2-EB14-11F0F5EE2699}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Frank\AppData\Local\Temp\ppcrlui_4352_2

c:\windows\system32\spsys.log

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-06-13 to 2012-07-13 ))))))))))))))))))))))))))))))

.

2012-07-13 11:19 . 2012-07-13 11:20 -------- d-----w- c:\users\Frank\AppData\Local\temp

2012-07-13 11:19 . 2012-07-13 11:19 -------- d-----w- c:\users\IUSR_NMPR\AppData\Local\temp

2012-07-13 11:19 . 2012-07-13 11:19 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-07-13 09:00 . 2012-07-13 09:00 -------- d-----w- c:\users\Frank\AppData\Local\blekkotb_031

2012-07-13 06:44 . 2012-06-13 13:40 2047488 ----a-w- c:\windows\system32\win32k.sys

2012-07-12 14:27 . 2012-07-12 14:27 -------- d-----w- c:\users\Frank\AppData\Roaming\Bitdefender

2012-07-12 14:27 . 2012-07-12 14:29 -------- d-----w- c:\programdata\Bitdefender

2012-07-12 14:24 . 2012-07-12 14:26 -------- d-----w- c:\program files\Bitdefender

2012-07-12 14:24 . 2011-08-16 12:59 360976 ----a-w- c:\windows\system32\drivers\bdfsfltr.sys

2012-07-12 14:24 . 2011-10-27 13:07 340624 ----a-w- c:\windows\system32\drivers\trufos.sys

2012-07-12 14:10 . 2012-07-12 14:10 -------- d-----w- c:\program files\AVG Secure Search

2012-07-12 09:13 . 2012-07-12 09:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-07-12 09:13 . 2012-07-03 11:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-07-12 07:11 . 2012-06-04 15:26 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2012-07-12 07:11 . 2012-06-02 00:04 278528 ----a-w- c:\windows\system32\schannel.dll

2012-07-12 07:11 . 2012-06-02 00:03 204288 ----a-w- c:\windows\system32\ncrypt.dll

2012-07-12 07:11 . 2012-06-05 16:47 708608 ----a-w- c:\program files\Common Files\System\ado\msado15.dll

2012-07-12 07:11 . 2012-06-05 16:47 1401856 ----a-w- c:\windows\system32\msxml6.dll

2012-07-12 07:11 . 2012-06-05 16:47 1248768 ----a-w- c:\windows\system32\msxml3.dll

2012-07-10 15:44 . 2012-07-10 15:44 -------- d-----w- c:\users\Frank\AppData\Roaming\AVG2012

2012-07-10 12:59 . 2012-07-10 12:59 -------- d-----w- c:\users\Frank\AppData\Local\AVG Secure Search

2012-07-10 12:59 . 2012-07-12 14:11 -------- d-----w- c:\programdata\AVG Secure Search

2012-07-10 12:59 . 2012-07-10 15:41 -------- d-----w- c:\program files\Common Files\AVG Secure Search

2012-07-10 12:58 . 2012-07-10 15:40 -------- d-----w- c:\programdata\AVG2012

2012-07-10 12:58 . 2012-07-10 12:58 -------- d-----w- C:\$AVG

2012-07-10 12:58 . 2012-07-10 12:58 -------- d-----w- c:\program files\AVG

2012-07-10 12:57 . 2012-07-13 10:03 -------- d-----w- c:\programdata\MFAData

2012-07-10 12:57 . 2012-07-10 12:57 -------- d--h--w- c:\programdata\Common Files

2012-07-10 06:55 . 2012-07-10 14:37 -------- d-----w- c:\users\Frank\{6de70698-64a4-4d62-890e-5a69342e3560}

2012-07-06 06:42 . 2012-07-06 06:42 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll

2012-07-06 06:42 . 2012-07-06 06:42 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll

2012-07-05 16:01 . 2012-07-05 16:01 -------- d-----w- c:\programdata\BDLogging

2012-07-05 15:59 . 2009-07-14 17:45 445008 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

2012-07-05 15:59 . 2009-07-14 17:45 38480 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

2012-07-05 15:45 . 2012-07-12 14:24 -------- d-----w- c:\program files\Common Files\Bitdefender

2012-07-05 07:19 . 2012-07-12 09:05 -------- d-----w- c:\users\Frank\AppData\Roaming\Malwarebytes

2012-07-05 07:19 . 2012-07-05 07:19 -------- d-----w- c:\programdata\Malwarebytes

2012-07-05 07:10 . 2012-07-05 07:10 -------- d-----w- c:\users\Frank\AppData\Roaming\QuickScan

2012-07-04 13:24 . 2012-07-04 13:24 30416 ----a-w- c:\windows\system32\drivers\GRD.sys

2012-07-04 12:55 . 2012-07-04 12:55 -------- d-----w- c:\windows\system32\BioAPIFFDB

2012-07-04 12:53 . 2012-07-04 12:53 49528 ----a-w- c:\windows\system32\drivers\PktIcpt.sys

2012-07-04 12:49 . 2012-07-05 06:42 -------- d-----w- c:\programdata\G DATA

2012-07-04 12:49 . 2012-07-05 06:42 -------- d-----w- c:\program files\Common Files\G Data

2012-07-04 12:07 . 2012-07-05 06:30 -------- d-----w- c:\users\Frank\AppData\Local\Downloaded Installations

2012-07-04 07:57 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FEA2C79F-5D3F-4F2F-990C-184DBEE9C5F8}\mpengine.dll

2012-07-02 13:05 . 2012-07-02 13:05 -------- d-----w- c:\users\Frank\AppData\Roaming\Anvisoft

2012-07-02 13:05 . 2012-06-18 06:42 22784 ----a-w- c:\windows\system32\drivers\asdrs.sys

2012-07-02 13:05 . 2012-06-18 06:42 16128 ----a-w- c:\windows\system32\drivers\asdrm.sys

2012-07-02 13:04 . 2012-07-02 13:04 -------- d-----w- c:\program files\Anvisoft

2012-07-02 11:32 . 2012-07-02 11:32 -------- d-----w- c:\users\Frank\AppData\Roaming\DriverCure

2012-07-02 11:32 . 2012-07-02 11:32 -------- d-----w- c:\users\Frank\AppData\Roaming\SpeedyPC Software

2012-07-02 11:32 . 2012-07-05 05:51 -------- d-----w- c:\programdata\SpeedyPC Software

2012-07-02 09:44 . 2012-07-02 09:44 388096 ----a-r- c:\users\Frank\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-07-02 09:44 . 2012-07-02 09:44 -------- d-----w- c:\program files\Trend Micro

2012-07-02 08:50 . 2012-07-02 08:52 -------- d-----w- C:\rei

2012-07-02 08:50 . 2012-07-02 08:50 -------- d-----w- c:\program files\Reimage

2012-06-28 13:36 . 2012-06-28 13:36 -------- d-----w- c:\program files\HitmanPro

2012-06-28 13:36 . 2012-07-11 16:24 -------- d-----w- c:\programdata\HitmanPro

2012-06-28 07:26 . 2012-06-28 07:26 -------- d-----w- c:\programdata\Grisoft

2012-06-27 12:37 . 2007-04-24 23:10 20480 ----a-w- c:\windows\system32\V0260Srv.exe

2012-06-27 12:37 . 2007-07-11 13:28 36864 ----a-w- c:\windows\system32\V0260Pin.dll

2012-06-27 12:37 . 2004-07-05 23:00 24576 ----a-w- c:\windows\system32\CtCamPin.crl

2012-06-27 12:37 . 2012-06-27 12:37 -------- d-----w- c:\windows\CtDrvInstall

2012-06-27 10:08 . 2012-06-27 12:06 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2012-06-27 10:07 . 2009-01-25 11:14 15224 ----a-w- c:\windows\system32\sdnclean.exe

2012-06-27 10:07 . 2012-06-27 10:08 -------- d-----w- c:\program files\Spybot - Search & Destroy 2

2012-06-27 05:45 . 2012-06-27 05:45 -------- d-----w- c:\programdata\WindowsSearch

2012-06-27 05:39 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-27 05:39 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll

2012-06-27 05:39 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-27 05:39 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-06-27 05:39 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll

2012-06-27 05:39 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll

2012-06-27 05:39 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll

2012-06-27 05:38 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-27 05:38 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe

2012-06-25 08:12 . 2012-06-25 08:12 -------- d-----w- c:\users\Frank\AppData\Local\Macromedia

2012-06-20 12:54 . 2012-06-20 12:54 -------- d-----w- c:\users\Frank\AppData\Local\Ashisoft

2012-06-20 12:53 . 2012-06-20 12:53 -------- d-----w- c:\users\Frank\AppData\Roaming\Ashisoft

2012-06-20 12:53 . 2012-06-20 12:53 -------- d-----w- c:\program files\Duplicate Finder

2012-06-20 12:21 . 2012-06-20 12:21 -------- d-----w- c:\program files\VisiPics

2012-06-19 13:51 . 2012-06-19 13:51 -------- d-----w- c:\users\Frank\AppData\Local\TomTom

2012-06-19 13:45 . 2012-06-19 13:45 -------- d-----w- c:\program files\TomTom International B.V

2012-06-19 13:45 . 2012-06-19 13:45 -------- d-----w- c:\program files\MyTomTom 3

2012-06-14 07:03 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll

2012-06-14 07:03 . 2012-04-23 16:00 133120 ----a-w- c:\windows\system32\cryptsvc.dll

2012-06-14 07:03 . 2012-04-23 16:00 98304 ----a-w- c:\windows\system32\cryptnet.dll

2012-06-14 07:00 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-07-13 08:10 . 2012-05-30 13:59 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-07-13 08:10 . 2012-05-30 13:59 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-06-08 16:17 . 2012-06-08 16:17 658512 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2012-06-03 10:37 . 2012-06-03 10:37 161792 ----a-w- c:\windows\system32\msls31.dll

2012-06-03 10:36 . 2012-06-03 10:36 86528 ----a-w- c:\windows\system32\iesysprep.dll

2012-06-03 10:36 . 2012-06-03 10:36 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2012-06-03 10:36 . 2012-06-03 10:36 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2012-06-03 10:36 . 2012-06-03 10:36 48640 ----a-w- c:\windows\system32\mshtmler.dll

2012-06-03 10:36 . 2012-06-03 10:36 63488 ----a-w- c:\windows\system32\tdc.ocx

2012-06-03 10:36 . 2012-06-03 10:36 367104 ----a-w- c:\windows\system32\html.iec

2012-06-03 10:36 . 2012-06-03 10:36 74752 ----a-w- c:\windows\system32\iesetup.dll

2012-06-03 10:36 . 2012-06-03 10:36 420864 ----a-w- c:\windows\system32\vbscript.dll

2012-06-03 10:36 . 2012-06-03 10:36 23552 ----a-w- c:\windows\system32\licmgr10.dll

2012-06-03 10:36 . 2012-06-03 10:36 152064 ----a-w- c:\windows\system32\wextract.exe

2012-06-03 10:36 . 2012-06-03 10:36 150528 ----a-w- c:\windows\system32\iexpress.exe

2012-06-03 10:36 . 2012-06-03 10:36 35840 ----a-w- c:\windows\system32\imgutil.dll

2012-06-03 10:36 . 2012-06-03 10:36 11776 ----a-w- c:\windows\system32\mshta.exe

2012-06-03 10:36 . 2012-06-03 10:36 101888 ----a-w- c:\windows\system32\admparse.dll

2012-06-03 10:36 . 2012-06-03 10:36 110592 ----a-w- c:\windows\system32\IEAdvpack.dll

2012-05-30 21:08 . 2011-03-28 16:36 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2012-05-30 09:04 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll

2012-05-30 09:04 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll

2012-05-25 15:43 . 2012-05-25 15:43 623616 ----a-w- c:\windows\system32\localspl.dll

2012-05-25 15:36 . 2012-05-25 15:36 499712 ----a-w- c:\windows\system32\kerberos.dll

2012-05-25 15:33 . 2012-05-25 15:33 1808896 ----a-w- c:\windows\system32\NlsLexicons0046.dll

2012-05-25 15:33 . 2012-05-25 15:33 1793536 ----a-w- c:\windows\system32\NlsLexicons0045.dll

2012-05-25 15:33 . 2012-05-25 15:33 1558016 ----a-w- c:\windows\system32\NlsLexicons0049.dll

2012-05-25 15:33 . 2012-05-25 15:33 1411072 ----a-w- c:\windows\system32\NlsLexicons0047.dll

2012-05-25 15:33 . 2012-05-25 15:33 5499904 ----a-w- c:\windows\system32\NlsLexicons0022.dll

2012-05-25 15:33 . 2012-05-25 15:33 2136064 ----a-w- c:\windows\system32\NlsLexicons0021.dll

2012-05-25 15:33 . 2012-05-25 15:33 1782272 ----a-w- c:\windows\system32\NlsLexicons0039.dll

2012-05-25 15:33 . 2012-05-25 15:33 1236992 ----a-w- c:\windows\system32\NlsLexicons0020.dll

2012-05-25 15:33 . 2012-05-25 15:33 7964672 ----a-w- c:\windows\system32\NlsLexicons0024.dll

2012-05-25 15:33 . 2012-05-25 15:33 6224896 ----a-w- c:\windows\system32\NlsLexicons0027.dll

2012-05-25 15:33 . 2012-05-25 15:33 5791232 ----a-w- c:\windows\system32\NlsLexicons0026.dll

2012-05-25 15:33 . 2012-05-25 15:33 4175872 ----a-w- c:\windows\system32\NlsLexicons0010.dll

2012-05-25 15:33 . 2012-05-25 15:33 4981248 ----a-w- c:\windows\system32\NlsLexicons0013.dll

2012-05-25 15:33 . 2012-05-25 15:33 2466816 ----a-w- c:\windows\system32\NlsLexicons0011.dll

2012-05-25 15:33 . 2012-05-25 15:33 6781440 ----a-w- c:\windows\system32\NlsLexicons0019.dll

2012-05-25 15:33 . 2012-05-25 15:33 3331072 ----a-w- c:\windows\system32\NlsLexicons0018.dll

2012-05-25 15:33 . 2012-05-25 15:33 11722752 ----a-w- c:\windows\system32\NlsLexicons0001.dll

2012-05-25 15:33 . 2012-05-25 15:33 4164096 ----a-w- c:\windows\system32\NlsLexicons0002.dll

2012-05-25 15:33 . 2012-05-25 15:33 1452544 ----a-w- c:\windows\system32\NlsLexicons0003.dll

2012-05-25 15:32 . 2012-05-25 15:32 3419136 ----a-w- c:\windows\system32\NlsLexicons004a.dll

2012-05-25 15:32 . 2012-05-25 15:32 1702912 ----a-w- c:\windows\system32\NlsLexicons004b.dll

2012-05-25 15:32 . 2012-05-25 15:32 4096 ----a-w- c:\windows\system32\NlsLexicons002a.dll

2012-05-25 15:32 . 2012-05-25 15:32 4093440 ----a-w- c:\windows\system32\NlsLexicons004c.dll

2012-05-25 15:32 . 2012-05-25 15:32 4045824 ----a-w- c:\windows\system32\NlsLexicons003e.dll

2012-05-25 15:32 . 2012-05-25 15:32 1972736 ----a-w- c:\windows\system32\NlsLexicons004e.dll

2012-05-25 15:32 . 2012-05-25 15:32 6585856 ----a-w- c:\windows\system32\NlsLexicons001b.dll

2012-05-25 15:32 . 2012-05-25 15:32 6346240 ----a-w- c:\windows\system32\NlsLexicons001d.dll

2012-05-25 15:32 . 2012-05-25 15:32 6014976 ----a-w- c:\windows\system32\NlsLexicons001a.dll

2012-05-25 15:32 . 2012-05-25 15:32 9892864 ----a-w- c:\windows\system32\NlsLexicons000a.dll

2012-05-25 15:32 . 2012-05-25 15:32 6237696 ----a-w- c:\windows\system32\NlsLexicons000c.dll

2012-05-25 15:32 . 2012-05-25 15:32 5654528 ----a-w- c:\windows\system32\NlsLexicons000f.dll

2012-05-25 15:32 . 2012-05-25 15:32 1722368 ----a-w- c:\windows\system32\NlsLexicons000d.dll

2012-05-25 15:32 . 2012-05-25 15:32 5090816 ----a-w- c:\windows\system32\NlsLexicons0416.dll

2012-05-25 15:32 . 2012-05-25 15:32 5031936 ----a-w- c:\windows\system32\NlsLexicons0816.dll

2012-05-25 15:32 . 2012-05-25 15:32 4616192 ----a-w- c:\windows\system32\NlsLexicons0414.dll

2012-05-25 15:32 . 2012-05-25 15:32 7042560 ----a-w- c:\windows\system32\NlsLexicons081a.dll

2012-05-25 15:32 . 2012-05-25 15:32 5071872 ----a-w- c:\windows\system32\NlsModels0011.dll

2012-05-25 15:32 . 2012-05-25 15:32 3104768 ----a-w- c:\windows\system32\NlsData0045.dll

2012-05-25 15:32 . 2012-05-25 15:32 3104768 ----a-w- c:\windows\system32\NlsData0049.dll

2012-05-25 15:32 . 2012-05-25 15:32 3104768 ----a-w- c:\windows\system32\NlsData0047.dll

2012-05-25 15:32 . 2012-05-25 15:32 3104768 ----a-w- c:\windows\system32\NlsData0046.dll

2012-05-25 15:32 . 2012-05-25 15:32 3104768 ----a-w- c:\windows\system32\NlsData0039.dll

2012-05-25 15:32 . 2012-05-25 15:32 3104768 ----a-w- c:\windows\system32\NlsData0020.dll

2012-05-25 15:32 . 2012-05-25 15:32 1965056 ----a-w- c:\windows\system32\NlsData0024.dll

2012-05-25 15:32 . 2012-05-25 15:32 1801216 ----a-w- c:\windows\system32\NlsData0022.dll

2012-05-25 15:32 . 2012-05-25 15:32 1801216 ----a-w- c:\windows\system32\NlsData0021.dll

2012-05-25 15:32 . 2012-05-25 15:32 4495360 ----a-w- c:\windows\system32\NlsData0010.dll

2012-05-25 15:32 . 2012-05-25 15:32 1966592 ----a-w- c:\windows\system32\NlsData0027.dll

2012-05-25 15:32 . 2012-05-25 15:32 1965056 ----a-w- c:\windows\system32\NlsData0026.dll

2012-05-25 15:32 . 2012-05-25 15:32 3466752 ----a-w- c:\windows\system32\NlsData0013.dll

2012-05-25 15:32 . 2012-05-25 15:32 2657280 ----a-w- c:\windows\system32\NlsData0011.dll

2012-05-25 15:32 . 2012-05-25 15:32 1965056 ----a-w- c:\windows\system32\NlsData0018.dll

2012-05-25 15:32 . 2012-05-25 15:32 1523712 ----a-w- c:\windows\system32\NlsData0000.dll

2012-05-25 15:32 . 2012-05-25 15:32 4497408 ----a-w- c:\windows\system32\NlsData0019.dll

2012-05-25 15:32 . 2012-05-25 15:32 2599936 ----a-w- c:\windows\system32\NlsData0001.dll

2012-05-25 15:32 . 2012-05-25 15:32 1965056 ----a-w- c:\windows\system32\NlsData0002.dll

2012-05-25 15:32 . 2012-05-25 15:32 4875776 ----a-w- c:\windows\system32\NlsData0009.dll

2012-05-25 15:32 . 2012-05-25 15:32 2243072 ----a-w- c:\windows\system32\NlsData0007.dll

2012-05-25 15:32 . 2012-05-25 15:32 1965056 ----a-w- c:\windows\system32\NlsData0003.dll

2012-05-25 15:32 . 2012-05-25 15:32 3104768 ----a-w- c:\windows\system32\NlsData004a.dll

2012-05-25 15:32 . 2012-05-25 15:32 3104768 ----a-w- c:\windows\system32\NlsData004e.dll

2012-05-25 15:32 . 2012-05-25 15:32 3104768 ----a-w- c:\windows\system32\NlsData004c.dll

2012-05-25 15:32 . 2012-05-25 15:32 3104768 ----a-w- c:\windows\system32\NlsData004b.dll

2012-05-25 15:32 . 2012-05-25 15:32 1965056 ----a-w- c:\windows\system32\NlsData001b.dll

2012-05-25 15:32 . 2012-05-25 15:32 1965056 ----a-w- c:\windows\system32\NlsData001a.dll

2012-05-25 15:32 . 2012-05-25 15:32 1801216 ----a-w- c:\windows\system32\NlsData003e.dll

2012-05-25 15:32 . 2012-05-25 15:32 1801216 ----a-w- c:\windows\system32\NlsData002a.dll

2012-05-25 15:32 . 2012-05-25 15:32 9847296 ----a-w- c:\windows\system32\NlsData000a.dll

2012-05-25 15:32 . 2012-05-25 15:32 4495360 ----a-w- c:\windows\system32\NlsData001d.dll

2012-05-25 15:32 . 2012-05-25 15:32 2643456 ----a-w- c:\windows\system32\NlsData000c.dll

2012-05-25 15:32 . 2012-05-25 15:32 2342912 ----a-w- c:\windows\system32\NlsData000d.dll

2012-05-25 15:32 . 2012-05-25 15:32 1965056 ----a-w- c:\windows\system32\NlsData000f.dll

2012-05-25 15:32 . 2012-05-25 15:32 4495360 ----a-w- c:\windows\system32\NlsData0414.dll

2012-05-25 15:32 . 2012-05-25 15:32 4495360 ----a-w- c:\windows\system32\NlsData0416.dll

2012-05-25 15:32 . 2012-05-25 15:32 6917120 ----a-w- c:\windows\system32\NlsLexicons0c1a.dll

2012-05-25 15:32 . 2012-05-25 15:32 4495360 ----a-w- c:\windows\system32\NlsData0816.dll

2012-07-06 06:42 . 2012-05-25 12:36 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2012-07-12 14:10 2074208 ----a-w- c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-12 2074208]

.

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox1]

@="{152C96EB-288E-4EDC-B7C6-D21F8250ADF3}"

[HKEY_CLASSES_ROOT\CLSID\{152C96EB-288E-4EDC-B7C6-D21F8250ADF3}]

2012-02-22 11:54 239112 ----a-w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox2]

@="{342DAA0B-D796-460D-8566-901E08A1CCAD}"

[HKEY_CLASSES_ROOT\CLSID\{342DAA0B-D796-460D-8566-901E08A1CCAD}]

2012-02-22 11:54 239112 ----a-w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox3]

@="{57595DAE-1AE1-4D97-A49E-67CBB53B52DF}"

[HKEY_CLASSES_ROOT\CLSID\{57595DAE-1AE1-4D97-A49E-67CBB53B52DF}]

2012-02-22 11:54 239112 ----a-w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox4]

@="{33816773-98AE-4723-ADE0-EBE54C8B5A67}"

[HKEY_CLASSES_ROOT\CLSID\{33816773-98AE-4723-ADE0-EBE54C8B5A67}]

2012-02-22 11:54 239112 ----a-w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2007-08-17 4702208]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-08 178712]

"PlayMovie"="c:\program files\HomeCinema\PlayMovie\PMVService.exe" [2007-09-06 172032]

"TVEService"="c:\program files\HomeCinema\TV Enhance\TVEService.exe" [2007-10-19 155648]

"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]

"NMSSupport"="c:\program files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [2007-06-27 439512]

"CCUTRAYICON"="c:\program files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [2007-06-27 215256]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2012-05-25 220160]

"toolbar_eula_launcher"="c:\program files\GoogleEULA\EULALauncher.exe" [2007-02-09 16896]

"Skytel"="Skytel.exe" [2007-08-03 1826816]

"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-09-12 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-12 8497696]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-12 81920]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]

"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-05-07 1073312]

"Anvi Smart Defender"="c:\program files\Anvisoft\Anvi Smart Defender\ASDTray.exe" [2012-06-25 710912]

"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-07-12 1107552]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]

"BDAgent"="c:\program files\Bitdefender\Bitdefender 2012\bdagent.exe" [2012-03-22 1183616]

.

c:\users\Frank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Schermopname en Snel starten.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36.sys]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro36Crusader]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro36CrusaderBoot]

@=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_TRAY]

2012-04-05 03:12 2587008 ----a-w- c:\program files\AVG\AVG2012\avgtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Garmin Lifetime Updater]

2012-05-23 11:32 1466760 ----a-w- c:\program files\Garmin\Lifetime Updater\GarminLifetime.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2012-05-25 14:38 116648 ----atw- c:\users\Frank\AppData\Local\Google\Update\GoogleUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyTomTomSA.exe]

2012-05-18 09:04 434168 ----a-w- c:\program files\MyTomTom 3\MyTomTomSA.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray]

2012-05-10 14:29 3349488 ----a-w- c:\program files\Spybot - Search & Destroy 2\SDTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]

2009-04-10 21:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spybot-S&D Cleaning]

2012-05-10 14:29 2959336 ----a-w- c:\program files\Spybot - Search & Destroy 2\SDCleaner.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

2012-05-25 12:33 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]

S3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [x]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

Inhoud van de 'Gedeelde Taken' map

.

2012-07-13 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-30 08:10]

.

2012-07-13 c:\windows\Tasks\Check for updates (Spybot - Search & Destroy).job

- c:\program files\Spybot - Search & Destroy 2\SDUpdate.exe [2012-06-27 14:29]

.

2012-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-05-25 14:29]

.

2012-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-05-25 14:29]

.

2012-07-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2162290485-3537841882-386488429-1001Core.job

- c:\users\Frank\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-30 14:38]

.

2012-07-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2162290485-3537841882-386488429-1001UA.job

- c:\users\Frank\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-30 14:38]

.

2012-06-27 c:\windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job

- c:\program files\Spybot - Search & Destroy 2\SDImmunize.exe [2012-06-27 14:29]

.

2012-06-27 c:\windows\Tasks\Scan the system (Spybot - Search & Destroy).job

- c:\program files\Spybot - Search & Destroy 2\SDScan.exe [2012-06-27 14:29]

.

------- Bijkomende Scan -------

.

mSearch Bar = hxxp://www.google.com/ie

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 195.130.130.1 195.130.131.1

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll

FF - ProfilePath - c:\users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kqtonk2o.default\

FF - prefs.js: browser.startup.homepage - HLN.be, Nieuws, sport en showbizz, 24/24, 7/7, meer dan 350 nieuwsupdates per dag

FF - user.js: extensions.BabylonToolbar_i.instlRef - sst

FF - user.js: extentions.y2layers.installId - 0c646adc-9386-4f22-a39a-14201199de22

FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,Buzzdock,

FF - user.js: extensions.autoDisableScopes - 14

FF - user.js: security.csp.enable - false

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-07-13 13:19

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]

"ImagePath"="\??\c:\program files\HomeCinema\PlayMovie\000.fcl"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]

"ImagePath"="\??\c:\program files\HomeCinema\PowerDVD\000.fcl"

.

Voltooingstijd: 2012-07-13 13:23:35

ComboFix-quarantined-files.txt 2012-07-13 11:23

ComboFix2.txt 2012-07-13 07:34

.

Pre-Run: 352.829.976.576 bytes beschikbaar

Post-Run: 352.927.608.832 bytes beschikbaar

.

- - End Of File - - 112DFA487F1DFED91571955847BB6E5C

kape · 13 juli 2012

Verwijder AVG met het speciale Removal Tool.

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Folder::

c:\users\Frank\AppData\Roaming\AVG2012

c:\users\Frank\AppData\Local\AVG Secure Search

c:\programdata\AVG Secure Search

c:\program files\Common Files\AVG Secure Search

c:\programdata\AVG2012

C:\$AVG

c:\program files\AVG

c:\users\Frank\{6de70698-64a4-4d62-890e-5a69342e3560}

c:\programdata\G DATA

c:\program files\Common Files\G Data

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

[-HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

[-HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]

[-HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"vProt"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_TRAY]

Firefox::

FF - ProfilePath - c:\users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kqtonk2o.default\

FF - user.js: extensions.BabylonToolbar_i.instlRef – sst

Sla dit bestand op je bureaublad op als CFScript.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht.

Franky.H · 13 juli 2012

ComboFix 12-07-13.01 - Frank 13/07/2012 14:59:00.3.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.2045.961 [GMT 2:00]