Logfile

• 

  Patries

  29-11-2010 18:41

  Hallo,

  Kan er iemand naar deze log kijken, ik heb al van alles gedaan o.a. gescand met adaware spybot, hijack, ook in veilige modus, probleem blijft bestaan.

  Krijg een virusmelding Win32/Patched

  mvg Patries

  Logfile of HijackThis v1.97.7

  Scan saved at 17:48:17, on 29-11-2010

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\Explorer.EXE

  C:\Documents and Settings\Patries\Mijn documenten\Bestanden oude computer\Patricia\hijackthis\HijackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cartoonnetwork.nl/index_nl.html#

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=NL_NL&c=Q305&bd=presario&pf=desktop

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=NL_NL&c=Q305&bd=presario&pf=desktop

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=NL_NL&c=Q305&bd=presario&pf=desktop

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)

  O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll (file missing)

  O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file)

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

  O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll

  O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: (no name) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O3 - Toolbar: Norton-werkbalk weergeven - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll (file missing)

  O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O4 - HKLM\..\Run: c:\windows\system\hpsysdrv.exe

  O4 - HKLM\..\Run: HDAudPropShortcut.exe

  O4 - HKLM\..\Run: C:\WINDOWS\SMINST\RECGUARD.EXE

  O4 - HKLM\..\Run: C:\WINDOWS\system32\ps2.exe

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: ALCWZRD.EXE

  O4 - HKLM\..\Run: ALCMTR.EXE

  O4 - HKLM\..\Run: C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

  O4 - HKLM\..\Run: KHALMNPR.EXE

  O4 - HKLM\..\Run: mmrtkrnl.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

  O4 - HKLM\..\Run: “C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe” /source=HKLM

  O4 - HKLM\..\Run: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

  O4 - HKLM\..\Run: c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

  O4 - HKLM\..\Run: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” -scheduler

  O4 - HKLM\..\Run: C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Virtual\System\VC8Play.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

  O4 - HKLM\..\Run: “C:\Program Files\Norton Internet Security\osCheck.exe”

  O4 - HKLM\..\Run: C:\Program Files\Wanadoo\NL\Mnu\igomnu.exe /S:T

  O4 - HKLM\..\Run: C:\HP\KBD\KBD.EXE

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start

  O4 - HKLM\..\Run: C:\Program Files\InkSaver\InkSaver.exe hide

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe”

  O4 - HKLM\..\Run: C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon

  O4 - HKLM\..\Run: C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: C:\PROGRA~1\AVG\AVG8\avgtray.exe

  O4 - HKLM\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Winamp\winamp556\Winamp\winampa.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

  O4 - HKLM\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBKeyScan.exe”

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

  O4 - HKCU\..\Run: “C:\Program Files\Microsoft ActiveSync\wcescomm.exe”

  O4 - HKCU\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\NewsBinPro\FTD\FTDv3.8\FTD Watchdog\FtdMonitor.exe”

  O4 - HKCU\..\RunOnce: C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103470 -“Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; (R1 1.5); .NET CLR 1.1.4322; WFX; .NET CLR 2.0.50727; InfoPath.2; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)” -“http://www.cartoonnetwork.nl/show/courage%20the%20cowardly%20dog/games/hal%20van%20afschuw”

  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

  O4 - Global Startup: hp psc 1000 series.lnk = ?

  O4 - Global Startup: hpoddt01.exe.lnk = ?

  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

  O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN

  O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 3.79\AMVConverter\grab.html

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

  O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

  O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

  O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

  O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.79\MediaManager\grab.html

  O9 - Extra button: In weblog opnemen (HKLM)

  O9 - Extra ‘Tools’ menuitem: &In weblog opnemen met Windows Live Writer (HKLM)

  O9 - Extra button: Create Mobile Favorite (HKLM)

  O9 - Extra ‘Tools’ menuitem: Mobiele favorieten maken… (HKLM)

  O9 - Extra button: Crazy Poker (HKLM)

  O9 - Extra button: Research (HKLM)

  O9 - Extra button: Verbindingshelp (HKLM)

  O9 - Extra ‘Tools’ menuitem: Verbindingshelp (HKLM)

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 (HKLM)

  O9 - Extra button: PartyPoker.net (HKLM)

  O9 - Extra ‘Tools’ menuitem: PartyPoker.net (HKLM)

  O9 - Extra button: Messenger (HKLM)

  O9 - Extra ‘Tools’ menuitem: Windows Messenger (HKLM)

  O9 - Extra button: Verbindingshelp (HKCU)

  O9 - Extra ‘Tools’ menuitem: Verbindingshelp (HKCU)

  O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

  O11 - Options group: International

  O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab

  O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

  O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

  O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab

  O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab

  O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

  O16 - DPF: {91F52A42-C10D-49A7-B941-882C657C604F} (Installation Helper Object) - http://kitcentral.wanadoo.nl/download/install/win32/nl/instwact/instwact.dll

  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game12.zylom.com/activex/zylomgamesplayer.cab

  O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install3.0/installer.exe

  O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab

  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab

  O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe

  O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab

  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/aio/nl/check/qdiagh.cab?326

  O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://cache.hyves-static.net/statics/Aurigma/ImageUploader4.cab

  Rapporteren
• 

  Jos H

  29-11-2010 19:38

  Hoi Patries

  Doorloop het stappenplan en plaats daarna de TWEE gevraagde logjes. http://antivirus.startpagina.nl/prikbord/4625317/voer-dit-eerst-uit-voordat-je-de-logjes-plaatst!!#msg-4625317

  Rapporteren
• 

  patries

  30-11-2010 07:38

  Het stappenplan lukt me niet helemaal het downloaden lukt me niet, hij breekt telkens af bij de laatste update.

  En in Java weet ik ook niet goed wat te doen, catch staat er nergens en mijn engels is ook niet al te best.

  De computer heb ik wel de hele nacht gescand in veilige modus maar geen resultaat.

  hierbij de andere log.

  Hoop dat het zo goed is, anders hoor ik het wel weer.

  mvg Patries

  Logfile of HijackThis v1.97.7

  Scan saved at 6:43:51, on 30-11-2010

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\Ati2evxx.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\system32\Ati2evxx.exe

  C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  C:\Program Files\mst software\mst Defrag\mstDfrgS.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBService.exe

  C:\PROGRA~1\AVG\AVG8\avgam.exe

  C:\PROGRA~1\AVG\AVG8\avgrsx.exe

  C:\PROGRA~1\AVG\AVG8\avgnsx.exe

  C:\WINDOWS\system32\IoctlSvc.exe

  C:\WINDOWS\system32\PnkBstrA.exe

  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  C:\WINDOWS\system32\wwSecure.exe

  C:\WINDOWS\system32\msiexec.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\Ati2evxx.exe

  C:\WINDOWS\Explorer.EXE

  C:\windows\system\hpsysdrv.exe

  C:\WINDOWS\SOUNDMAN.EXE

  C:\WINDOWS\ALCWZRD.EXE

  C:\WINDOWS\ALCMTR.EXE

  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe

  C:\WINDOWS\system32\rundll32.exe

  C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

  C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

  C:\Program Files\Common Files\Real\Update_OB\realsched.exe

  C:\HP\KBD\KBD.EXE

  C:\Program Files\Canon\MyPrinter\BJMyPrt.exe

  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

  C:\PROGRA~1\AVG\AVG8\avgtray.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Winamp\winamp556\Winamp\winampa.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\All in one\DAEMON Tools\daemon.exe

  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\FTD\FTD 3.8.5\FTDv3.8\FTD Watchdog\FtdMonitor.exe

  C:\Program Files\Microsoft ActiveSync\wcescomm.exe

  C:\PROGRA~1\MI3AA1~1\rapimgr.exe

  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe

  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

  C:\Program Files\Logitech\SetPoint\KEM.exe

  C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Documents and Settings\Patries\Mijn documenten\Bestanden oude computer\Patricia\hijackthis\HijackThis.exe

  C:\Program Files\AVG\AVG8\avgcsrvx.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=NL_NL&c=Q305&bd=presario&pf=desktop

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=NL_NL&c=Q305&bd=presario&pf=desktop

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=NL_NL&c=Q305&bd=presario&pf=desktop

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=NL_NL&c=Q305&bd=presario&pf=desktop

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=NL_NL&c=Q305&bd=presario&pf=desktop

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo

  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)

  O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll (file missing)

  O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file)

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

  O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll

  O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: (no name) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O3 - Toolbar: Norton-werkbalk weergeven - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll (file missing)

  O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O3 - Toolbar: Sammsoft Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O4 - HKLM\..\Run: c:\windows\system\hpsysdrv.exe

  O4 - HKLM\..\Run: HDAudPropShortcut.exe

  O4 - HKLM\..\Run: C:\WINDOWS\SMINST\RECGUARD.EXE

  O4 - HKLM\..\Run: C:\WINDOWS\system32\ps2.exe

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: ALCWZRD.EXE

  O4 - HKLM\..\Run: ALCMTR.EXE

  O4 - HKLM\..\Run: C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

  O4 - HKLM\..\Run: KHALMNPR.EXE

  O4 - HKLM\..\Run: mmrtkrnl.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

  O4 - HKLM\..\Run: “C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe” /source=HKLM

  O4 - HKLM\..\Run: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

  O4 - HKLM\..\Run: c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

  O4 - HKLM\..\Run: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” -scheduler

  O4 - HKLM\..\Run: C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Virtual\System\VC8Play.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

  O4 - HKLM\..\Run: “C:\Program Files\Norton Internet Security\osCheck.exe”

  O4 - HKLM\..\Run: C:\Program Files\Wanadoo\NL\Mnu\igomnu.exe /S:T

  O4 - HKLM\..\Run: C:\HP\KBD\KBD.EXE

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start

  O4 - HKLM\..\Run: C:\Program Files\InkSaver\InkSaver.exe hide

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe”

  O4 - HKLM\..\Run: C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon

  O4 - HKLM\..\Run: C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: C:\PROGRA~1\AVG\AVG8\avgtray.exe

  O4 - HKLM\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Winamp\winamp556\Winamp\winampa.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

  O4 - HKLM\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBKeyScan.exe”

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKCU\..\Run: “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

  O4 - HKCU\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\All in one\DAEMON Tools\daemon.exe” -autorun

  O4 - HKCU\..\Run: “C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe” /automount

  O4 - HKCU\..\Run: “C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe”

  O4 - HKCU\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\FTD\FTD 3.8.5\FTDv3.8\FTD Watchdog\FtdMonitor.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Microsoft ActiveSync\wcescomm.exe”

  O4 - HKCU\..\Run: C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Ij1.exe

  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

  O4 - Global Startup: hp psc 1000 series.lnk = ?

  O4 - Global Startup: hpoddt01.exe.lnk = ?

  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

  O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

  O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

  O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

  O8 - Extra context menu item: Free YouTube Download - C:\Documents and Settings\Compaq_Eigenaar\Application Data\DVDVideoSoftIEHelpers\youtubedownload.htm

  O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\Compaq_Eigenaar\Application Data\DVDVideoSoftIEHelpers\youtubetomp3.htm

  O9 - Extra button: In weblog opnemen (HKLM)

  O9 - Extra ‘Tools’ menuitem: &In weblog opnemen met Windows Live Writer (HKLM)

  O9 - Extra button: Create Mobile Favorite (HKLM)

  O9 - Extra ‘Tools’ menuitem: Mobiele favorieten maken… (HKLM)

  O9 - Extra button: Crazy Poker (HKLM)

  O9 - Extra button: Research (HKLM)

  O9 - Extra button: Verbindingshelp (HKLM)

  O9 - Extra ‘Tools’ menuitem: Verbindingshelp (HKLM)

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 (HKLM)

  O9 - Extra button: PartyPoker.net (HKLM)

  O9 - Extra ‘Tools’ menuitem: PartyPoker.net (HKLM)

  O9 - Extra button: Messenger (HKLM)

  O9 - Extra ‘Tools’ menuitem: Windows Messenger (HKLM)

  O9 - Extra button: Verbindingshelp (HKCU)

  O9 - Extra ‘Tools’ menuitem: Verbindingshelp (HKCU)

  O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

  O11 - Options group: International

  O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab

  O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

  O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} (System Requirements Lab Class) - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

  O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab

  O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab

  O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

  O16 - DPF: {91F52A42-C10D-49A7-B941-882C657C604F} (Installation Helper Object) - http://kitcentral.wanadoo.nl/download/install/win32/nl/instwact/instwact.dll

  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game12.zylom.com/activex/zylomgamesplayer.cab

  O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install3.0/installer.exe

  O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab

  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab

  O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe

  O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab

  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/aio/nl/check/qdiagh.cab?326

  O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://cache.hyves-static.net/statics/Aurigma/ImageUploader4.cab

  Rapporteren
• 

  fazantje

  30-11-2010 09:14

  Hoi Patries,

  Je schreef o.a.:

  >>>Het stappenplan lukt me niet helemaal het downloaden lukt me niet, hij breekt telkens af bij de laatste update.<<<

  Als het downloaden niet lukt, ga dan ff met een memorystick naar de buren, familie of vrienden en laat daar: MBAM en HijackThis op die stick zetten.

  Mag natuurlijk ook op CD/DVD branden.

  Installeer deze dan op jou computer en laat als eerst MBAM (na eerst te hebben ge-update) draaien.

  Plaats daarna de 2 logjes, die van MBAM en een nieuwe (met de nieuwste versie) logje van HijackThis.

  Daarna zien we verder.

  Succes,

  Huib;)

  

  Rapporteren
• 

  patries

  30-11-2010 09:30

  Twee nieuwe logjes, hoop dat dit goed is.

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 9:20:57, on 30-11-2010

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\Ati2evxx.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\system32\Ati2evxx.exe

  C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  C:\PROGRA~1\AVG\AVG8\avgam.exe

  C:\PROGRA~1\AVG\AVG8\avgrsx.exe

  C:\Program Files\mst software\mst Defrag\mstDfrgS.exe

  C:\PROGRA~1\AVG\AVG8\avgnsx.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBService.exe

  C:\WINDOWS\system32\IoctlSvc.exe

  C:\WINDOWS\system32\PnkBstrA.exe

  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe

  C:\WINDOWS\system32\wwSecure.exe

  C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe

  C:\Program Files\Common Files\Authentium\AntiVirus5\vseqrts.exe

  C:\windows\system\hpsysdrv.exe

  C:\WINDOWS\SOUNDMAN.EXE

  C:\WINDOWS\ALCWZRD.EXE

  C:\WINDOWS\ALCMTR.EXE

  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe

  C:\WINDOWS\system32\rundll32.exe

  C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

  C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

  C:\Program Files\Common Files\Real\Update_OB\realsched.exe

  C:\HP\KBD\KBD.EXE

  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

  C:\Program Files\Canon\MyPrinter\BJMyPrt.exe

  C:\PROGRA~1\AVG\AVG8\avgtray.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Winamp\winamp556\Winamp\winampa.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\NewsBinPro\FTD\FTDv3.8\FTD Watchdog\FtdMonitor.exe

  C:\WINDOWS\system32\msiexec.exe

  C:\Program Files\AVG\AVG8\avgcsrvx.exe

  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe

  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

  C:\Program Files\Logitech\SetPoint\KEM.exe

  C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=NL_NL&c=Q305&bd=presario&pf=desktop

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=NL_NL&c=Q305&bd=presario&pf=desktop

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cartoonnetwork.nl/index_nl.html#

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=NL_NL&c=Q305&bd=presario&pf=desktop

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  R3 - URLSearchHook: (no name) - - (no file)

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)

  O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll (file missing)

  O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file)

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll

  O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O3 - Toolbar: Norton-werkbalk weergeven - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll (file missing)

  O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O3 - Toolbar: Sammsoft Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O4 - HKLM\..\Run: c:\windows\system\hpsysdrv.exe

  O4 - HKLM\..\Run: HDAudPropShortcut.exe

  O4 - HKLM\..\Run: C:\WINDOWS\SMINST\RECGUARD.EXE

  O4 - HKLM\..\Run: C:\WINDOWS\system32\ps2.exe

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: ALCWZRD.EXE

  O4 - HKLM\..\Run: ALCMTR.EXE

  O4 - HKLM\..\Run: C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

  O4 - HKLM\..\Run: KHALMNPR.EXE

  O4 - HKLM\..\Run: mmrtkrnl.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

  O4 - HKLM\..\Run: “C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe” /source=HKLM

  O4 - HKLM\..\Run: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

  O4 - HKLM\..\Run: c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

  O4 - HKLM\..\Run: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” -scheduler

  O4 - HKLM\..\Run: C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Virtual\System\VC8Play.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

  O4 - HKLM\..\Run: “C:\Program Files\Norton Internet Security\osCheck.exe”

  O4 - HKLM\..\Run: C:\Program Files\Wanadoo\NL\Mnu\igomnu.exe /S:T

  O4 - HKLM\..\Run: C:\HP\KBD\KBD.EXE

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start

  O4 - HKLM\..\Run: C:\Program Files\InkSaver\InkSaver.exe hide

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe”

  O4 - HKLM\..\Run: C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon

  O4 - HKLM\..\Run: C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: C:\PROGRA~1\AVG\AVG8\avgtray.exe

  O4 - HKLM\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Winamp\winamp556\Winamp\winampa.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

  O4 - HKLM\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBKeyScan.exe”

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

  O4 - HKCU\..\Run: “C:\Program Files\Microsoft ActiveSync\wcescomm.exe”

  O4 - HKCU\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\NewsBinPro\FTD\FTDv3.8\FTD Watchdog\FtdMonitor.exe”

  O4 - HKCU\..\Run: C:\Program Files\Advanced Registry Optimizer\aro.exe -rem

  O4 - HKCU\..\RunOnce: C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103470 -“Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; (R1 1.5); .NET CLR 1.1.4322; WFX; .NET CLR 2.0.50727; InfoPath.2; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)” -“http://www.cartoonnetwork.nl/show/courage%20the%20cowardly%20dog/games/hal%20van%20afschuw”

  O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Lokale service’)

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Netwerkservice’)

  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

  O4 - Global Startup: hp psc 1000 series.lnk = ?

  O4 - Global Startup: hpoddt01.exe.lnk = ?

  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

  O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN

  O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 3.79\AMVConverter\grab.html

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

  O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

  O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

  O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

  O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.79\MediaManager\grab.html

  O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra ‘Tools’ menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

  O9 - Extra ‘Tools’ menuitem: Mobiele favorieten maken… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

  O9 - Extra button: Crazy Poker - {8A8A3162-B5FA-4c54-A862-4E62CBE8A255} - C:\Program Files\crazyvegasMPP\MPPoker.exe

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

  O9 - Extra button: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

  O9 - Extra ‘Tools’ menuitem: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Games\PartyPokerNet\RunPF.exe (file missing)

  O9 - Extra ‘Tools’ menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Games\PartyPokerNet\RunPF.exe (file missing)

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra button: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)

  O9 - Extra ‘Tools’ menuitem: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)

  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab

  O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

  O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab

  O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab

  O16 - DPF: {91F52A42-C10D-49A7-B941-882C657C604F} (Installation Helper Object) - http://kitcentral.wanadoo.nl/download/install/win32/nl/instwact/instwact.dll

  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game12.zylom.com/activex/zylomgamesplayer.cab

  O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install3.0/installer.exe

  O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab

  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab

  O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe

  O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab

  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/aio/nl/check/qdiagh.cab?326

  O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://cache.hyves-static.net/statics/Aurigma/ImageUploader4.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

  O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

  O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

  O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

  O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

  O23 - Service: COM Host (comHost) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (file missing)

  O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Magix Music Maker Pro 15\Common\Database\bin\fbserver.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

  O23 - Service: Wachtwoordvalidatie voor Symantec IS (ISPwdSvc) - Unknown owner - C:\Program Files\Norton Internet Security\isPwdSvc.exe (file missing)

  O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)

  O23 - Service: mst Defrag Service (mstDfrgS) - mst software, Martin Stiemerling, Germany - C:\Program Files\mst software\mst Defrag\mstDfrgS.exe

  O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)

  O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBService.exe

  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

  O23 - Service: ODBC service - Unknown owner - C:\WINDOWS\system32\odbc.exe (file missing)

  O23 - Service: Planner voor Automatische LiveUpdate - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

  O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

  O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)

  O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe (file missing)

  O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

  O23 - Service: Virtual CD v8 Management Service (VC8SecS) - Unknown owner - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Virtual\System\VC8SecS.exe (file missing)

  O23 - Service: vseamps - Authentium, Inc - C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe

  O23 - Service: vsedsps - Authentium, Inc - C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe

  O23 - Service: vseqrts - Authentium, Inc - C:\Program Files\Common Files\Authentium\AntiVirus5\vseqrts.exe

  O23 - Service: Washer AutoComplete (wwSecSvc) - Unknown owner - C:\WINDOWS\system32\wwSecure.exe

  –

  End of file - 21871 bytes

  En die van MBAM

  Malwarebytes' Anti-Malware 1.46

  www.malwarebytes.org

  Databaseversie: 5216

  Windows 5.1.2600 Service Pack 3

  Internet Explorer 8.0.6001.18702

  30-11-2010 8:48:05

  mbam-log-2010-11-30 (08-48-05).txt

  Scantype: Snelle scan

  Objecten gescand: 193189

  Verstreken tijd: 22 minuut/minuten, 54 seconde(n)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 1

  Registersleutels geïnfecteerd: 9

  Registerwaarden geïnfecteerd: 0

  Registerdata geïnfecteerd: 2

  Mappen geïnfecteerd: 0

  Bestanden geïnfecteerd: 20

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen geïnfecteerd:

  c:\WINDOWS\system32\sshnas21.dll (Trojan.FraudPack.Gen) -> Delete on reboot.

  Registersleutels geïnfecteerd:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sshnas (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4d1c4e81-a32a-416b-bcdb-33b3ef3617d3} (Adware.Need2Find) -> Quarantined and deleted successfully.

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f919fbd3-a96b-4679-af26-f551439bb5fd} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5b4c3b43-49b6-42a7-a602-f7acdca0d409} (Adware.OneStepSearch) -> Quarantined and deleted successfully.

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.

  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_ONESTEP_SEARCH_SERVICE (Adware.OneStepSearch) -> Quarantined and deleted successfully.

  Registerwaarden geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registerdata geïnfecteerd:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

  Mappen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Bestanden geïnfecteerd:

  c:\WINDOWS\system32\sshnas21.dll (Trojan.FraudPack.Gen) -> Delete on reboot.

  C:\Documents and Settings\Compaq_Eigenaar\Local Settings\Temp\Ij0.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Documents and Settings\Compaq_Eigenaar\Local Settings\Temp\Ij2.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Documents and Settings\Compaq_Eigenaar\Local Settings\Temp\Ij4.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Documents and Settings\Compaq_Eigenaar\Local Settings\Temp\Ij5.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Documents and Settings\Compaq_Eigenaar\Local Settings\Temp\Ij6.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Documents and Settings\Compaq_Eigenaar\Local Settings\Temp\Ij8.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Documents and Settings\Compaq_Eigenaar\Local Settings\Temp\Ij9.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Documents and Settings\Compaq_Eigenaar\Local Settings\Temp\Ika.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Documents and Settings\Compaq_Eigenaar\Local Settings\Temp\Ij1.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Documents and Settings\Compaq_Eigenaar\Local Settings\Temporary Internet Files\Content.IE5\C723LGNE\WM9Codecs.11.45223.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Documents and Settings\Compaq_Eigenaar\Local Settings\Temporary Internet Files\Content.IE5\KMEY0ZUF\loads.pl (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

  C:\WINDOWS\Ilaqua.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\WINDOWS\system32\drivers\etc\smss.exe (Trojan.Agent) -> Quarantined and deleted successfully.

  C:\WINDOWS\system32\drivers\services.exe (Trojan.Agent) -> Quarantined and deleted successfully.

  C:\Documents and Settings\Compaq_Eigenaar\Local Settings\Temp\sshnas21.dll (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Documents and Settings\Compaq_Eigenaar\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> Quarantined and deleted successfully.

  C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\WINDOWS\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job (Trojan.FakeAlert) -> Quarantined and deleted successfully.

  C:\WINDOWS\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

  Rapporteren
• 

  fazantje

  30-11-2010 10:12

  Hoi Patries,

  Hoe kan het dan nu binnen 16 minuten wel alles kan, terwijl je om 7.38 uur nog schreef dat het downloaden niet lukte:S

  Heb je jou computer opnieuw opgestart:S, zo niet, doe dit eerst voordat je verder gaat!

  Verwijder Ask.com en need2find vanuit jou software.

  Verwijder ook de toolbars: Sammsoft Toolbar - Windows Live Toolbar en Toolbar: Easy-WebPrint

  Wat is jou scanner:S

  Ik zie AVG8, Norton en ook nog exe's van Avast.

  Verder schreef je o.a.:

  >>>gescand met adaware spybot<<<

  Dit zie ik niet terug in de logjes:S:S

  Start HijackThis en klik op “Do a scan only” en vink de volgende regels aan:

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

  R3 - URLSearchHook: (no name) - - (no file)

  O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file)

  O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O3 - Toolbar: Norton-werkbalk weergeven - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll (file missing)

  O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O3 - Toolbar: Sammsoft Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O4 - Global Startup: hp psc 1000 series.lnk = ?

  O4 - Global Startup: hpoddt01.exe.lnk = ?

  O4 - HKCU\..\RunOnce: C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103470 -“Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; (R1 1.5); .NET CLR 1.1.4322; WFX; .NET CLR 2.0.50727; InfoPath.2; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)” -";

  O8 - Extra context menu item: &Search -

  O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) -

  Sluit alle vensters, behalve HijackThis en klik op fix checked.

  Start je computer opnieuw op, geef even antwoord op mijn vragen en plaats 2 nieuwe logjes. (van MBAM en HijackThis)

  Succes,

  Huib;)

  

  Rapporteren
• 

  patries

  30-11-2010 12:29

  Ik had de verkeerde download aangeklikt, die werkte dus niet, foutje van mij.

  De scanner die we hebben is avg8

  Hier is de nieuwe log van mbam

  Malwarebytes' Anti-Malware 1.46

  www.malwarebytes.org

  Databaseversie: 5216

  Windows 5.1.2600 Service Pack 3

  Internet Explorer 8.0.6001.18702

  30-11-2010 11:53:13

  mbam-log-2010-11-30 (11-53-13).txt

  Scantype: Snelle scan

  Objecten gescand: 192558

  Verstreken tijd: 20 minuut/minuten, 41 seconde(n)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 0

  Registersleutels geïnfecteerd: 0

  Registerwaarden geïnfecteerd: 0

  Registerdata geïnfecteerd: 0

  Mappen geïnfecteerd: 0

  Bestanden geïnfecteerd: 0

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registerwaarden geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registerdata geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Mappen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Bestanden geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Hijack log

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 12:25:30, on 30-11-2010

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\Ati2evxx.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\system32\Ati2evxx.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  C:\PROGRA~1\AVG\AVG8\avgam.exe

  C:\PROGRA~1\AVG\AVG8\avgrsx.exe

  C:\PROGRA~1\AVG\AVG8\avgnsx.exe

  C:\Program Files\mst software\mst Defrag\mstDfrgS.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBService.exe

  C:\WINDOWS\system32\IoctlSvc.exe

  C:\WINDOWS\system32\PnkBstrA.exe

  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe

  C:\WINDOWS\system32\wwSecure.exe

  C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe

  C:\Program Files\Common Files\Authentium\AntiVirus5\vseqrts.exe

  C:\windows\system\hpsysdrv.exe

  C:\WINDOWS\SOUNDMAN.EXE

  C:\WINDOWS\ALCWZRD.EXE

  C:\WINDOWS\ALCMTR.EXE

  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe

  C:\WINDOWS\system32\rundll32.exe

  C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

  C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

  C:\Program Files\Common Files\Real\Update_OB\realsched.exe

  C:\HP\KBD\KBD.EXE

  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

  C:\Program Files\Canon\MyPrinter\BJMyPrt.exe

  C:\PROGRA~1\AVG\AVG8\avgtray.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Winamp\winamp556\Winamp\winampa.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\NewsBinPro\FTD\FTDv3.8\FTD Watchdog\FtdMonitor.exe

  C:\Program Files\Logitech\SetPoint\KEM.exe

  C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\AVG\AVG8\avgcsrvx.exe

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\AVG\AVG8\avgscanx.exe

  C:\Program Files\AVG\AVG8\avgcsrvx.exe

  C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

  C:\WINDOWS\system32\svchost.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cartoonnetwork.nl/index_nl.html#

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=NL_NL&c=Q305&bd=presario&pf=desktop

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)

  O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll (file missing)

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O4 - HKLM\..\Run: c:\windows\system\hpsysdrv.exe

  O4 - HKLM\..\Run: HDAudPropShortcut.exe

  O4 - HKLM\..\Run: C:\WINDOWS\SMINST\RECGUARD.EXE

  O4 - HKLM\..\Run: C:\WINDOWS\system32\ps2.exe

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: ALCWZRD.EXE

  O4 - HKLM\..\Run: ALCMTR.EXE

  O4 - HKLM\..\Run: C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

  O4 - HKLM\..\Run: KHALMNPR.EXE

  O4 - HKLM\..\Run: mmrtkrnl.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

  O4 - HKLM\..\Run: “C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe” /source=HKLM

  O4 - HKLM\..\Run: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

  O4 - HKLM\..\Run: c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

  O4 - HKLM\..\Run: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” -scheduler

  O4 - HKLM\..\Run: C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Virtual\System\VC8Play.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

  O4 - HKLM\..\Run: “C:\Program Files\Norton Internet Security\osCheck.exe”

  O4 - HKLM\..\Run: C:\Program Files\Wanadoo\NL\Mnu\igomnu.exe /S:T

  O4 - HKLM\..\Run: C:\HP\KBD\KBD.EXE

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start

  O4 - HKLM\..\Run: C:\Program Files\InkSaver\InkSaver.exe hide

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe”

  O4 - HKLM\..\Run: C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon

  O4 - HKLM\..\Run: C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: C:\PROGRA~1\AVG\AVG8\avgtray.exe

  O4 - HKLM\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Winamp\winamp556\Winamp\winampa.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

  O4 - HKLM\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBKeyScan.exe”

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

  O4 - HKCU\..\Run: “C:\Program Files\Microsoft ActiveSync\wcescomm.exe”

  O4 - HKCU\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\NewsBinPro\FTD\FTDv3.8\FTD Watchdog\FtdMonitor.exe”

  O4 - HKCU\..\Run: C:\Program Files\Advanced Registry Optimizer\aro.exe -rem

  O4 - HKCU\..\RunOnce: C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103470 -“Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; (R1 1.5); .NET CLR 1.1.4322; WFX; .NET CLR 2.0.50727; InfoPath.2; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)” -“http://www.cartoonnetwork.nl/show/courage%20the%20cowardly%20dog/games/hal%20van%20afschuw”

  O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Lokale service’)

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Netwerkservice’)

  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

  O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 3.79\AMVConverter\grab.html

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.79\MediaManager\grab.html

  O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra ‘Tools’ menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

  O9 - Extra ‘Tools’ menuitem: Mobiele favorieten maken… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

  O9 - Extra button: Crazy Poker - {8A8A3162-B5FA-4c54-A862-4E62CBE8A255} - C:\Program Files\crazyvegasMPP\MPPoker.exe

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

  O9 - Extra button: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

  O9 - Extra ‘Tools’ menuitem: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Games\PartyPokerNet\RunPF.exe (file missing)

  O9 - Extra ‘Tools’ menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Games\PartyPokerNet\RunPF.exe (file missing)

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra button: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)

  O9 - Extra ‘Tools’ menuitem: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)

  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab

  O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

  O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab

  O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab

  O16 - DPF: {91F52A42-C10D-49A7-B941-882C657C604F} (Installation Helper Object) - http://kitcentral.wanadoo.nl/download/install/win32/nl/instwact/instwact.dll

  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game12.zylom.com/activex/zylomgamesplayer.cab

  O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install3.0/installer.exe

  O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab

  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab

  O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab

  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/aio/nl/check/qdiagh.cab?326

  O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://cache.hyves-static.net/statics/Aurigma/ImageUploader4.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

  O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

  O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

  O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

  O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

  O23 - Service: COM Host (comHost) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (file missing)

  O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Magix Music Maker Pro 15\Common\Database\bin\fbserver.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

  O23 - Service: Wachtwoordvalidatie voor Symantec IS (ISPwdSvc) - Unknown owner - C:\Program Files\Norton Internet Security\isPwdSvc.exe (file missing)

  O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)

  O23 - Service: mst Defrag Service (mstDfrgS) - mst software, Martin Stiemerling, Germany - C:\Program Files\mst software\mst Defrag\mstDfrgS.exe

  O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)

  O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBService.exe

  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

  O23 - Service: ODBC service - Unknown owner - C:\WINDOWS\system32\odbc.exe (file missing)

  O23 - Service: Planner voor Automatische LiveUpdate - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

  O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

  O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)

  O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe (file missing)

  O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

  O23 - Service: Virtual CD v8 Management Service (VC8SecS) - Unknown owner - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Virtual\System\VC8SecS.exe (file missing)

  O23 - Service: vseamps - Authentium, Inc - C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe

  O23 - Service: vsedsps - Authentium, Inc - C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe

  O23 - Service: vseqrts - Authentium, Inc - C:\Program Files\Common Files\Authentium\AntiVirus5\vseqrts.exe

  O23 - Service: Washer AutoComplete (wwSecSvc) - Unknown owner - C:\WINDOWS\system32\wwSecure.exe

  –

  End of file - 19676 bytes

  mvg Patries

  Rapporteren
• 

  fazantje

  30-11-2010 12:43

  Hoi Patries,

  Dus je hebt niets van Norton.

  Ga naar: C - configuratiescherm - software en verwijder alles van Norton/Symantec.

  Als hier ook nog wat van Avast staat, dan ook verwijderen.

  Start HijackThis en klik op “Do a scan only” en vink de volgende regels aan:

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

  O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll (file missing)

  O4 - HKCU\..\RunOnce: C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103470 -“Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; (R1 1.5); .NET CLR 1.1.4322; WFX; .NET CLR 2.0.50727; InfoPath.2; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)” -";

  O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} -

  O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

  O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

  O23 - Service: COM Host (comHost) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (file missing)

  O23 - Service: Wachtwoordvalidatie voor Symantec IS (ISPwdSvc) - Unknown owner - C:\Program Files\Norton Internet Security\isPwdSvc.exe (file missing)

  O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)

  O23 - Service: Planner voor Automatische LiveUpdate - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

  O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)

  O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe (file missing)

  O23 - Service: vseamps - Authentium, Inc - C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe

  O23 - Service: vsedsps - Authentium, Inc - C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe

  O23 - Service: vseqrts - Authentium, Inc - C:\Program Files\Common Files\Authentium\AntiVirus5\vseqrts.exe

  O23 - Service: Washer AutoComplete (wwSecSvc) - Unknown owner - C:\WINDOWS\system32\wwSecure.exe

  Sluit alle vensters, behalve HijackThis en klik op fix checked.

  Start computer opnieuw op en plaats een nieuw HijackThis logje.

  Vraagje:

  Was ik vergeten in het begin te vragen, van wie kreeg je die virusmelding:S:S

  Groetjes Huib;)

  

  Rapporteren
• 

  patries

  30-11-2010 12:56

  Ik kan daar niks vinden van norton/Symantic ook niks van avast.

  De melding komt trouwens in een pop up van avg

  resident shield waarschuwing van een meervoudige bedreiging in C:\Windows\explorer.exe en C:\Windows\system32\winlogon.exe

  Er staat achter {systeemkritischbestand/systeembestand dat niet verwijderd moet worden}

  Rapporteren
• 

  patries

  30-11-2010 13:28

  Nieuwe log, volgens mij staan er weer regels tussen die ik net heb verwijderd?

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 13:22:47, on 30-11-2010

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\Ati2evxx.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\system32\Ati2evxx.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  C:\PROGRA~1\AVG\AVG8\avgam.exe

  C:\PROGRA~1\AVG\AVG8\avgrsx.exe

  C:\PROGRA~1\AVG\AVG8\avgnsx.exe

  C:\Program Files\mst software\mst Defrag\mstDfrgS.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBService.exe

  C:\WINDOWS\system32\IoctlSvc.exe

  C:\WINDOWS\system32\PnkBstrA.exe

  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  C:\WINDOWS\system32\wwSecure.exe

  C:\WINDOWS\system32\wuauclt.exe

  C:\windows\system\hpsysdrv.exe

  C:\WINDOWS\SOUNDMAN.EXE

  C:\WINDOWS\ALCWZRD.EXE

  C:\WINDOWS\ALCMTR.EXE

  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe

  C:\WINDOWS\system32\rundll32.exe

  C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

  C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

  C:\Program Files\Common Files\Real\Update_OB\realsched.exe

  C:\HP\KBD\KBD.EXE

  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

  C:\Program Files\Canon\MyPrinter\BJMyPrt.exe

  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

  C:\PROGRA~1\AVG\AVG8\avgtray.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Winamp\winamp556\Winamp\winampa.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

  C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\NewsBinPro\FTD\FTDv3.8\FTD Watchdog\FtdMonitor.exe

  C:\Program Files\Logitech\SetPoint\KEM.exe

  C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

  C:\WINDOWS\system32\msiexec.exe

  C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

  C:\Program Files\AVG\AVG8\avgcsrvx.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cartoonnetwork.nl/index_nl.html#

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O4 - HKLM\..\Run: c:\windows\system\hpsysdrv.exe

  O4 - HKLM\..\Run: HDAudPropShortcut.exe

  O4 - HKLM\..\Run: C:\WINDOWS\SMINST\RECGUARD.EXE

  O4 - HKLM\..\Run: C:\WINDOWS\system32\ps2.exe

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: ALCWZRD.EXE

  O4 - HKLM\..\Run: ALCMTR.EXE

  O4 - HKLM\..\Run: C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

  O4 - HKLM\..\Run: KHALMNPR.EXE

  O4 - HKLM\..\Run: mmrtkrnl.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

  O4 - HKLM\..\Run: “C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe” /source=HKLM

  O4 - HKLM\..\Run: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

  O4 - HKLM\..\Run: c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

  O4 - HKLM\..\Run: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” -scheduler

  O4 - HKLM\..\Run: C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Virtual\System\VC8Play.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

  O4 - HKLM\..\Run: “C:\Program Files\Norton Internet Security\osCheck.exe”

  O4 - HKLM\..\Run: C:\Program Files\Wanadoo\NL\Mnu\igomnu.exe /S:T

  O4 - HKLM\..\Run: C:\HP\KBD\KBD.EXE

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start

  O4 - HKLM\..\Run: C:\Program Files\InkSaver\InkSaver.exe hide

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe”

  O4 - HKLM\..\Run: C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon

  O4 - HKLM\..\Run: C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: C:\PROGRA~1\AVG\AVG8\avgtray.exe

  O4 - HKLM\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Winamp\winamp556\Winamp\winampa.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

  O4 - HKLM\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBKeyScan.exe”

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

  O4 - HKCU\..\Run: “C:\Program Files\Microsoft ActiveSync\wcescomm.exe”

  O4 - HKCU\..\Run: “C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\NewsBinPro\FTD\FTDv3.8\FTD Watchdog\FtdMonitor.exe”

  O4 - HKCU\..\Run: C:\Program Files\Advanced Registry Optimizer\aro.exe -rem

  O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Lokale service’)

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Netwerkservice’)

  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe

  O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 3.79\AMVConverter\grab.html

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.79\MediaManager\grab.html

  O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra ‘Tools’ menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

  O9 - Extra ‘Tools’ menuitem: Mobiele favorieten maken… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

  O9 - Extra button: Crazy Poker - {8A8A3162-B5FA-4c54-A862-4E62CBE8A255} - C:\Program Files\crazyvegasMPP\MPPoker.exe

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

  O9 - Extra button: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

  O9 - Extra ‘Tools’ menuitem: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Games\PartyPokerNet\RunPF.exe (file missing)

  O9 - Extra ‘Tools’ menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Games\PartyPokerNet\RunPF.exe (file missing)

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra button: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)

  O9 - Extra ‘Tools’ menuitem: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)

  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab

  O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

  O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab

  O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab

  O16 - DPF: {91F52A42-C10D-49A7-B941-882C657C604F} (Installation Helper Object) - http://kitcentral.wanadoo.nl/download/install/win32/nl/instwact/instwact.dll

  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game12.zylom.com/activex/zylomgamesplayer.cab

  O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab

  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab

  O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab

  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/aio/nl/check/qdiagh.cab?326

  O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://cache.hyves-static.net/statics/Aurigma/ImageUploader4.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

  O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

  O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

  O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

  O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

  O23 - Service: COM Host (comHost) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (file missing)

  O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Magix Music Maker Pro 15\Common\Database\bin\fbserver.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

  O23 - Service: Wachtwoordvalidatie voor Symantec IS (ISPwdSvc) - Unknown owner - C:\Program Files\Norton Internet Security\isPwdSvc.exe (file missing)

  O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: mst Defrag Service (mstDfrgS) - mst software, Martin Stiemerling, Germany - C:\Program Files\mst software\mst Defrag\mstDfrgS.exe

  O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)

  O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Nero 8\Nero\Nero8\Nero BackItUp\NBService.exe

  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

  O23 - Service: ODBC service - Unknown owner - C:\WINDOWS\system32\odbc.exe (file missing)

  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

  O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

  O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe (file missing)

  O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

  O23 - Service: Virtual CD v8 Management Service (VC8SecS) - Unknown owner - C:\Documents and Settings\Compaq_Eigenaar\Mijn documenten\Marco\Bestanden\Virtual\System\VC8SecS.exe (file missing)

  O23 - Service: Washer AutoComplete (wwSecSvc) - Unknown owner - C:\WINDOWS\system32\wwSecure.exe

  –

  End of file - 17615 bytes

  Rapporteren