ComboFix 11-11-23.01 - Gebruiker 23-11-2011 20:56:34.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.4055.1470
Gestart vanuit: D:\downloads\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Nieuw herstelpunt werd aangemaakt
(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\Temporary Internet Files\{04BEE927-FAFD-4D43-BDAD-AC0360008EC8}.xps
C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\Temporary Internet Files\{280A8D92-1CAA-4288-9D72-75BDD58283F0}.xps
C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\Temporary Internet Files\{5F4A4BB3-BC8F-42F4-8110-906F0248BFC0}.xps
C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\Temporary Internet Files\{69B23CE9-802C-4070-9A05-636D7B94A604}.xps
C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\Temporary Internet Files\{85D476F8-C763-4AE7-8D42-35C0CA103F34}.xps
C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\Temporary Internet Files\{AE7A8D76-31EC-4B77-AAAC-D918EB404AF7}.xps
C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\Temporary Internet Files\{DE5F39F2-D4E5-46A1-9AB7-F0191C9FA986}.xps
C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\Temporary Internet Files\{ECD675D3-9A21-4A64-8A77-AC073D165657}.xps
C:\Users\Gebruiker\AppData\Roaming\94.bmp
C:\Users\Gebruiker\AppData\Roaming\DgCFgrfUtV.txt
C:\Users\Gebruiker\AppData\Roaming\log.txt
C:\Users\Gebruiker\AppData\Roaming\svchost.exe
C:\Users\Gebruiker\AppData\Roaming\vso_ts_preview.xml
C:\Windows\InstallDir
C:\Windows\SysWow64\windows
(((((((((((((((((((( Bestanden Gemaakt van 2011-10-23 to 2011-11-23 ))))))))))))))))))))))))))))))
2011-11-23 20:00:47 . 2011-11-23 20:00:47 ——– d—–w- C:\Users\UpdatusUser\AppData\Local\temp
2011-11-23 20:00:47 . 2011-11-23 20:00:47 ——– d—–w- C:\Users\Public\AppData\Local\temp
2011-11-23 20:00:47 . 2011-11-23 20:00:47 ——– d—–w- C:\Users\Default\AppData\Local\temp
2011-11-23 20:00:47 . 2011-11-23 20:00:47 ——– d—–w- C:\Users\AppData\AppData\Local\temp
2011-11-18 19:22:11 . 2011-11-18 19:22:11 ——– d—–w- C:\New folder1
2011-11-18 08:27:05 . 2011-11-18 08:27:05 ——– d—–w- C:\Users\Gebruiker\AppData\Roaming\NVIDIA
2011-11-15 05:19:42 . 2011-11-15 05:19:42 ——– d—–w- C:\Users\Default\AppData\Local\Microsoft Help
2011-11-11 05:11:13 . 2011-11-13 18:10:04 ——– d—–w- C:\Users\Gebruiker\AppData\Roaming\Alawar Stargaze
2011-11-09 21:02:02 . 2011-10-01 05:45:21 886784 —-a-w- C:\Program Files\Common Files\System\wab32.dll
2011-11-09 21:02:02 . 2011-10-01 04:37:08 708608 —-a-w- C:\Program Files (x86)\Common Files\System\wab32.dll
2011-11-09 21:02:01 . 2011-09-29 16:29:28 1923952 —-a-w- C:\Windows\system32\drivers\tcpip.sys
2011-11-09 21:02:01 . 2011-09-29 04:03:32 3144704 —-a-w- C:\Windows\system32\win32k.sys
2011-11-06 19:04:58 . 2011-11-06 19:04:58 ——– d—–w- C:\ProgramData\Funny Bear Studio
2011-11-04 07:43:39 . 2011-11-04 07:43:39 ——– d—–w- C:\Windows\SysWow64\drivers\AVG
2011-11-01 22:27:58 . 2011-11-01 22:28:00 ——– d—–w- C:\Users\Gebruiker\AppData\Roaming\MA
2011-11-01 06:45:12 . 2011-11-23 17:08:30 ——– d—–w- C:\Program Files (x86)\Common Files\AVG Secure Search
2011-11-01 06:45:12 . 2011-11-09 11:44:41 ——– d—–w- C:\Program Files (x86)\AVG Secure Search
2011-11-01 06:44:13 . 2011-11-01 06:44:13 ——– d—–w- C:\Users\Gebruiker\AppData\Roaming\AVG2012
2011-11-01 06:43:54 . 2011-11-23 17:08:31 ——– d—–w- C:\ProgramData\AVG2012
2011-10-28 14:47:40 . 2011-10-28 14:47:40 ——– d—–w- C:\Users\Gebruiker\AppData\Roaming\iMaxGen
2011-10-26 11:09:50 . 2011-10-26 11:09:50 ——– d—–w- C:\Users\Gebruiker\AppData\Roaming\iWin
2011-10-26 11:09:50 . 2011-10-26 11:09:50 ——– d—–w- C:\ProgramData\iWin
2011-10-26 11:04:00 . 2011-10-26 13:10:32 ——– d—–w- C:\Program Files (x86)\Zylom Games
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
2011-11-15 05:04:13 . 2011-09-11 18:26:21 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-15 08:53:00 . 2011-01-07 19:49:34 837952 —-a-w- C:\Windows\system32\easyupdatusapiu64.dll
2011-10-15 08:53:00 . 2011-01-07 19:49:28 10406208 —-a-w- C:\Windows\system32\nvcpl.dll
2011-10-15 08:53:00 . 2011-01-07 19:49:10 5067584 —-a-w- C:\Windows\system32\nvsvc64.dll
2011-10-15 08:53:00 . 2011-01-07 19:48:58 222528 —-a-w- C:\Windows\system32\nvmctray.dll
2011-10-15 08:53:00 . 2011-01-07 19:48:58 1640768 —-a-w- C:\Windows\system32\nvvsvc.exe
2011-10-15 08:53:00 . 2010-07-09 22:38:00 8791360 —-a-w- C:\Windows\system32\nvwgf2umx.dll
2011-10-15 08:53:00 . 2010-07-09 22:38:00 7041856 —-a-w- C:\Windows\SysWow64\nvwgf2um.dll
2011-10-15 08:53:00 . 2010-07-09 22:38:00 2808128 —-a-w- C:\Windows\system32\nvapi64.dll
2011-10-15 08:53:00 . 2010-07-09 15:17:18 3074368 —-a-w- C:\Windows\system32\nvsvcr.dll
2011-10-15 08:53:00 . 2010-07-09 15:17:18 137536 —-a-w- C:\Windows\system32\nvshext.dll
2011-10-14 22:54:52 . 2011-10-14 22:54:52 321856 —-a-w- C:\Windows\SysWow64\nvStreaming.exe
2011-10-07 05:23:46 . 2011-10-07 05:23:46 283728 —-a-w- C:\Windows\system32\drivers\avgldx64.sys
2011-10-03 03:06:03 . 2011-01-18 07:49:48 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll
2011-09-13 05:30:08 . 2011-09-13 05:30:08 37456 —-a-w- C:\Windows\system32\drivers\avgrkx64.sys
2011-09-01 05:24:07 . 2011-10-13 22:03:09 2309120 —-a-w- C:\Windows\system32\jscript9.dll
2011-09-01 05:17:57 . 2011-10-13 22:03:09 1389056 —-a-w- C:\Windows\system32\wininet.dll
2011-09-01 05:12:04 . 2011-10-13 22:03:11 2382848 —-a-w- C:\Windows\system32\mshtml.tlb
2011-09-01 02:35:59 . 2011-10-13 22:03:09 1798144 —-a-w- C:\Windows\SysWow64\jscript9.dll
2011-09-01 02:28:15 . 2011-10-13 22:03:10 1126912 —-a-w- C:\Windows\SysWow64\wininet.dll
2011-09-01 02:22:54 . 2011-10-13 22:03:11 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2011-08-31 15:00:50 . 2010-12-11 15:12:15 25416 —-a-w- C:\Windows\system32\drivers\mbam.sys
2011-08-27 05:37:49 . 2011-10-13 17:50:28 861696 —-a-w- C:\Windows\system32\oleaut32.dll
2011-08-27 05:37:48 . 2011-10-13 17:50:29 331776 —-a-w- C:\Windows\system32\oleacc.dll
2011-08-27 04:26:27 . 2011-10-13 17:50:29 233472 —-a-w- C:\Windows\SysWow64\oleacc.dll
2011-08-27 04:26:27 . 2011-10-13 17:50:28 571904 —-a-w- C:\Windows\SysWow64\oleaut32.dll
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
2011-11-09 11:44:41 1451336 —-a-w- C:\Program Files (x86)\AVG Secure Search\8.0.0.40\AVG Secure Search_toolbar.dll
“{95B7759C-8C7F-4BF1-B163-73684A933233}”= “C:\Program Files (x86)\AVG Secure Search\8.0.0.40\AVG Secure Search_toolbar.dll”
@=“{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}”
2010-10-06 23:36:00 94208 —-a-w- C:\Users\Gebruiker\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
@=“{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}”
2010-10-06 23:36:00 94208 —-a-w- C:\Users\Gebruiker\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
@=“{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}”
2010-10-06 23:36:00 94208 —-a-w- C:\Users\Gebruiker\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
@=“{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}”
2010-10-06 23:36:00 94208 —-a-w- C:\Users\Gebruiker\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
“Sidebar”=“C:\Program Files\Windows Sidebar\sidebar.exe”
“AVG_TRAY”=“C:\Program Files (x86)\AVG\AVG2012\avgtray.exe”
“Malwarebytes' Anti-Malware”=“e:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe”
“vProt”=“C:\Program Files (x86)\AVG Secure Search\vprot.exe”
“AvgUninstallURL”=“start http://www.avg.com/nl.special-uninstallation-feedback-appf?lic=OUFWRlJFRS1WMEtNQy1FOVZVVy1FVzBWQS1VVTNYTC1GRVc5Ny1PVTZF&inst=NzctNjI1ODU5MTI0LVFJWDErMy1GTDEwKzEtTElDKzg4LVNQMSsxLVNQMVRCKzEtU1VEKzEtVFVHKzMtUzFJKzEtU1UzKzEtRERUKzA&prod=90&ver=10.0.1390”
C:\Users\Gebruiker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - C:\Users\Gebruiker\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
“ConsentPromptBehaviorAdmin”= 0 (0x0)
“ConsentPromptBehaviorUser”= 3 (0x3)
“EnableLUA”= 0 (0x0)
“EnableUIADesktopToggle”= 0 (0x0)
“PromptOnSecureDesktop”= 0 (0x0)
BootExecute REG_MULTI_SZ autocheck autochk *\0C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
“HP Software Update”=C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
“Adobe ARM”=“C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe”
“Adobe Reader Speed Launcher”=“C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe”
“SunJavaUpdateSched”=“C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe”
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
R2 gupdate;Google Updateservice (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
R3 gupdatem;Google Update-service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files\Microsoft Office\Office14\GROOVE.EXE
R3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
R3 SetupNTGLM7X;SetupNTGLM7X;F:\NTGLM7X.sys
R3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys
R3 WatAdminSvc;Windows Activation Technologies-service;C:\Windows\system32\Wat\WatAdminSvc.exe
R4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
S0 AVGIDSEH;AVGIDSEH;C:\Windows\system32\DRIVERS\AVGIDSEH.Sys
S0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\system32\DRIVERS\avgrkx64.sys
S1 Avgldx64;AVG AVI Loader Driver;C:\Windows\system32\DRIVERS\avgldx64.sys
S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\system32\DRIVERS\avgmfx64.sys
S1 Avgtdia;AVG TDI Driver;C:\Windows\system32\DRIVERS\avgtdia.sys
S1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys
S2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
S2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
S2 MBAMService;MBAMService;e:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
S2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
S2 vToolbarUpdater;vToolbarUpdater;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe
S3 AVGIDSDriver;AVGIDSDriver;C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys
S3 AVGIDSFilter;AVGIDSFilter;C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys
S3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys
S3 MBAMProtector;MBAMProtector;C:\Windows\system32\drivers\mbam.sys
S3 netr7364;Stuurprogramma voor RT73 USB draadloze LAN-kaart voor Vista;C:\Windows\system32\DRIVERS\netr7364.sys
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys
S3 RTL8167;Realtek 8167 NT-stuurprogramma;C:\Windows\system32\DRIVERS\Rt64win7.sys
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
Inhoud van de ‘Gedeelde Taken’ map
2011-11-23 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
2011-11-23 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
——— x86-64 ———–
@=“{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}”
2010-10-06 23:36:00 97792 —-a-w- C:\Users\Gebruiker\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
@=“{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}”
2010-10-06 23:36:00 97792 —-a-w- C:\Users\Gebruiker\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
@=“{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}”
2010-10-06 23:36:00 97792 —-a-w- C:\Users\Gebruiker\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
@=“{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}”
2010-10-06 23:36:00 97792 —-a-w- C:\Users\Gebruiker\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
“BCSSync”=“C:\Program Files\Microsoft Office\Office14\BCSSync.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
——- Bijkomende Scan ——-
uLocal Page = C:\Windows\system32\blank.htm
uStart Page = hxxp://www.google.nl/
IE: &Verzenden naar OneNote - C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: E&xporteren naar Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - C:\Users\Gebruiker\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
TCP: DhcpNameServer = 192.168.1.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll
FF - ProfilePath - C:\Users\Gebruiker\AppData\Roaming\Mozilla\Firefox\Profiles\3b8i8jfo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2603445&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Softonic Netherlands Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2603445&SearchSource=13
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: HP Smart Web Printing: smartwebprinting@hp.com - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF - Ext: HP Smart Web Printing: smartwebprinting@hp.com - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF - Ext: MyAshampoo Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - %profile%\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
FF - Ext: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - %profile%\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: Softonic Netherlands Toolbar: {65ca59ee-9920-4d7f-8c41-bfa12403261a} - %profile%\extensions\{65ca59ee-9920-4d7f-8c41-bfa12403261a}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
- - - - ORPHANS VERWIJDERD - - - -
WebBrowser-{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - (no file)
WebBrowser-{65CA59EE-9920-4D7F-8C41-BFA12403261A} - (no file)
WebBrowser-{77F8C945-4B74-4BD6-A073-E0D1997EDCE8} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
AddRemove-Adobe Shockwave Player - C:\Windows\system32\Adobe\Shockwave 11\uninstaller.exe
——————— VERGRENDELDE REGISTER SLEUTELS ———————
@Denied: (2) (S-1-5-21-1848488349-641486460-2212997090-1000)
@Denied: (2) (LocalSystem)
“Progid”=“WindowsLiveMail.Email.1”
@Denied: (2) (S-1-5-21-1848488349-641486460-2212997090-1000)
@Denied: (2) (LocalSystem)
“Progid”=“WindowsLiveMail.VCard.1”
@Denied: (A 2) (Everyone)
@=“FlashBroker”
“LocalizedString”=“@C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101”
“Enabled”=dword:00000001
@=“C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe”
@=“{FAB3E735-69C7-453B-A446-B6823C6DF1C9}”
@Denied: (A 2) (Everyone)
@=“Shockwave Flash Object”
@=“C:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx”
“ThreadingModel”=“Apartment”
@=“0”
@=“ShockwaveFlash.ShockwaveFlash.10”
@=“C:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1”
@=“{D27CDB6B-AE6D-11cf-96B8-444553540000}”
@=“1.0”
@=“ShockwaveFlash.ShockwaveFlash”
@Denied: (A 2) (Everyone)
@=“Macromedia Flash Factory Object”
@=“C:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx”
“ThreadingModel”=“Apartment”
@=“FlashFactory.FlashFactory.1”
@=“C:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1”
@=“{D27CDB6B-AE6D-11cf-96B8-444553540000}”
@=“1.0”
@=“FlashFactory.FlashFactory”
@Denied: (A 2) (Everyone)
@=“IFlashBroker4”
@=“{00020424-0000-0000-C000-000000000046}”
@=“{FAB3E735-69C7-453B-A446-B6823C6DF1C9}”
“Version”=“1.0”
@Denied: (Full) (Everyone)
———————— Andere Aktieve Processen ————————
C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
**************************************************************************
Voltooingstijd: 2011-11-23 21:07:31 - machine werd herstart
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Databaseversie: 8224
Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421
23-11-2011 21:43:48
mbam-log-2011-11-23 (21-43-48).txt
Scantype: Volledige scan (C:\|D:\|)
Objecten gescand: 331106
Verstreken tijd: 24 minuut/minuten, 28 seconde(n)
Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 0
Registerwaarden geïnfecteerd: 0
Registerdata geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 2
Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)
Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)
Registersleutels geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)
Registerwaarden geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)
Registerdata geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)
Mappen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)
Bestanden geïnfecteerd:
c:\Qoobox\quarantine\C\Users\gebruiker\AppData\Roaming\svchost.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
d:\downloads\nieuwe map\vlcsetup (1).exe (Adware.Hotbar) -> Quarantined and deleted successfully.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:48:54, on 23-11-2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Users\Gebruiker\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
C:\Program Files (x86)\AVG Secure Search\vprot.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Trend Micro\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL
O2 - BHO: Aanmeldhulp voor Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\8.0.0.40\AVG Secure Search_toolbar.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\8.0.0.40\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: “C:\Program Files (x86)\AVG\AVG2012\avgtray.exe”
O4 - HKLM\..\Run: “e:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe” /starttray
O4 - HKLM\..\Run: “C:\Program Files (x86)\AVG Secure Search\vprot.exe”
O4 - HKLM\..\RunOnce: cmd.exe /c start http://www.avg.com/nl.special-uninstallation-feedback-appf?lic=OUFWRlJFRS1WMEtNQy1FOVZVVy1FVzBWQS1VVTNYTC1GRVc5Ny1PVTZF“&”inst=NzctNjI1ODU5MTI0LVFJWDErMy1GTDEwKzEtTElDKzg4LVNQMSsxLVNQMVRCKzEtU1VEKzEtVFVHKzMtUzFJKzEtU1UzKzEtRERUKzA“&”prod=90“&”ver=10.0.1390
O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-21-1848488349-641486460-2212997090-1003\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User ‘UpdatusUser’)
O4 - HKUS\S-1-5-21-1848488349-641486460-2212997090-1003\..\RunOnce: C:\Windows\System32\mctadmin.exe (User ‘UpdatusUser’)
O4 - Startup: Dropbox.lnk = Gebruiker\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Verzenden naar OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Gebruiker\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra ‘Tools’ menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra ‘Tools’ menuitem: &Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra ‘Tools’ menuitem: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: Accelerated graphics
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe
O23 - Service: MBAMService - Malwarebytes Corporation - e:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: vToolbarUpdater - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
–
End of file - 11152 bytes
Is dit wat u nodig heeft
en is dit de oorzaak van het uitvallen van de pc
gr Hans
Doorzoek het forum
Zoeken met Startpagina
Startpagina Thema's
