Internet heel traag

Have0 · 23 december 2012

Beste Kape, ik heb beiden in de veilige modus uitgevoerd. Als het goed is hieronder beide logfiles.

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 21:18:13, on 23-12-2012

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Safe mode

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

C:\WINDOWS\system32\ctfmon.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Nieuws | Altijd op de hoogte van het laatste nieuws met Telegraaf.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll

O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

O4 - HKLM\..\Run: [indexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"

O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY

O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x08c5 -f video -m logitech -d 11.0.0.1217 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x08c5 -f video -m logitech -d 11.0.0.1217 (User 'Default user')

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: ABBYY FineReader 9.0 Sprint Licensing Service (ABBYY.Licensing.FineReader.Sprint.9.0) - ABBYY - C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgidsagent.exe

O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgwdsvc.exe

O23 - Service: Alcohol Virtual Drive Auto-mount Service (AxAutoMntSrv) - Alcohol Soft Development Team - C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe

O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe

O23 - Service: Compaq Local Alerter (CPQALERT) - Hewlett-Packard Company - C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe

O23 - Service: cpqdmi - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe

O23 - Service: Compaq DMI Web Agent (cpqWebDmi) - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe

O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe

--

End of file - 5632 bytes

ComboFix 12-12-22.02 - Fam. Haverkamp 23-12-2012 20:59:27.13.1 - x86 MINIMAL

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.2039.1767 [GMT 1:00]

Gestart vanuit: c:\documents and settings\Fam. Haverkamp\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\Fam. Haverkamp\Bureaublad\CFScript.txt

AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-11-23 to 2012-12-23 ))))))))))))))))))))))))))))))

.

2012-12-22 19:16 . 2012-12-23 19:53 -------- dc-h--r- c:\documents and settings\Fam. Haverkamp\Onlangs geopend

2012-12-22 13:39 . 2012-12-22 13:39 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Application Data\DDMSettings

2012-12-21 06:45 . 2012-12-21 06:45 -------- dc----w- c:\documents and settings\Paula\Application Data\AVG2013

2012-12-21 06:44 . 2012-12-21 06:44 -------- dc----w- c:\documents and settings\Paula\Local Settings\Application Data\Avg2013

2012-12-17 18:30 . 2012-12-17 18:30 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Local Settings\Application Data\WinAVI

2012-12-17 18:30 . 2012-12-17 18:30 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Application Data\WinAVI

2012-12-17 18:29 . 2012-12-17 18:29 -------- dc----w- c:\program files\WinAVI

2012-12-16 15:51 . 2012-12-16 16:08 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Application Data\ImgBurn

2012-12-16 15:50 . 2012-12-16 15:50 -------- dc----w- c:\program files\ImgBurn

2012-12-16 15:30 . 2012-12-16 15:42 -------- dc----w- c:\program files\AnyToISO

2012-12-16 10:24 . 2005-06-21 15:49 167936 -c--a-w- c:\windows\system32\igfxres.dll

2012-12-15 16:50 . 2012-12-15 16:50 -------- dc----w- c:\program files\Smart Projects

2012-12-15 15:01 . 2012-12-15 15:01 -------- dc----w- c:\program files\Alcohol Soft

2012-12-15 14:57 . 2012-12-15 14:57 477240 -c--a-w- c:\windows\system32\drivers\sptd.sys

2012-12-14 19:31 . 2012-12-14 19:31 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Application Data\AVG2013

2012-12-14 18:51 . 2012-12-14 18:51 -------- dc----w- c:\windows\system32\config\systemprofile\Application Data\AVG2013

2012-12-14 18:49 . 2012-12-14 18:49 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Application Data\TuneUp Software

2012-12-14 18:33 . 2012-12-14 18:51 -------- dc----w- c:\documents and settings\All Users\Application Data\AVG2013

2012-12-14 18:22 . 2012-12-15 12:26 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Local Settings\Application Data\Avg2013

2012-12-14 18:22 . 2012-12-14 18:22 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Local Settings\Application Data\MFAData

2012-12-09 15:55 . 2012-12-09 15:55 -------- dc----w- c:\program files\MagicISO

2012-12-07 16:13 . 2012-12-07 16:16 -------- dc----w- c:\program files\Common Files\DivX Shared

2012-12-04 17:00 . 2012-03-01 12:32 1775732 -c--a-w- c:\documents and settings\Fam. Haverkamp\E360K_F050_DSP-E360RU-1002.0.BIN

2012-12-03 22:07 . 2012-12-03 22:07 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Application Data\Softonic

2012-12-03 22:06 . 2012-12-03 22:06 -------- dc----w- c:\program files\Softonic

2012-12-03 22:02 . 2012-12-03 22:02 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Application Data\4Free

2012-12-03 20:45 . 2012-12-03 20:45 -------- dc----w- c:\program files\Video Download Converter

2012-12-03 20:44 . 2012-12-03 20:44 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Application Data\VideoDownloadConverter_4z

2012-12-03 20:44 . 2012-12-03 20:44 -------- dc----w- c:\program files\VideoDownloadConverter_4z

2012-12-03 19:07 . 2012-12-07 16:16 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Application Data\DivX

2012-12-03 18:59 . 2012-12-07 16:17 -------- dc----w- c:\program files\DivX

2012-12-03 18:58 . 2012-12-07 16:17 -------- dc----w- c:\documents and settings\All Users\Application Data\DivX

2012-12-02 11:10 . 2012-12-02 11:10 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Application Data\FLVPlayerPackages

2012-12-01 19:11 . 2012-12-03 17:22 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Application Data\.minecraft

2012-12-01 17:56 . 2002-10-30 12:14 274432 -c--a-w- c:\windows\system32\NCTAudioPlayer.dll

2012-12-01 17:56 . 2002-11-15 12:17 892928 -c--a-w- c:\windows\system32\NCTAudioInformation.dll

2012-12-01 17:56 . 2002-11-13 10:14 1703936 -c--a-w- c:\windows\system32\NCTAudioFile.dll

2012-12-01 17:56 . 2002-09-06 10:36 233472 -c--a-w- c:\windows\system32\lame_enc.dll

2012-12-01 17:56 . 2012-12-01 17:58 -------- dc----w- c:\program files\Ace MP3 To WAV Converter

2012-11-25 18:40 . 2012-11-25 18:40 -------- dc----w- c:\documents and settings\Fam. Haverkamp\Application Data\AnvSoft

2012-11-25 18:40 . 2012-11-25 18:40 -------- dc----w- c:\program files\AnvSoft

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-12-16 12:23 . 2008-04-15 12:00 290560 -c--a-w- c:\windows\system32\atmfd.dll

2012-11-21 16:35 . 2012-10-06 10:29 87608 -c--a-w- c:\documents and settings\Fam. Haverkamp\Application Data\inst.exe

2012-11-21 16:35 . 2010-07-06 15:55 47360 -c--a-w- c:\windows\system32\drivers\pcouffin.sys

2012-11-21 16:35 . 2010-07-06 15:55 47360 -c--a-w- c:\documents and settings\Fam. Haverkamp\Application Data\pcouffin.sys

2012-11-19 15:50 . 2012-11-19 15:50 18816 -c--a-w- c:\windows\system32\drivers\dvd43llh.sys

2012-11-13 20:29 . 2012-11-13 20:29 354216 -c--a-w- c:\windows\system32\DivXControlPanelApplet.cpl

2012-11-13 11:55 . 2008-04-15 12:00 1866496 -c--a-w- c:\windows\system32\win32k.sys

2012-11-02 02:03 . 2008-04-15 12:00 375296 -c--a-w- c:\windows\system32\dpnet.dll

2012-11-01 17:08 . 2012-11-01 17:08 1409 -c--a-w- c:\windows\system32\tmpE70C7.FOT

2012-11-01 12:12 . 2008-04-15 12:00 916992 -c--a-w- c:\windows\system32\wininet.dll

2012-11-01 12:12 . 2008-04-15 12:00 43520 -c----w- c:\windows\system32\licmgr10.dll

2012-11-01 12:12 . 2008-04-15 12:00 1469440 -c----w- c:\windows\system32\inetcpl.cpl

2012-11-01 00:35 . 2008-04-15 12:00 385024 -c----w- c:\windows\system32\html.iec

2012-10-31 15:20 . 2012-10-31 15:20 1409 -c--a-w- c:\windows\system32\tmpEBFA2.FOT

2012-10-27 15:53 . 2012-10-27 15:53 1409 -c--a-w- c:\windows\system32\tmp2FDEB.FOT

2012-10-27 08:07 . 2012-10-27 08:07 1409 -c--a-w- c:\windows\system32\tmpEE978.FOT

2012-10-27 07:44 . 2012-10-27 07:44 1409 -c--a-w- c:\windows\system32\tmp16DF2.FOT

2012-10-22 15:44 . 2012-10-22 15:44 1409 -c--a-w- c:\windows\system32\tmpBEAAA.FOT

2012-10-22 15:23 . 2012-10-22 15:23 1409 -c--a-w- c:\windows\system32\tmp61777.FOT

2012-10-22 12:02 . 2011-12-23 11:32 179936 -c--a-w- c:\windows\system32\drivers\avgidsdriverx.sys

2012-10-15 02:48 . 2012-04-19 02:50 55776 -c--a-w- c:\windows\system32\drivers\avgidshx.sys

2012-10-05 02:32 . 2011-08-08 05:08 93536 -c--a-w- c:\windows\system32\drivers\avgmfx86.sys

2012-10-02 18:04 . 2008-04-15 12:00 58368 -c--a-w- c:\windows\system32\synceng.dll

2012-10-02 02:30 . 2011-10-07 05:23 159712 -c--a-w- c:\windows\system32\drivers\avgldx86.sys

2012-09-29 17:54 . 2010-02-17 19:07 22856 -c--a-w- c:\windows\system32\drivers\mbam.sys

2012-12-06 18:38 . 2012-12-06 18:37 262112 -c--a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2012-01-05 75624]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ChkAdmin"="c:\progra~1\Compaq\COMPAQ~1\CHKADMIN.EXE" [2002-08-13 81920]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]

"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-18 57393]

"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-18 40960]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]

"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216]

"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2009-07-08 472112]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-06-21 155648]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-21 126976]

"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-11-06 3143800]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"WUAppSetup"="c:\program files\Common Files\logishrd\WUApp32.exe" [2007-05-11 441120]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Bluetooth Manager.lnk]

path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\Bluetooth Manager.lnk

backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Statusvenster.lnk]

path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\Statusvenster.lnk

backup=c:\windows\pss\Statusvenster.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-07-11 19:00 919008 -c--a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2012-07-31 11:20 38872 -c--a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]

2008-04-15 12:00 110592 -c--a-w- c:\windows\system32\bthprops.cpl

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0]

2005-05-17 16:42 933888 -c----w- c:\program files\Brother\ControlCenter2\brctrcen.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

2008-04-15 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXMediaServer]

2012-11-13 18:13 450560 -c--a-w- c:\program files\DivX\DivX Media Server\DivXMediaServer.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2012-11-30 02:06 1263512 -c--a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dvd43]

2009-10-23 18:34 827904 -c--a-w- c:\program files\dvd43\DVD43_Tray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EEventManager]

2010-10-12 12:56 979328 -c--a-w- c:\program files\EPSON Software\Event Manager\EEventManager.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-11-29 16:38 421888 -c--a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt]

2005-01-26 16:02 49152 -c----w- c:\program files\Brother\Brmfl05a\BrStDvPt.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"vToolbarUpdater"=2 (0x2)

"AdvancedSystemCareService5"=2 (0x2)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Documents and Settings\\Fam. Haverkamp\\Mijn documenten\\Downloads\\solutoinstaller-j7SRa5z2T4.exe"=

"c:\\Documents and Settings\\Fam. Haverkamp\\Mijn documenten\\Downloads\\SweetImSetup.exe"=

"c:\\Documents and Settings\\Fam. Haverkamp\\Mijn documenten\\Downloads\\solutoinstaller-Xc32NqTd17.exe"=

"c:\\Program Files\\EPSON Software\\Event Manager\\EEventManager.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

.

R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [19-4-2012 3:50 55776]

R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [21-9-2012 3:46 177376]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [13-9-2011 6:30 35552]

R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]

S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [23-12-2011 12:32 179936]

S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [23-12-2011 12:32 19936]

S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7-10-2011 6:23 159712]

S1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [11-7-2011 1:14 164832]

S1 ClntMgmt;Compaq Client Management Driver;c:\windows\system32\drivers\Clntmgmt.sys [17-2-2010 10:56 54272]

S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [14-5-2009 17:07 759048]

S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [6-11-2012 19:00 5814392]

S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [22-10-2012 13:05 196664]

S2 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service;c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [5-1-2012 16:42 75624]

S2 cpqWebDmi;Compaq DMI Web Agent;c:\progra~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe [17-2-2010 10:56 24576]

S2 PfFilter;PfFilter;c:\program files\IObit\Protected Folder\pffilter.sys [19-8-2011 19:40 140848]

S3 cpuz135;cpuz135;\??\c:\windows\TEMP\cpuz135\cpuz135_x32.sys --> c:\windows\TEMP\cpuz135\cpuz135_x32.sys [?]

S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\h:\everest ultimate edition 4.60 build 1500\kerneld.wnt --> h:\everest ultimate edition 4.60 build 1500\kerneld.wnt [?]

S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [6-7-2010 16:55 47360]

.

Inhoud van de 'Gedeelde Taken' map

.

2012-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.telegraaf.nl/

mStart Page = hxxp://www.google.com

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: DhcpNameServer = 212.54.40.25 212.54.35.25

FF - ProfilePath - c:\documents and settings\Fam. Haverkamp\Application Data\Mozilla\Firefox\Profiles\75il4gpn.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.telegraaf.nl/

FF - ExtSQL: 2012-12-03 21:45; 4zffxtbr@VideoDownloadConverter_4z.com; c:\program files\VideoDownloadConverter_4z\bar\1.bin

FF - ExtSQL: 2012-12-07 17:16; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF - user.js: extensions.funmoods.hmpg - true

FF - user.js: extensions.funmoods.hmpgUrl - hxxp://searchfunmoods.com/?f=1&a=test331&chnl=test331&cd=2XzuyEtN2Y1L1QzutDtDtD0CyByCtBtAyEtC0D0AtBtCtA0BtN0D0Tzu0CtBzztDtN1L2XzutBtFtCtFtBtFtAtAtC&cr=1826531049

FF - user.js: extensions.funmoods.dfltSrch - true

FF - user.js: extensions.funmoods.srchPrvdr - Search

FF - user.js: extensions.funmoods.dnsErr - true

FF - user.js: extensions.funmoods_i.newTab - true

FF - user.js: extensions.funmoods.newTabUrl - hxxp://searchfunmoods.com/?f=2&a=test331&chnl=test331&cd=2XzuyEtN2Y1L1QzutDtDtD0CyByCtBtAyEtC0D0AtBtCtA0BtN0D0Tzu0CtBzztDtN1L2XzutBtFtCtFtBtFtAtAtC&cr=1826531049

FF - user.js: extensions.funmoods.tlbrSrchUrl - hxxp://searchfunmoods.com/?f=3&a=test331&chnl=test331&cd=2XzuyEtN2Y1L1QzutDtDtD0CyByCtBtAyEtC0D0AtBtCtA0BtN0D0Tzu0CtBzztDtN1L2XzutBtFtCtFtBtFtAtAtC&cr=1826531049&q=

FF - user.js: extensions.funmoods.id - 000C762341DA213B

FF - user.js: extensions.funmoods.instlDay - 15619

FF - user.js: extensions.funmoods.vrsn - 1.5.23.22

FF - user.js: extensions.funmoods.vrsni - 1.5.23.22

FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2213:23

FF - user.js: extensions.funmoods.prtnrId - funmoods

FF - user.js: extensions.funmoods.prdct - funmoods

FF - user.js: extensions.funmoods.aflt - test331

FF - user.js: extensions.funmoods_i.smplGrp - none

FF - user.js: extensions.funmoods.tlbrId - base

FF - user.js: extensions.funmoods.instlRef - test331

FF - user.js: extensions.funmoods.dfltLng -

FF - user.js: extensions.funmoods.excTlbr - false

FF - user.js: extensions.funmoods.autoRvrt - false

FF - user.js: extensions.funmoods.envrmnt - production

FF - user.js: extensions.funmoods.isdcmntcmplt - true

FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0

FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=b03f213b000000000000000c762341da&q=

FF - user.js: extensions.BabylonToolbar.id - b03f213b000000000000000c762341da

FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}

FF - user.js: extensions.BabylonToolbar.instlDay - 15676

FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.3.8

FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.3.8

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.3.812:10

FF - user.js: extensions.BabylonToolbar.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar.tlbrId - irhnew

FF - user.js: extensions.BabylonToolbar.instlRef - sst

FF - user.js: extensions.BabylonToolbar.dfltLng - en

FF - user.js: extensions.BabylonToolbar.excTlbr - false

FF - user.js: extensions.BabylonToolbar.admin - false

FF - user.js: extensions.Softonic.rvrtMsg - Click Yes to keep current home page and default search settings, Click No to restore original settings

FF - user.js: extensions.Softonic.autoRvrt - false

FF - user.js: extensions.Softonic_i.hmpg - true

FF - user.js: extensions.Softonic.hmpgUrl - hxxp://search.softonic.com/INF00047/tb_v1?SearchSource=13&cc=

FF - user.js: extensions.Softonic.hpOld - hxxp://www.telegraaf.nl/

FF - user.js: extensions.Softonic.hpNew - hxxp://search.softonic.com/INF00047/tb_v1?SearchSource=13&cc=

FF - user.js: extensions.Softonic.dfltSrch - true

FF - user.js: extensions.Softonic.srchPrvdr - Search the web (Softonic)

FF - user.js: extensions.Softonic.keyWordUrl - hxxp://search.softonic.com/INF00047/tb_v1?SearchSource=2&cc=&q=

FF - user.js: extensions.Softonic.dspOld -

FF - user.js: extensions.Softonic.dspNew - Search the web (Softonic)

FF - user.js: extensions.Softonic_i.dnsErr - true

FF - user.js: extensions.Softonic_i.newTab - true

FF - user.js: extensions.Softonic.newTabUrl - hxxp://search.softonic.com/INF00047/tb_v1?SearchSource=15&cc=

FF - user.js: extensions.Softonic.tlbrSrchUrl - hxxp://search.softonic.com/INF00047/tb_v1?SearchSource=1&cc=&q=

FF - user.js: extensions.Softonic.id - b03f213b000000000000000c762341da

FF - user.js: extensions.Softonic.instlDay - 15677

FF - user.js: extensions.Softonic.vrsn - 1.6.7.4

FF - user.js: extensions.Softonic.vrsni - 1.6.7.4

FF - user.js: extensions.Softonic_i.vrsnTs - 1.6.7.423:08

FF - user.js: extensions.Softonic.prtnrId - softonic

FF - user.js: extensions.Softonic.prdct - Softonic

FF - user.js: extensions.Softonic.aflt - SD

FF - user.js: extensions.Softonic_i.smplGrp - none

FF - user.js: extensions.Softonic.tlbrId - BASEirobinhoodActive

FF - user.js: extensions.Softonic.instlRef - INF00047

FF - user.js: extensions.Softonic.dfltLng - nl

FF - user.js: extensions.Softonic.excTlbr - false

FF - user.js: extensions.Softonic.admin - false

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-12-23 21:12

Windows 5.1.2600 Service Pack 3 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]

"ImagePath"="\??\h:\everest ultimate edition 4.60 build 1500\kerneld.wnt"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,47,e8,b9,cb,c6,54,bd,4d,8f,86,35,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,47,e8,b9,cb,c6,54,bd,4d,8f,86,35,\

.

[HKEY_USERS\S-1-5-21-1123561945-299502267-1417001333-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1BBBAAD5-B106-1DF8-17B6-3C5537D0C8BC}*]

@Allowed: (Read) (RestrictedCode)

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–}|ÿÿÿÿÀ•}|ù•9~*]

"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'explorer.exe'(828)

c:\windows\system32\msi.dll

.

Voltooingstijd: 2012-12-23 21:16:16

ComboFix-quarantined-files.txt 2012-12-23 20:16

ComboFix2.txt 2012-12-23 10:55

ComboFix3.txt 2012-12-22 11:19

ComboFix4.txt 2012-12-22 09:36

ComboFix5.txt 2012-12-23 19:56

.

Pre-Run: 17.754.263.552 bytes beschikbaar

Post-Run: 17.754.689.536 bytes beschikbaar

.

- - End Of File - - 7AEA9D2B9624DB9EC301085F7BA4324C

kweezie wabbit · 24 december 2012

Helaas nog niet gelukt

Download AdwCleaner by Xplode naar je bureaublad.

Sluit alle openstaande vensters.
Vista en Windows 7 gebruikers: Rechtsklik op AdwCleaner en selecteer als Administrator uitvoeren...
Voor XP: Gewoon dubbelklikken op AdwCleaner.
Klik vervolgens op Verwijderen.
Klik bij AdwCleaner – Informatie op OK
Klik bij AdwCleaner – Herstarten Noodzakelijk op OK

Dat tijdens de actie de snelkoppelingen verdwijnen, is normaal. Nadat de PC opnieuw is opgestart, opent een logfile. Post de inhoud van dit log in je volgende bericht, samen met een nieuw logje van HijackThis en combofix.

Combofix gewoon opstarten, dus niet met scriptje.

Have0 · 26 december 2012

Beste Kweezie Wabbit en Kape,

bedankt voor jullie hulp en tijd. Nog een goede tweede Kerstdag. Hieronder de logfiles. Misschien maakt het niet uit maar ik heb eerst adwcleaner, daarna hijackthis en als laatste combofix een scan laten uitvoeren. Mijn internet reageert wel sneller nu. Ben benieuwd of en wat jullie nog kunnen vinden. Hartelijk dank

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 18:00:13, on 26-12-2012

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\PROGRA~1\AVG\AVG2013\avgrsx.exe

C:\Program Files\AVG\AVG2013\avgcsrvx.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\brsvc01a.exe

C:\WINDOWS\system32\brss01a.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

C:\Program Files\AVG\AVG2013\avgidsagent.exe

C:\Program Files\AVG\AVG2013\avgwdsvc.exe

C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe

C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\AVG\AVG2013\avgnsx.exe

C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe

C:\Program Files\Pure Networks\Network Magic\nmapp.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\AVG\AVG2013\avgui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe