[OPGELOST] groot probleem

kape · 26 mei 2009

Download Combofix naar je Bureaublad.

Lees hier meer over correct gebruik van Combofix.

OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download Combofix opnieuw.

Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

Dubbelklik op Combofix.exe om het te starten.
Indien je Combofix al eerder hebt gebruikt, kan je een waarschuwing krijgen dat een update beschikbaar is. Sta toe dat ComboFix wordt geupdate.
Volg de instructies, aanvaard de disclaimer door op Ja te klikken.
Indien de Recovery Console niet geïnstalleerd is, wordt je gevraagd om dit alsnog te doen door op JA te klikken in het "Query - Recovery Console" venster (enkel voor XP, niet voor VISTA).
Klik op OK en Ja om automatisch de Recovery Console te laten installeren.
Klik na afloop terug op Ja om het scannen op malware te starten.
Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

Wanneer de fix voltooid is en na herstart, zal de log Combofix.txt openen.

Post dit logje in je volgende antwoord.

filkill · 26 mei 2009

ComboFix 09-05-25.A2 - Hilde 26/05/2009 18:45.15 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.31.1043.18.1023.566 [GMT 2:00]

Gestart vanuit: c:\documents and settings\Hilde\Bureaublad\ComboFix.exe

AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

FW: BitDefender Firewall *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Hilde\x.exe

H:\Desktop.ini

.

(((((((((((((((((((( Bestanden Gemaakt van 2009-04-26 to 2009-05-26 ))))))))))))))))))))))))))))))

.

2009-05-25 14:49 . 2009-05-25 14:49 -------- d-----w c:\documents and settings\LocalService\Application Data\SACore

2009-05-25 14:49 . 2009-05-25 14:49 -------- d-----w c:\windows\system32\config\systemprofile\Application Data\SACore

2009-05-25 14:49 . 2009-05-25 14:49 -------- d-----w c:\documents and settings\All Users\Application Data\SiteAdvisor

2009-05-25 14:48 . 2009-05-25 14:48 -------- d-----w c:\program files\Common Files\McAfee

2009-05-25 14:48 . 2009-05-25 14:48 -------- d-----w c:\windows\LastGood

2009-05-25 14:47 . 2009-05-25 14:48 -------- d-----w c:\documents and settings\All Users\Application Data\McAfee

2009-05-25 14:47 . 2009-05-25 14:48 -------- d-----w c:\program files\McAfee

2009-05-24 16:41 . 2009-05-24 16:41 -------- d-----w c:\program files\Microsoft Silverlight

2009-05-20 18:33 . 2009-05-26 14:15 -------- d-----w c:\program files\Pokémon - Speel het!

2009-05-19 15:39 . 2009-05-19 15:39 -------- d-----w c:\program files\ExeIco

2009-05-17 10:13 . 2009-05-17 10:13 -------- d-----w c:\program files\Virtual Earth 3D

2009-05-17 09:31 . 2009-05-17 09:31 -------- d-----w c:\program files\Cabri II Plus 1.3

2009-05-17 09:31 . 2009-05-17 09:31 -------- d-----w c:\documents and settings\All Users\Application Data\Reallusion

2009-05-17 09:31 . 2009-05-17 09:31 -------- d-----w c:\program files\Reallusion

2009-05-17 09:20 . 2009-05-17 09:20 -------- d-----w c:\program files\PC Drivers HeadQuarters

2009-05-16 21:01 . 2009-05-17 09:31 -------- d-----w c:\documents and settings\Hilde\Local Settings\Application Data\sabnzbd

2009-05-16 21:01 . 2009-05-17 09:31 -------- d-----w c:\program files\SABnzbd

2009-05-16 12:00 . 2009-05-16 12:00 -------- d-----w c:\documents and settings\All Users\Application Data\LogiShrd

2009-05-16 11:39 . 2007-12-14 14:13 53248 ----a-w c:\windows\system32\LBTCoIns.DLL

2009-05-16 11:38 . 2009-05-16 11:38 10134 ----a-r c:\documents and settings\Hilde\Application Data\Microsoft\Installer\{3101CB58-3482-4D21-AF1A-7057FC935355}\ARPPRODUCTICON.exe

2009-05-16 11:38 . 2009-05-16 11:39 -------- d-----w c:\program files\Common Files\Logishrd

2009-05-16 11:38 . 2009-05-16 11:38 -------- d-----w c:\documents and settings\Hilde\Application Data\InstallShield

2009-05-14 16:05 . 2009-05-26 14:32 -------- d--h--r c:\documents and settings\Hilde\Onlangs geopend

2009-05-13 14:28 . 2009-05-13 15:01 -------- d-----w c:\documents and settings\Hilde\Application Data\vlc

2009-05-13 14:22 . 2009-05-13 14:22 -------- d-----w c:\documents and settings\Hilde\Local Settings\Application Data\Graboid_Inc

2009-05-13 14:22 . 2009-05-13 14:28 -------- d-----w c:\documents and settings\Hilde\Local Settings\Application Data\Graboid

2009-05-13 14:22 . 2009-05-13 14:25 -------- d-----w c:\documents and settings\Hilde\Application Data\MozillaControl

2009-05-13 14:21 . 2009-05-13 14:21 -------- d-----w c:\program files\Mozilla ActiveX Control v1.7.12

2009-05-13 14:20 . 2009-05-13 14:21 -------- d-----w c:\program files\Graboid

2009-05-10 11:23 . 2006-05-03 20:53 174592 ----a-w c:\windows\system32\framedyn.dll

2009-05-10 09:39 . 2009-05-10 09:39 -------- d-----w c:\documents and settings\Hilde\Local Settings\Application Data\Cooliris

2009-05-10 09:39 . 2009-04-17 14:58 954368 ----a-w c:\documents and settings\Hilde\Application Data\Mozilla\Firefox\Profiles\tlgtuz9b.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe

2009-05-10 09:39 . 2009-04-17 14:58 103424 ----a-w c:\documents and settings\Hilde\Application Data\Mozilla\Firefox\Profiles\tlgtuz9b.default\extensions\piclens@cooliris.com\libs\pixomatic.dll

2009-05-10 09:39 . 2009-04-17 14:58 65536 ----a-w c:\documents and settings\Hilde\Application Data\Mozilla\Firefox\Profiles\tlgtuz9b.default\extensions\piclens@cooliris.com\components\coolirisstub.dll

2009-05-10 09:39 . 2009-04-17 14:58 1161626 ----a-w c:\documents and settings\Hilde\Application Data\Mozilla\Firefox\Profiles\tlgtuz9b.default\extensions\piclens@cooliris.com\libs\avcodec-51.dll

2009-05-10 09:39 . 2009-04-17 14:58 71652 ----a-w c:\documents and settings\Hilde\Application Data\Mozilla\Firefox\Profiles\tlgtuz9b.default\extensions\piclens@cooliris.com\libs\avutil-49.dll

2009-05-10 09:39 . 2009-04-17 14:58 4579328 ----a-w c:\documents and settings\Hilde\Application Data\Mozilla\Firefox\Profiles\tlgtuz9b.default\extensions\piclens@cooliris.com\libs\cooliris18.dll

2009-05-10 09:39 . 2009-04-17 14:58 344064 ----a-w c:\documents and settings\Hilde\Application Data\Mozilla\Firefox\Profiles\tlgtuz9b.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe

2009-05-10 09:39 . 2009-04-17 14:58 4534272 ----a-w c:\documents and settings\Hilde\Application Data\Mozilla\Firefox\Profiles\tlgtuz9b.default\extensions\piclens@cooliris.com\libs\cooliris19.dll

2009-05-10 09:39 . 2009-04-17 14:58 131868 ----a-w c:\documents and settings\Hilde\Application Data\Mozilla\Firefox\Profiles\tlgtuz9b.default\extensions\piclens@cooliris.com\libs\avformat-52.dll

2009-05-08 18:03 . 2009-05-08 18:03 -------- d-----w c:\windows\system32\Samsung_USB_Drivers

2009-05-08 18:03 . 2009-05-08 18:03 -------- d-----w c:\program files\DIFX

2009-05-08 18:02 . 2008-12-13 15:15 233472 ----a-w c:\windows\system32\FsUsbExService.Exe

2009-05-08 18:02 . 2008-12-13 15:15 110592 ----a-w c:\windows\system32\FsUsbExDevice.Dll

2009-05-08 18:02 . 2009-05-10 17:53 -------- d-----w c:\documents and settings\Hilde\Application Data\Samsung

2009-05-08 18:01 . 2009-05-08 18:01 -------- d-----w c:\program files\MarkAny

2009-05-08 18:01 . 2009-05-10 11:21 -------- d-----w c:\program files\Samsung

2009-05-08 17:20 . 2004-08-03 21:10 38016 -c--a-w c:\windows\system32\dllcache\bthmodem.sys

2009-05-08 17:20 . 2004-08-03 21:10 38016 ----a-w c:\windows\system32\drivers\bthmodem.sys

2009-05-06 12:31 . 2009-05-06 12:31 603904 ----a-w c:\windows\system32\TUProgSt.exe

2009-05-06 12:31 . 2008-11-24 11:19 27904 ----a-w c:\windows\system32\uxtuneup.dll

2009-05-06 12:31 . 2009-05-06 12:31 362240 ----a-w c:\windows\system32\TuneUpDefragService.exe

2009-05-06 12:29 . 2009-05-06 12:29 -------- d-----w c:\documents and settings\Hilde\Application Data\TuneUp Software

2009-05-06 12:28 . 2009-05-06 12:28 -------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software

2009-05-06 12:28 . 2009-05-06 12:31 -------- d-----w c:\program files\TuneUp Utilities 2009

2009-05-06 12:28 . 2009-05-06 12:28 -------- d-sh--w c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}

2009-05-01 20:51 . 2009-05-14 15:52 -------- d-----w c:\program files\Uniblue

2009-05-01 20:43 . 2009-05-01 20:48 -------- d-----w c:\program files\Common Files\Ahead

2009-04-29 17:47 . 2009-04-29 17:47 -------- d-----w c:\windows\system32\AGEIA

2009-04-29 17:47 . 2009-04-29 17:47 -------- d-----w c:\program files\AGEIA Technologies

2009-04-29 17:41 . 2009-04-29 18:15 -------- d-----w c:\program files\KetnetKick2

2009-04-29 13:17 . 2009-04-29 13:17 -------- d-----w c:\documents and settings\Hilde\Application Data\Move Networks

2009-04-29 13:17 . 2009-02-12 09:41 973312 ----a-w c:\documents and settings\Hilde\Application Data\Mozilla\Firefox\Profiles\tlgtuz9b.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll

2009-04-27 17:05 . 2009-04-27 17:06 -------- d-----w c:\program files\Duke Nukem Manhattan Project

2009-04-26 16:56 . 2009-04-26 16:56 766 ----a-r c:\documents and settings\Hilde\Application Data\Microsoft\Installer\{69FDD4EA-9D68-11D5-8A28-005004D37F93}\CopyofHelp.exe

2009-04-26 16:56 . 2009-04-26 16:56 766 ----a-r c:\documents and settings\Hilde\Application Data\Microsoft\Installer\{69FDD4EA-9D68-11D5-8A28-005004D37F93}\Copy(2)ofweb.exe

2009-04-26 16:56 . 2009-04-26 16:56 2238 ----a-r c:\documents and settings\Hilde\Application Data\Microsoft\Installer\{69FDD4EA-9D68-11D5-8A28-005004D37F93}\wolf3D.exe

2009-04-26 16:56 . 2009-04-26 16:56 -------- d-----w c:\program files\Wolfenstein 3D

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-26 14:33 . 2008-10-26 08:54 -------- d-----w c:\documents and settings\Hilde\Application Data\HPAppData

2009-05-25 19:16 . 2008-06-13 11:08 -------- d-----w c:\program files\Opera

2009-05-25 15:30 . 2008-05-31 10:59 -------- d-----w c:\documents and settings\Hilde\Application Data\uTorrent

2009-05-23 22:09 . 2009-02-06 15:30 81984 ----a-w c:\windows\system32\bdod.bin

2009-05-22 15:19 . 2001-09-07 12:00 93496 ----a-w c:\windows\system32\perfc013.dat

2009-05-22 15:19 . 2001-09-07 12:00 515408 ----a-w c:\windows\system32\perfh013.dat

2009-05-21 15:35 . 2008-06-04 18:39 -------- d-----w c:\documents and settings\Hilde\Application Data\Vso

2009-05-20 18:33 . 2007-12-09 15:25 -------- d--h--w c:\program files\InstallShield Installation Information

2009-05-19 20:04 . 2007-12-07 17:32 -------- d-----w c:\documents and settings\Hilde\Application Data\Ahead

2009-05-19 16:33 . 2007-12-07 18:44 160320 ----a-w c:\documents and settings\Hilde\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-05-17 15:36 . 2008-09-05 18:41 -------- d-----w c:\documents and settings\Hilde\Application Data\Download Manager

2009-05-17 09:31 . 2008-01-20 17:11 -------- d-----w c:\program files\Common Files\Wise Installation Wizard

2009-05-16 12:10 . 2009-04-15 03:04 -------- d-----w c:\program files\Common Files\Logitech

2009-05-16 12:09 . 2009-04-15 03:04 -------- d-----w c:\program files\Logitech

2009-05-14 15:58 . 2008-10-25 10:11 -------- d-----w c:\documents and settings\All Users\Application Data\EPSON

2009-05-14 15:54 . 2009-03-08 19:48 -------- d-----w c:\program files\Image-Line

2009-05-14 15:53 . 2009-02-08 09:52 -------- d-----w c:\program files\Enigma Software Group

2009-05-14 15:51 . 2009-01-07 16:15 -------- d-----w c:\program files\cladDVD.NET 3.5.7

2009-05-14 15:49 . 2008-03-22 18:02 -------- d-----w c:\program files\Ubisoft

2009-05-14 15:49 . 2009-01-01 20:25 -------- d-----w c:\program files\Lavasoft

2009-05-14 15:49 . 2008-02-14 17:40 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

2009-05-14 15:46 . 2009-01-07 13:19 -------- d-----w c:\program files\Any DVD Converter Professional

2009-05-14 15:46 . 2009-01-07 13:19 -------- d-----w c:\documents and settings\Hilde\Application Data\Any DVD Converter Professional

2009-05-14 15:46 . 2008-04-19 18:07 -------- d-----w c:\program files\AviSynth 2.5

2009-05-14 15:43 . 2009-04-26 16:22 -------- d-----w c:\program files\Common Files\AVSMedia

2009-05-14 15:43 . 2009-04-26 16:22 -------- d-----w c:\program files\AVS4YOU

2009-05-14 15:42 . 2009-03-13 19:14 -------- d-----w c:\program files\Cool MP3 Splitter

2009-05-14 15:41 . 2009-03-12 21:01 -------- d-----w c:\program files\IrfanView

2009-05-10 19:22 . 2009-01-10 14:07 -------- d-----w c:\documents and settings\Hilde\Application Data\VMware

2009-05-10 11:31 . 2007-10-25 15:26 5632 ----a-w c:\windows\system32\drivers\StarOpen.sys

2009-05-01 20:43 . 2008-07-19 17:24 -------- d-----w c:\documents and settings\All Users\Application Data\Nero

2009-04-29 17:39 . 2008-03-31 10:08 107888 ----a-w c:\windows\system32\CmdLineExt.dll

2009-04-28 14:38 . 2008-10-17 13:01 104328 ----a-w c:\windows\system32\drivers\bdfndisf.sys

2009-04-26 16:25 . 2009-04-26 16:25 -------- d-----w c:\documents and settings\Hilde\Application Data\AVS4YOU

2009-04-26 16:24 . 2009-04-26 16:24 -------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU

2009-04-24 16:50 . 2007-12-13 14:04 -------- d-----w c:\documents and settings\Hilde\Application Data\LimeWire

2009-04-23 16:16 . 2009-04-16 16:27 -------- d-----w c:\program files\DC++

2009-04-19 16:29 . 2009-04-19 16:29 -------- d-----w c:\program files\DVDFab 5

2009-04-17 18:11 . 2009-04-17 18:11 -------- d-----w c:\program files\IKEA HomePlanner

2009-04-17 09:34 . 2007-12-09 14:33 -------- d-----w c:\program files\Java

2009-04-17 09:32 . 2009-04-17 09:32 152576 ----a-w c:\documents and settings\Hilde\Application Data\Sun\Java\jre1.6.0_13\lzma.dll

2009-04-16 17:18 . 2009-04-16 17:18 -------- d-----w c:\program files\FlashFXP

2009-04-16 17:18 . 2009-04-16 17:18 -------- d-----w c:\documents and settings\All Users\Application Data\FlashFXP

2009-04-15 03:10 . 2009-04-15 03:06 -------- d-----w c:\documents and settings\Hilde\Application Data\Logitech

2009-04-15 03:07 . 2009-04-15 03:07 -------- d-----w c:\documents and settings\LocalService\Application Data\Logitech

2009-04-15 03:06 . 2009-04-15 03:04 -------- d-----w c:\documents and settings\All Users\Application Data\Logitech

2009-04-15 03:03 . 2009-04-15 03:03 -------- d-----w c:\program files\WIDCOMM

2009-04-14 07:25 . 2007-12-08 11:43 512 ----a-w C:\ScanSectorLog.dat

2009-04-04 20:53 . 2007-12-07 20:50 -------- d-----w c:\documents and settings\Hilde\Application Data\Skype

2009-04-04 14:03 . 2007-12-07 20:52 -------- d-----w c:\documents and settings\Hilde\Application Data\skypePM

2009-04-04 12:24 . 2008-05-15 15:23 -------- d-----w c:\documents and settings\Hilde\Application Data\dvdcss

2009-04-02 09:57 . 2009-04-02 09:57 -------- d-----w c:\program files\VoipBuster.com

2009-04-02 09:49 . 2009-04-02 08:25 -------- d-----w c:\program files\FreeCall.com

2009-04-02 09:49 . 2009-04-02 08:32 -------- d-----w c:\documents and settings\Hilde\Application Data\FreeCall

2009-04-01 08:39 . 2007-12-07 17:31 -------- d-----w c:\program files\Nero

2009-04-01 08:33 . 2008-07-19 17:24 -------- d-----w c:\program files\Common Files\Nero

2009-03-31 10:38 . 2009-03-31 10:38 -------- d-----w c:\program files\eRightSoft

2009-03-31 10:11 . 2009-03-31 10:11 -------- d-----w c:\program files\VDOWNLOADER

2009-03-29 19:17 . 2009-03-28 10:36 -------- d-----w c:\program files\CLE

2009-03-29 09:57 . 2007-12-08 15:58 -------- d-----w c:\program files\Common Files\Adobe

2009-03-28 09:51 . 2009-03-28 09:50 34 ----a-w c:\documents and settings\Hilde\jagex_runescape_preferences.dat

2009-03-26 17:04 . 2009-03-26 17:04 2876719 ----a-w c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-03-22 18:27 . 2009-03-22 18:27 208896 ----a-w c:\documents and settings\Hilde\Application Data\SystemRequirementsLab\SRLProxy_srl_4.dll

2009-03-22 18:27 . 2009-03-22 18:27 208896 ----a-w c:\documents and settings\Hilde\Application Data\SystemRequirementsLab\SRLProxy_srl_3.dll

2009-03-22 18:27 . 2009-03-22 18:27 208896 ----a-w c:\documents and settings\Hilde\Application Data\SystemRequirementsLab\SRLProxy_srl_2.dll

2009-03-22 18:27 . 2009-03-22 18:27 208896 ----a-w c:\documents and settings\Hilde\Application Data\SystemRequirementsLab\SRLProxy_srl_1.dll

2009-03-09 03:19 . 2009-02-07 12:21 410984 ----a-w c:\windows\system32\deploytk.dll

2009-04-28 14:38 . 2008-10-30 16:34 49664 ----a-w c:\program files\mozilla firefox\components\FFComm.dll

2008-12-06 11:08 . 2008-12-06 11:08 56 --sh--r c:\windows\system32\724B7C748F.sys

2006-05-03 10:06 . 2009-03-31 10:39 163328 --sh--r c:\windows\system32\flvDX.dll

2007-02-21 11:47 . 2009-03-31 10:39 31232 --sh--r c:\windows\system32\msfDX.dll

2008-03-16 13:30 . 2009-03-31 10:39 216064 --sh--r c:\windows\system32\nbDX.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-04-28 778240]

"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-04-28 69632]

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-04 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-4-15 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2008-05-02 00:42 72208 ----a-w c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2008-05-28 10:32 87352 ------w c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Gamma Loader.lnk]

path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\Adobe Gamma Loader.lnk

backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Telemeter.lnk]

path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\Telemeter.lnk

backup=c:\windows\pss\Telemeter.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"TabletService"=2 (0x2)

"gusvc"=2 (0x2)

"Ati HotKey Poller"=2 (0x2)

"Apple Mobile Device"=2 (0x2)

"aawservice"=2 (0x2)

"WLSetupSvc"=3 (0x3)

"usnjsvc"=3 (0x3)

"StarWindServiceAE"=2 (0x2)

"RCPServer"=2 (0x2)

"PnkBstrA"=2 (0x2)

"Pml Driver HPZ12"=2 (0x2)

"PLFlash DeviceIoControl Service"=2 (0x2)

"ose"=3 (0x3)

"odserv"=3 (0x3)

"NMIndexingService"=3 (0x3)

"Nero BackItUp Scheduler 3"=2 (0x2)

"MDM"=2 (0x2)

"Logitech Easy Synchronization"=2 (0x2)

"LBTServ"=2 (0x2)

"IDriverT"=3 (0x3)

"FLEXnet Licensing Service"=3 (0x3)

"Creative Service for CDROM Access"=2 (0x2)

"btwdins"=2 (0x2)

"Bonjour Service"=2 (0x2)

"avg8wd"=2 (0x2)

"ATI Smart"=2 (0x2)

"Adobe LM Service"=3 (0x3)

"iPod Service"=3 (0x3)

"VSSERV"=2 (0x2)

"VMware NAT Service"=2 (0x2)

"VMnetDHCP"=2 (0x2)

"VMAuthdService"=2 (0x2)

"ufad-ws60"=3 (0x3)

"SureThing Labelflash service"=3 (0x3)

"NMSAccessU"=2 (0x2)

"Nero BackItUp Scheduler 4.0"=2 (0x2)

"MBAMService"=2 (0x2)

"LIVESRV"=2 (0x2)

"LightScribeService"=2 (0x2)

"JavaQuickStarterService"=2 (0x2)

"idsvc"=3 (0x3)

"gupdate1c98c6c4bad6542"=2 (0x2)

"Arrakis3"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Microsoft Games\\Age of Mythology\\aom.exe"=

"c:\\Westwood\\Renegade\\Game.exe"=

"c:\\Program Files\\Remote Control Pro\\RCPServer.exe"=

"c:\\Program Files\\Counter-Strike 1.6 V35\\hl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\VMware\\VMware Workstation\\vmware-authd.exe"=

"c:\\WINDOWS\\system32\\java.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=

"c:\\Program Files\\VoipBuster.com\\VoipBuster\\VoipBuster.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\DC++\\DCPlusPlus.exe"=

"c:\\Program Files\\FlashFXP\\FlashFXP.exe"=

"c:\\Program Files\\KetnetKick2\\Main.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=

"c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"5353:TCP"= 5353:TCP:Adobe CSI CS4

R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [4/09/2008 17:33 82696]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [29/08/2008 17:50 45848]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/02/2009 21:00 179856]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [25/05/2009 16:48 210216]

R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [6/05/2009 14:31 603904]

R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [29/10/2008 0:08 54960]

R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [18/09/2008 12:09 111112]

R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [17/10/2008 15:01 104328]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/02/2009 21:00 15504]

R3 Rcphook;Rcphook;c:\windows\system32\drivers\rcpmini.sys [23/04/2007 11:31 2848]

S2 0184221243262927mcinstcleanup;McAfee Application Installer Cleanup (0184221243262927);c:\docume~1\Hilde\LOCALS~1\Temp\018422~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\Hilde\LOCALS~1\Temp\018422~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]

S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?]

S3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\drivers\a38usb.sys [2/01/2008 16:31 33536]

S3 idrmkl;idrmkl;\??\c:\docume~1\Hilde\LOCALS~1\Temp\idrmkl.sys --> c:\docume~1\Hilde\LOCALS~1\Temp\idrmkl.sys [?]

S3 P0630VID;Creative WebCam Live!;c:\windows\system32\drivers\P0630Vid.sys [31/05/2008 19:15 91830]

S3 XDva032;XDva032;\??\c:\windows\system32\XDva032.sys --> c:\windows\system32\XDva032.sys [?]

S4 Anyplace Control Security;Anyplace Control Security;c:\windows\svcadmin.exe /service --> c:\windows\svcadmin.exe [?]

S4 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [17/07/2008 13:06 118784]

S4 gupdate1c98c6c4bad6542;Google Update Service (gupdate1c98c6c4bad6542);c:\program files\Google\Update\GoogleUpdate.exe [11/02/2009 19:15 133104]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

S4 RCPServer;Remote Control Pro;c:\program files\Remote Control Pro\RCPServer.exe [18/08/2008 18:43 166912]

S4 SureThing Labelflash service;SureThing Labelflash service;c:\program files\Common Files\SureThing Shared\stllssvr.exe [10/01/2009 13:54 74392]

--- Andere Services/Drivers In Geheugen ---

*NewlyCreated* - 4117B95E

*NewlyCreated* - B2124FA6

*NewlyCreated* - MCAFEE_SITEADVISOR_SERVICE

*Deregistered* - 4117b95e

*Deregistered* - b2124fa6

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

bdx REG_MULTI_SZ scan

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

"c:\program files\Common Files\LightScribe\LSRunOnce.exe"

.

Inhoud van de 'Gedeelde Taken' map

2009-05-06 c:\windows\Tasks\1-Click Maintenance.job

- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-04 14:46]

2009-02-13 c:\windows\Tasks\GoogleUpdateTaskMachine.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-11 17:15]

2009-02-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-484763869-1801674531-1003.job

- c:\documents and settings\Hilde\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-28 13:32]

2009-03-26 c:\windows\Tasks\Malwarebytes' Scheduled Update for Hilde.job

- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-02-06 09:19]

.

- - - - ORPHANS VERWIJDERD - - - -

HKLM-Run-Bluetooth Connection Assistant - LBTWIZ.EXE

SafeBoot-procexp90.Sys

.

------- Bijkomende Scan -------

.

uStart Page = Google

mStart Page = hxxp://www.google.com

uInternet Connection Wizard,ShellNext = iexplore

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Verzenden naar &Bluetooth-apparaat... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

LSP: c:\program files\VMware\VMware Workstation\vsocklib.dll

DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game04.zylom.com/activex/zylomgamesplayer.cab

DPF: {C42B23DF-334C-4AD0-9AB4-91FF53D04239} - hxxp://v.netlogstatic.com/v2.05/652//s/m/oz/OzDesktopImporter.cab

FF - ProfilePath - c:\documents and settings\Hilde\Application Data\Mozilla\Firefox\Profiles\tlgtuz9b.default\

FF - prefs.js: browser.startup.homepage - Google

FF - component: c:\documents and settings\Hilde\Application Data\Mozilla\Firefox\Profiles\tlgtuz9b.default\extensions\piclens@cooliris.com\components\coolirisstub.dll

FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll

FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll

FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll

FF - plugin: c:\documents and settings\Hilde\Application Data\Mozilla\Firefox\Profiles\tlgtuz9b.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll

FF - plugin: c:\documents and settings\Hilde\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll

FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll

FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll

FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

---- FIREFOX POLICIES ----

FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.00.13.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2009-05-26 18:51

Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\S-1-5-21-1229272821-484763869-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F656598A-1227-7FB4-726C-D71416DC5402}*]

@Allowed: (Read) (RestrictedCode)

"iafijlppbbdibmpngo"=hex:6a,61,61,66,61,6c,62,66,6d,68,69,63,67,6a,6e,61,65,67,

65,67,00,00

"hadhdpoidklbgglo"=hex:6a,61,62,66,6d,68,6e,6b,67,6c,63,6f,6c,61,6f,65,64,70,

69,61,00,13

"hagjpcijemjmnbeg"=hex:66,61,63,66,67,6c,68,68,6c,65,67,6a,00,d1

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"