Hoe kom ik van poker 770 af?

• 

  tessie

  23-08-2011 11:59

  Goedemorgen,

  Hopelijk kan iemand mij helpen. Gisteren heb ik mijn pc afgesloten, niets aan de hand.

  Vanochtend start ik op en in mijn boekhoudprogramma verschijnt een icoon van een programma(?) Poker 770 (of misschien een verwijzing naar een internetsite). In ieder geval, ik krijg het met geen mogelijkheid verwijderd. Ik heb alle bovenstaande stappen doorgelopen en hier zijn de logjes:

  Malwarebytes' Anti-Malware 1.51.1.1800

  www.malwarebytes.org

  Databaseversie: 7543

  Windows 5.1.2600 Service Pack 3

  Internet Explorer 8.0.6001.18702

  23-8-2011 11:41:44

  mbam-log-2011-08-23 (11-41-44).txt

  Scantype: Snelle scan

  Objecten gescand: 175545

  Verstreken tijd: 5 minuut/minuten, 39 seconde(n)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 0

  Registersleutels geïnfecteerd: 0

  Registerwaarden geïnfecteerd: 0

  Registerdata geïnfecteerd: 0

  Mappen geïnfecteerd: 0

  Bestanden geïnfecteerd: 0

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registerwaarden geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registerdata geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Mappen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Bestanden geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  En van Hijack This:

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 11:54:06, on 23-8-2011

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\AVG\AVG9\avgchsvx.exe

  C:\Program Files\AVG\AVG9\avgrsx.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\AVG\AVG9\avgcsrvx.exe

  C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

  C:\Program Files\Intel\ASF Agent\ASFAgent.exe

  C:\Program Files\AVG\AVG9\avgwdsvc.exe

  C:\Program Files\Dell\OpenManage\Client\Iap.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  C:\WINDOWS\System32\nvsvc32.exe

  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  C:\Program Files\AVG\AVG9\avgam.exe

  C:\Program Files\AVG\AVG9\avgnsx.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\System32\DSentry.exe

  C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

  C:\Program Files\iTunes\iTunesHelper.exe

  C:\Program Files\SC-Print2005\Msgsrv.exe

  C:\Program Files\Sharp\Sharpdesk\SharpTray.exe

  C:\Program Files\Sharp\Sharpdesk\FtpServer.exe

  C:\WINDOWS\system32\spool\drivers\w32x86\3\SN0XRCV.exe

  C:\PROGRA~1\AVG\AVG9\avgtray.exe

  C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

  C:\Program Files\Sharp\Sharpdesk\nsapp.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\stickies\stickies.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\iPod\bin\iPodService.exe

  C:\Program Files\AVG\AVG9\avgcsrvx.exe

  C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

  C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

  C:\WINDOWS\system32\mstsc.exe

  C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll

  O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl\msntb.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl\msntb.dll

  O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

  O4 - HKLM\..\Run: C:\WINDOWS\System32\DSentry.exe

  O4 - HKLM\..\Run: “C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”

  O4 - HKLM\..\Run: “C:\Program Files\iTunes\iTunesHelper.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: C:\Program Files\SC-Print2005\Msgsrv.exe /NSC-Print2005 /S

  O4 - HKLM\..\Run: “C:\Program Files\Sharp\Sharpdesk\IndexTray.exe” /n

  O4 - HKLM\..\Run: “C:\Program Files\Sharp\Sharpdesk\SharpTray.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Sharp\Sharpdesk\TypeRegChecker.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Sharp\Sharpdesk\FtpServer.exe” -usedefault

  O4 - HKLM\..\Run: C:\WINDOWS\system32\spool\drivers\w32x86\3\SN0XRCV.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\AVG\AVG9\avgtray.exe

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe” /starttray

  O4 - HKLM\..\RunOnce: C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

  O4 - HKCU\..\Run: “C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe”

  O4 - HKCU\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  O4 - HKCU\..\Run: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

  O4 - HKCU\..\Run: “C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe” /automount

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Lokale service’)

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Netwerkservice’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)

  O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

  O4 - Startup: Stickies.lnk = C:\Program Files\stickies\stickies.exe

  O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

  O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {0DBF2423-33D3-4084-B83E-6A3661F2CD46} (Album Upload Software Control) - http://www.mijnalbum.nl/v3/skinsrc/core/system/6.5.6/ImageUploader6.cab

  O16 - DPF: {485D813E-EE26-4DF8-9FAF-DEDF2885306E} (NSHelp Class) - http://dell-server/ConnectComputer/nshelp.dll

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab

  O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://verkopen.marktplaats.nl/js/widgets/imageUploader/aurigma/5_7_24_0/ImageUploader5.cab

  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

  O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://192.168.35.99/Remote/msrdp.cab

  O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} (CeWe Color AG & Co. OHG Control) - https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll

  O18 - Filter hijack: text/html - (no CLSID) - (no file)

  O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

  O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

  O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

  O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe

  O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe

  O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe

  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

  O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

  O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

  O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  –

  End of file - 11025 bytes

  Bedankt voor het lezen van het probleem. Hopelijk weet iemand van jullie hier iets meer over?

  Vr groet,

  Tessie

  Rapporteren
• 

  Ben

  23-08-2011 13:42

  hallo Tessie,

  Schakel Spybot's TeaTimer even uit omdat deze de fix in de weg kan zitten:

  - Start Spybot

  - Ga naar Mode > selecteer Advanced Mode

  - Ga naar Tools en klik op het Resident-icoon in de lijst

  - Haal het vinkje weg bij Resident TeaTimer en klik OK

  - Herstart de computer

  Als de computer schoon is, kun je TeaTimer weer aan zetten

  Start HijackThis, klik op scan en vink de volgende regels aan;

  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

  O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

  O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

  O18 - Filter hijack: text/html - (no CLSID) - (no file)

  Sluit alle open vensters(behalve HijackThis), klik daarna op Fix checked en bevestig het door in het volgende scherm op Ja te klikken

  Start pc opnieuw op en plaats een nieuw Hijack this logje en vertel hoe het met je probleem staat?

  http://2.bp.blogspot.com/_NAn8-ZItaHE/Scq3w6FaicI/AAAAAAAACVY/QqPkGy7EU7U/s320/school69.gif

  Ben

  Rapporteren
• 

  tessie

  23-08-2011 14:02

  Hallo Ben,

  Allereerst hartelijk dank voor jouw hulp!

  Alleen het probleem is nog niet opgelost.

  Ik weet niet of ik het scherm (wat het probleem geeft) kan opslaan en hier kan invoegen? Zodat je kunt zien wat het probleem is?

  Hier wel alvast een nieuw logje:

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 13:58:27, on 23-8-2011

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\AVG\AVG9\avgchsvx.exe

  C:\Program Files\AVG\AVG9\avgrsx.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\AVG\AVG9\avgcsrvx.exe

  C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

  C:\Program Files\Intel\ASF Agent\ASFAgent.exe

  C:\Program Files\AVG\AVG9\avgwdsvc.exe

  C:\Program Files\Dell\OpenManage\Client\Iap.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  C:\WINDOWS\System32\nvsvc32.exe

  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  C:\Program Files\AVG\AVG9\avgam.exe

  C:\WINDOWS\system32\wuauclt.exe

  C:\Program Files\AVG\AVG9\avgnsx.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\System32\DSentry.exe

  C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

  C:\Program Files\iTunes\iTunesHelper.exe

  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

  C:\Program Files\SC-Print2005\Msgsrv.exe

  C:\Program Files\Sharp\Sharpdesk\SharpTray.exe

  C:\Program Files\Sharp\Sharpdesk\FtpServer.exe

  C:\WINDOWS\system32\spool\drivers\w32x86\3\SN0XRCV.exe

  C:\PROGRA~1\AVG\AVG9\avgtray.exe

  C:\Program Files\Sharp\Sharpdesk\nsapp.exe

  C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

  C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

  C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  C:\Program Files\SpywareGuard\sgmain.exe

  C:\Program Files\stickies\stickies.exe

  C:\Program Files\SpywareGuard\sgbhp.exe

  C:\Program Files\iPod\bin\iPodService.exe

  C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\AVG\AVG9\avgcsrvx.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll

  O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl\msntb.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl\msntb.dll

  O4 - HKLM\..\Run: C:\WINDOWS\System32\DSentry.exe

  O4 - HKLM\..\Run: “C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”

  O4 - HKLM\..\Run: “C:\Program Files\iTunes\iTunesHelper.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: C:\Program Files\SC-Print2005\Msgsrv.exe /NSC-Print2005 /S

  O4 - HKLM\..\Run: “C:\Program Files\Sharp\Sharpdesk\IndexTray.exe” /n

  O4 - HKLM\..\Run: “C:\Program Files\Sharp\Sharpdesk\SharpTray.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Sharp\Sharpdesk\TypeRegChecker.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Sharp\Sharpdesk\FtpServer.exe” -usedefault

  O4 - HKLM\..\Run: C:\WINDOWS\system32\spool\drivers\w32x86\3\SN0XRCV.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\AVG\AVG9\avgtray.exe

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe” /starttray

  O4 - HKCU\..\Run: “C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe”

  O4 - HKCU\..\Run: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

  O4 - HKCU\..\Run: “C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe” /automount

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Lokale service’)

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Netwerkservice’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)

  O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

  O4 - Startup: Stickies.lnk = C:\Program Files\stickies\stickies.exe

  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

  O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {0DBF2423-33D3-4084-B83E-6A3661F2CD46} (Album Upload Software Control) - http://www.mijnalbum.nl/v3/skinsrc/core/system/6.5.6/ImageUploader6.cab

  O16 - DPF: {485D813E-EE26-4DF8-9FAF-DEDF2885306E} (NSHelp Class) - http://dell-server/ConnectComputer/nshelp.dll

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab

  O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://verkopen.marktplaats.nl/js/widgets/imageUploader/aurigma/5_7_24_0/ImageUploader5.cab

  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

  O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://192.168.35.99/Remote/msrdp.cab

  O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} (CeWe Color AG & Co. OHG Control) - https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll

  O18 - Filter hijack: text/html - (no CLSID) - (no file)

  O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

  O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

  O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

  O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe

  O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe

  O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe

  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

  O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

  O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

  O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  –

  End of file - 10665 bytes

  Rapporteren
• 

  fazantje

  23-08-2011 14:19

  Hoi Tessie,

  Download combofix Hier

  Indien je Combofix al eerder hebt gebruikt, gelieve die versie te verwijderen en Combofix opnieuw te downloaden via bovenstaande link,

  want Combofix wordt dagelijks geupdate.

  OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus- of een andere realtime scanner,

  schakel dan deze scanner uit en download Combofix opnieuw.

  Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

  Dubbelklik op Combofix.exe

  Volg de instructies, aanvaard de disclaimer.

  Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

  Het kan enige tijd duren voordat het logje van combofix komt, dus denk niet van hij is op tilt.

  Wanneer de fix voltooid is en na herstart, zal de log combofix.txt openen.

  Plaats deze log in je volgende post samen met een nieuw HijackThis logje.

  En vertel er bij hoe het staat met je problemen.

  Succes,

  Huib;)

  

  Rapporteren
• 

  tessie

  23-08-2011 14:35

  Hallo Huib,

  Ik ben er mee bezig, maar vast heel erg dom van mij? Hoe zet ik die AVG uit??

  Ik kan niet kiezen voor Exit of uitschakelen.

  Als ik met de rechtermuisknop klik dan heb ik keuze uit:

  - Openen AVG Interface

  - Scans

  - Bijwerken

  - Help

  De combofix wil wel verdergaan maar dit is op mijn eigen risico, dus ik heb hem toch maar even uitgezet.

  Of kan ik ermee doorgaan?

  Ik ben op deze pc tot 3 uur, dus als je niets meer van mij hoort, donderdag ben ik weer op deze pc aanwezig.

  Rapporteren
• 

  fazantje

  23-08-2011 14:40

  Hoi Tessie,

  AVG mag je helemaal verwijderen, dit is nog een verouderde versie dus je moet straks toch nieuwe versie installeren;)

  Succes,

  Huib;)

  

  Rapporteren
• 

  tessie

  23-08-2011 14:49

  Hallo Huib,

  Wij hebben een AVG dat voor 4 computers geldt. Een betaalde versie. Kan ik die wel zomaar verwijderen?

  Ik wacht even jouw reactie af en ga dan donderdag dat allemaal even doen.

  Groet en alvast bedankt,

  tessie

  Rapporteren
• 

  Ben

  23-08-2011 15:03

  hallo tessie,

  Tot hoe lang geld de licentie van AVG ?

  Update je AVG (je heb AVG 9) wel eens je zit al aan AVG 11 http://www.avg.com/nl-nl/home-small-office-security-ppc?ctype=ppc_nl_gs_0002&wm_crID=6987364&wm_lpID=35083935&wm_ctID=383&wm_kwID=21308914&wm_mtID=3&wm_content=0&wm_g_crID=7946955432&wm_g_kw=AVG&wm_g_pcmt=&wm_g_cnt=0&wm_kw=AVG&wm_sd=1

  Anders word het eens tijd voor een nieuwe AVG !!

  Doe alvast de combofix zonder AVG te verwijderen (dus op eigen risico)

  http://2.bp.blogspot.com/_NAn8-ZItaHE/Scq3w6FaicI/AAAAAAAACVY/QqPkGy7EU7U/s320/school69.gif

  Ben

  Rapporteren
• 

  tessie

  25-08-2011 09:58

  Hallo Ben/Huib,

  Ik ben er weer. De AVG licentie is tot mei 2012 en volgens mij update AVG toch vanzelf? Want dat doet hij af en toe.

  Ik heb hier het logje van combifix:

  ComboFix 11-08-24.06 - Ellen Janssens 25-08-2011 9:33.1.2 - x86

  Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.1023.411

  Gestart vanuit: c:\documents and settings\Ellen Janssens\Bureaublad\ComboFix.exe

  AV: AVG File Server Edition *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

  * Nieuw herstelpunt werd aangemaakt

  .

  .

  (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

  .

  .

  c:\documents and settings\Ellen Janssens\Application Data\Arsio

  c:\documents and settings\Ellen Janssens\Application Data\Arsio\Arsio.ini

  c:\documents and settings\Ellen Janssens\Application Data\inst.exe

  c:\documents and settings\Ellen Janssens\Bureaublad\Internet Explorer.lnk

  c:\documents and settings\Ellen Janssens\Favorieten\Videos.url

  c:\documents and settings\Ellen Janssens\Menu Start\Programma's\Videos.url

  c:\documents and settings\Ellen Janssens\WINDOWS

  c:\program files\messenger\msmsgsin.exe

  c:\windows\ehome\medctrro.exe

  c:\windows\IsUn0413.exe

  c:\windows\system32\comct332.ocx

  c:\windows\system32\ReadMe.txt

  c:\windows\system32\setup.ini

  .

  .

  ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

  .

  .

  ——-\Legacy_SPYWARECLEANERSERVICE

  ——-\Service_usnjsvc

  .

  .

  (((((((((((((((((((( Bestanden Gemaakt van 2011-07-25 to 2011-08-25 ))))))))))))))))))))))))))))))

  .

  .

  2011-08-23 12:31 . 2011-08-23 12:31 ——– d—–w- c:\documents and settings\Ellen Janssens\Application Data\AVG9

  2011-08-10 23:59 . 2011-06-24 14:10 139656 ——w- c:\windows\system32\dllcache\rdpwd.sys

  2011-08-10 23:58 . 2011-07-08 14:02 10496 ——w- c:\windows\system32\dllcache\ndistapi.sys

  .

  .

  .

  ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

  .

  2011-07-15 13:29 . 2002-09-11 05:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys

  2011-07-08 14:02 . 2002-09-11 05:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys

  2011-07-06 17:52 . 2009-02-24 11:20 22712 —-a-w- c:\windows\system32\drivers\mbam.sys

  2011-07-06 17:52 . 2009-02-24 11:20 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys

  2011-06-24 14:10 . 2002-09-11 05:00 139656 —-a-w- c:\windows\system32\drivers\rdpwd.sys

  2011-06-23 18:31 . 2004-02-06 16:09 916480 —-a-w- c:\windows\system32\wininet.dll

  2011-06-23 18:31 . 2002-09-11 05:00 43520 ——w- c:\windows\system32\licmgr10.dll

  2011-06-23 18:31 . 2002-09-11 05:00 1469440 ——w- c:\windows\system32\inetcpl.cpl

  2011-06-23 12:05 . 2004-08-04 07:55 385024 ——w- c:\windows\system32\html.iec

  2011-06-23 07:26 . 2011-05-17 07:40 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

  2011-06-20 17:44 . 2002-09-11 05:00 293888 —-a-w- c:\windows\system32\winsrv.dll

  2011-06-06 11:35 . 2002-09-11 05:00 1859072 —-a-w- c:\windows\system32\win32k.sys

  2010-02-25 11:14 . 2010-02-25 11:14 2277016 —-a-w- c:\program files\CBSquest_setup.exe

  2004-06-29 12:13 . 2008-04-24 12:20 532616 —-a-w- c:\program files\ImageResizerPowertoySetup.exe

  2004-12-02 14:35 . 2005-01-14 11:57 94208 —-a-w- c:\program files\mozilla firefox\components\BrandRes.dll

  2004-12-02 14:35 . 2005-01-14 11:57 150912 —-a-w- c:\program files\mozilla firefox\components\fullsoft.dll

  2004-12-02 14:35 . 2005-01-14 11:57 41585 —-a-w- c:\program files\mozilla firefox\components\jar50.dll

  2004-12-02 14:35 . 2005-01-14 11:57 48235 —-a-w- c:\program files\mozilla firefox\components\jsd3250.dll

  2004-12-02 14:35 . 2005-01-14 11:57 8825 —-a-w- c:\program files\mozilla firefox\components\qfaservices.dll

  2004-12-02 14:35 . 2005-01-14 11:57 158835 —-a-w- c:\program files\mozilla firefox\components\xpinstal.dll

  .

  .

  ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

  .

  .

  *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

  REGEDIT4

  .

  “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe”

  “SUPERAntiSpyware”=“c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe”

  “AlcoholAutomount”=“c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe”

  .

  “DVDSentry”=“c:\windows\System32\DSentry.exe”

  “AdaptecDirectCD”=“c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe”

  “Adobe Photo Downloader”=“c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”

  “iTunesHelper”=“c:\program files\iTunes\iTunesHelper.exe”

  “Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  “SC-Print2005 Msgsrv”=“c:\program files\SC-Print2005\Msgsrv.exe”

  “IndexTray”=“c:\program files\Sharp\Sharpdesk\IndexTray.exe”

  “SharpTray”=“c:\program files\Sharp\Sharpdesk\SharpTray.exe”

  “TypeRegChecker”=“c:\program files\Sharp\Sharpdesk\TypeRegChecker.exe”

  “FtpServer.exe”=“c:\program files\Sharp\Sharpdesk\FtpServer.exe”

  “SN0XRCV”=“c:\windows\system32\spool\drivers\w32x86\3\SN0XRCV.exe”

  “AVG9_TRAY”=“c:\progra~1\AVG\AVG9\avgtray.exe”

  “QuickTime Task”=“c:\program files\QuickTime\qttask.exe”

  “Malwarebytes' Anti-Malware”=“c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe”

  .

  “CTFMON.EXE”=“c:\windows\System32\CTFMON.EXE”

  .

  c:\documents and settings\Ellen Janssens\Menu Start\Programma's\Opstarten\

  SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe

  Stickies.lnk - c:\program files\stickies\stickies.exe

  .

  “{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}”= “c:\program files\SUPERAntiSpyware\SASSEH.DLL”

  .

  2009-09-07 08:10 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

  .

  2010-06-22 07:39 12536 —-a-w- c:\windows\SYSTEM32\avgrsstx.dll

  .

  @=“”

  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck

  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon

  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task

  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched

  .

  “%windir%\\system32\\sessmgr.exe”=

  “c:\\WINDOWS\\SYSTEM32\\fxsclnt.exe”=

  “c:\\Program Files\\Messenger\\msmsgs.exe”=

  “%windir%\\Network Diagnostic\\xpnetdiag.exe”=

  “c:\\Program Files\\iTunes\\iTunes.exe”=

  “c:\\Program Files\\Kyocera\\KACT\\KACT.exe”=

  “c:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\SN0XNJR.exe”=

  “c:\\Program Files\\MSN Messenger\\msnmsgr.exe”=

  “c:\\Program Files\\MSN Messenger\\livecall.exe”=

  “c:\\Program Files\\AVG\\AVG9\\avgam.exe”=

  “c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe”=

  “c:\\Program Files\\AVG\\AVG9\\avgupd.exe”=

  “c:\\Program Files\\AVG\\AVG9\\avgnsx.exe”=

  .

  R0 AvgRkx86;avgrkx86.sys;c:\windows\SYSTEM32\DRIVERS\avgrkx86.sys

  R0 sptd;sptd;c:\windows\SYSTEM32\DRIVERS\sptd.sys

  R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys

  R1 AvgTdiX;AVG Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys

  R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS

  R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS

  R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE

  R2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe

  R2 AsfAlrt;AsfAlrt;c:\windows\SYSTEM32\DRIVERS\Asfalrt.sys

  R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe

  R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe

  R3 MBAMProtector;MBAMProtector;c:\windows\SYSTEM32\DRIVERS\mbam.sys

  S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS

  .

  .

  ——- Bijkomende Scan ——-

  .

  uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

  uStart Page = hxxp://www.startpagina.nl/

  uInternet Connection Wizard,ShellNext = hxxp://www.euro.dell.com/

  TCP: DhcpNameServer = 80.89.238.3 80.89.224.64

  DPF: {0DBF2423-33D3-4084-B83E-6A3661F2CD46} - hxxp://www.mijnalbum.nl/v3/skinsrc/core/system/6.5.6/ImageUploader6.cab

  DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab

  .

  - - - - ORPHANS VERWIJDERD - - - -

  .

  Toolbar-Locked - (no file)

  WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

  WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

  HKCU-Run-Spyware Doctor - (no file)

  MSConfigStartUp-CTFMON - (no file)

  AddRemove-Aangifte inkomstenbelasting 2007 - c:\program files\Belastingdienst\Aangifte inkomstenbelasting\2007\ib2007u.exe

  AddRemove-EASY COMPUTING CD-Drukkerij Kit - c:\windows\IsUn0413.exe

  AddRemove-CLOCKLITEDOWNLOAD - c:\docume~1\ELLENJ~1\APPLIC~1\TRANS2~1\Datelogview.exe

  .

  .

  .

  **************************************************************************

  .

  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

  Rootkit scan 2011-08-25 09:43

  Windows 5.1.2600 Service Pack 3 NTFS

  .

  scannen van verborgen processen …

  .

  scannen van verborgen autostart items …

  .

  scannen van verborgen bestanden …

  .

  .

  c:\windows\TEMP\65173b13-f09a-4cd6-8ae7-53b6c8522642.tmp 0 bytes

  .

  Scan succesvol afgerond

  verborgen bestanden: 1

  .

  **************************************************************************

  .

  ——————— VERGRENDELDE REGISTER SLEUTELS ———————

  .

  “3140111900063D11C8EF10054038389C”=“C?\\WINDOWS\\System32\\FM20ENU.DLL”

  .

  ——————— DLLs Geladen Onder Lopende Processen ———————

  .

  - - - - - - - > ‘winlogon.exe’(732)

  c:\program files\SUPERAntiSpyware\SASWINLO.DLL

  .

  - - - - - - - > ‘explorer.exe’(2004)

  c:\windows\system32\webcheck.dll

  c:\windows\system32\WPDShServiceObj.dll

  c:\windows\system32\PortableDeviceTypes.dll

  c:\windows\system32\PortableDeviceApi.dll

  .

  ———————— Andere Aktieve Processen ————————

  .

  c:\program files\AVG\AVG9\avgchsvx.exe

  c:\program files\AVG\AVG9\avgrsx.exe

  c:\program files\AVG\AVG9\avgcsrvx.exe

  c:\program files\Dell\OpenManage\Client\Iap.exe

  c:\program files\Java\jre6\bin\jqs.exe

  c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  c:\windows\System32\nvsvc32.exe

  c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  c:\program files\AVG\AVG9\avgam.exe

  c:\program files\AVG\AVG9\avgnsx.exe

  c:\program files\Sharp\Sharpdesk\nsapp.exe

  c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe

  c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  c:\program files\SpywareGuard\sgbhp.exe

  c:\program files\iPod\bin\iPodService.exe

  c:\program files\AVG\AVG9\avgcsrvx.exe

  .

  **************************************************************************

  .

  Voltooingstijd: 2011-08-25 09:49:05 - machine werd herstart

  ComboFix-quarantined-files.txt 2011-08-25 07:49

  .

  Pre-Run: 93.690.507.264 bytes beschikbaar

  Post-Run: 93.596.168.192 bytes beschikbaar

  .

  WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe

  timeout=2

  default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

  c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons

  UnsupportedDebug=“do not select this” /debug

  multi(0)disk(0)rdisk(0)partition(2)\WINDOWS=“Microsoft Windows XP Professional” /fastdetect /NoExecute=OptIn

  .

  - - End Of File - - 86C4FBFA6BF6A86CE877C1E37F323FA5

  En van HiJack:

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 9:55:16, on 25-8-2011

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\AVG\AVG9\avgchsvx.exe

  C:\Program Files\AVG\AVG9\avgrsx.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\AVG\AVG9\avgcsrvx.exe

  C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

  C:\Program Files\Intel\ASF Agent\ASFAgent.exe

  C:\Program Files\AVG\AVG9\avgwdsvc.exe

  C:\Program Files\Dell\OpenManage\Client\Iap.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  C:\WINDOWS\System32\nvsvc32.exe

  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  C:\Program Files\AVG\AVG9\avgam.exe

  C:\Program Files\AVG\AVG9\avgnsx.exe

  C:\WINDOWS\system32\wuauclt.exe

  C:\WINDOWS\System32\DSentry.exe

  C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

  C:\Program Files\iTunes\iTunesHelper.exe

  C:\Program Files\SC-Print2005\Msgsrv.exe

  C:\Program Files\Sharp\Sharpdesk\SharpTray.exe

  C:\Program Files\Sharp\Sharpdesk\FtpServer.exe

  C:\WINDOWS\system32\spool\drivers\w32x86\3\SN0XRCV.exe

  C:\PROGRA~1\AVG\AVG9\avgtray.exe

  C:\Program Files\Sharp\Sharpdesk\nsapp.exe

  C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

  C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

  C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  C:\Program Files\SpywareGuard\sgmain.exe

  C:\Program Files\stickies\stickies.exe

  C:\Program Files\SpywareGuard\sgbhp.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\iPod\bin\iPodService.exe

  C:\Program Files\AVG\AVG9\avgcsrvx.exe

  C:\WINDOWS\explorer.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll

  O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl\msntb.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl\msntb.dll

  O4 - HKLM\..\Run: C:\WINDOWS\System32\DSentry.exe

  O4 - HKLM\..\Run: “C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”

  O4 - HKLM\..\Run: “C:\Program Files\iTunes\iTunesHelper.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: C:\Program Files\SC-Print2005\Msgsrv.exe /NSC-Print2005 /S

  O4 - HKLM\..\Run: “C:\Program Files\Sharp\Sharpdesk\IndexTray.exe” /n

  O4 - HKLM\..\Run: “C:\Program Files\Sharp\Sharpdesk\SharpTray.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Sharp\Sharpdesk\TypeRegChecker.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Sharp\Sharpdesk\FtpServer.exe” -usedefault

  O4 - HKLM\..\Run: C:\WINDOWS\system32\spool\drivers\w32x86\3\SN0XRCV.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\AVG\AVG9\avgtray.exe

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe” /starttray

  O4 - HKCU\..\Run: “C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe”

  O4 - HKCU\..\Run: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

  O4 - HKCU\..\Run: “C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe” /automount

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)

  O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

  O4 - Startup: Stickies.lnk = C:\Program Files\stickies\stickies.exe

  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

  O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {0DBF2423-33D3-4084-B83E-6A3661F2CD46} (Album Upload Software Control) - http://www.mijnalbum.nl/v3/skinsrc/core/system/6.5.6/ImageUploader6.cab

  O16 - DPF: {485D813E-EE26-4DF8-9FAF-DEDF2885306E} (NSHelp Class) - http://dell-server/ConnectComputer/nshelp.dll

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab

  O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://verkopen.marktplaats.nl/js/widgets/imageUploader/aurigma/5_7_24_0/ImageUploader5.cab

  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

  O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://192.168.35.99/Remote/msrdp.cab

  O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} (CeWe Color AG & Co. OHG Control) - https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll

  O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

  O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

  O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

  O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe

  O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe

  O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe

  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

  O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

  O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

  O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  –

  End of file - 10506 bytes

  Ik heb net gekeken in het boekhoudprogramma maar poker 770 staat er nog steeds in.

  groet, tessie

  Rapporteren
• 

  tessie

  25-08-2011 10:13

  Ik heb net de boekhouding afgesloten en weer opgestart en nu is het weg!

  Rapporteren