Gewoon een logfile ter controle

• 

  Kevin

  17-03-2012 02:55

  Het is een tijdje dat ik m'n pc heb opgeschoond en aangezien ik niet of nauwelijks verstand van heb wil ik graag een logfile plaatsen, zodat men het voor mij kan kijken of er nog iets aan kan veranderen.

  Ik had namelijk laatst wel vaak van een error als ik ook maar iets open, IE, WMP etc.

  Ook meer een standaard controle dus hoop hiermee verder te kunnen.

  Mvg,

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 2:39:27, on 17-3-2012

  Platform: Windows Vista SP2 (WinNT 6.00.1906)

  MSIE: Internet Explorer v7.00 (7.00.6002.18005)

  Boot mode: Normal

  Running processes:

  C:\Windows\system32\Dwm.exe

  C:\Windows\system32\taskeng.exe

  C:\Windows\Explorer.EXE

  C:\Program Files\Acer\Empowering Technology\SysMonitor.exe

  C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe

  C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

  C:\Windows\RtHDVCpl.exe

  C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe

  C:\Windows\System32\rundll32.exe

  C:\Windows\WindowsMobile\wmdSync.exe

  C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  C:\Program Files\AVG\AVG10\avgtray.exe

  C:\Program Files\Ask.com\Updater\Updater.exe

  C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\Windows\ehome\ehtray.exe

  C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe

  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

  C:\Windows\ehome\ehmsas.exe

  C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

  C:\Program Files\Windows Media Player\wmpnscfg.exe

  C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

  C:\Program Files\Rainmeter\Rainmeter.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

  C:\Windows\system32\conime.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  C:\Program Files\Real\RealPlayer\RealPlay.exe

  C:\Windows\system32\SndVol.exe

  C:\Program Files\Common Files\Real\Update_OB\realsched.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Windows Live\Messenger\msnmsgr.exe

  C:\Program Files\Windows Live\Contacts\wlcomm.exe

  C:\Windows\system32\SearchFilterHost.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=1&o=vp32&d=1208&m=aspire_x1700

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O1 - Hosts: ::1 localhost

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll

  O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

  O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.415.1646\swg.dll

  O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll

  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

  O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll

  O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\SysMonitor.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe

  O4 - HKLM\..\Run: “C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe” -s

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: “C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe” /runcleanupscript

  O4 - HKLM\..\Run: %windir%\WindowsMobile\wmdSync.exe

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  O4 - HKLM\..\Run: C:\Program Files\AVG\AVG10\avgtray.exe

  O4 - HKLM\..\Run: “C:\Program Files\Ask.com\Updater\Updater.exe”

  O4 - HKLM\..\Run: C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft LifeCam\LifeExp.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  O4 - HKLM\..\RunOnce: C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: “C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Electronic Arts\EADM\Core.exe” -silent

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\KiesHelper.exe /s

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

  O4 - HKCU\..\Run: “C:\Users\Jacky\AppData\Local\Google\Update\GoogleUpdate.exe” /c

  O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

  O4 - HKCU\..\RunOnce: C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729; OfficeLiveConnector.1.5; OfficeLivePatch.1.3; .NET4.0C; AskTbNRO/5.13.1.18107)” -“http://www.dadsproject.com/Klokkijken/klokkijken.php”

  O4 - HKCU\..\RunOnce: C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe monthly

  O4 - HKUS\S-1-5-18\..\RunOnce: C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe monthly (User ‘SYSTEEM’)

  O4 - HKUS\.DEFAULT\..\RunOnce: C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe monthly (User ‘Default user’)

  O4 - Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

  O4 - Startup: Rainmeter (2).lnk = C:\Program Files\Rainmeter\Rainmeter.exe

  O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

  O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

  O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

  O9 - Extra ‘Tools’ menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

  O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

  O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O9 - Extra ‘Tools’ menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

  O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe

  O13 - Gopher Prefix:

  O16 - DPF: Yahoo! Word Racer - http://origin.games.yahoo.net/games/clients/y/wt1_x.cab

  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab

  O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.13.0.cab

  O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldnl-nl.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll

  O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

  O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe

  O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe

  O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

  O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

  O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

  O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe

  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

  O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)

  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

  O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe

  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

  O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

  O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

  O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

  –

  End of file - 14229 bytes

  Malwarebytes' Anti-Malware 1.41

  Database versie: 2926

  Windows 6.0.6002 Service Pack 2

  29-1-2011 2:21:52

  mbam-log-2011-01-29 (02-21-52).txt

  Scan type: Volledige Scan (C:\|D:\|)

  Objecten gescand: 283856

  Verstreken tijd: 50 minute(s), 23 second(s)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 0

  Registersleutels geïnfecteerd: 729

  Registerwaarden geïnfecteerd: 0

  Registerdata bestanden geïnfecteerd: 0

  Mappen geïnfecteerd: 0

  Bestanden geïnfecteerd: 0

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Geheugenmodulen geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Malware kon ik niet erbij zetten omdat het te lang werd.. dus ik weet niet hoe ik moet sturen.

  Rapporteren
• 

  fazantje

  17-03-2012 08:49

  Hoi Kevin,

  Zou je HijackThis opnieuw Hier willen downloaden, want je hebt n.l. een zeer verouderde versie gebruikt.

  Dus graag een nieuw HijackThis logje.

  Het MBAM logje mag in een nieuw bericht zetten, zodat we toch kunnen zien welke besmettingen er zijn.

  Dus gewoon het oude MBAM logje plaatsen en een nieuw HijackThis logje.

  Succes,

  Huib;)

  

  Rapporteren
• 

  fazantje

  17-03-2012 10:33

  Hoi Kevin,

  Ik werd door Jos H wakker geschud(tu) Tis nog vroeg heh.

  Voer gewoon even alle stappen die hier staan, en plaats daarna de 2 nieuwe logjes.

  In jou vorige bericht staan oude logjes, zie:

  Logfile of Trend Micro HijackThis v2.0.2 <—– verouderde versie.

  mbam-log-2011-01-29 (02-21-52).txt <—– ook verouderde versie en verkeerde datum.

  Succes,

  Huib;)

  

  Rapporteren
• 

  Kevin

  06-04-2012 02:21

  Sorry was iets tussengekomen, vandaar late reactie, maar hier de toegevoegde logs:

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 2:17:24, on 6-4-2012

  Platform: Windows Vista SP2 (WinNT 6.00.1906)

  MSIE: Internet Explorer v7.00 (7.00.6002.18005)

  Boot mode: Normal

  Running processes:

  C:\Windows\system32\Dwm.exe

  C:\Windows\system32\taskeng.exe

  C:\Windows\Explorer.EXE

  C:\Program Files\Acer\Empowering Technology\SysMonitor.exe

  C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe

  C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

  C:\Windows\RtHDVCpl.exe

  C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe

  C:\Windows\System32\rundll32.exe

  C:\Windows\WindowsMobile\wmdSync.exe

  C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  C:\Program Files\AVG\AVG10\avgtray.exe

  C:\Program Files\Ask.com\Updater\Updater.exe

  C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\Windows\ehome\ehtray.exe

  C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe

  C:\Windows\ehome\ehmsas.exe

  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

  C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

  C:\Program Files\Windows Media Player\wmpnscfg.exe

  C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

  C:\Program Files\Rainmeter\Rainmeter.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Windows\system32\conime.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  C:\Program Files\Mozilla Firefox\firefox.exe

  C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

  C:\Windows\system32\SndVol.exe

  C:\Windows\notepad.exe

  C:\Windows\system32\SearchFilterHost.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=1&o=vp32&d=1208&m=aspire_x1700

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O1 - Hosts: ::1 localhost

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll

  O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

  O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.415.1646\swg.dll

  O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll

  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

  O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll

  O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\SysMonitor.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe

  O4 - HKLM\..\Run: “C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe” -s

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: %windir%\WindowsMobile\wmdSync.exe

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  O4 - HKLM\..\Run: C:\Program Files\AVG\AVG10\avgtray.exe

  O4 - HKLM\..\Run: “C:\Program Files\Ask.com\Updater\Updater.exe”

  O4 - HKLM\..\Run: C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft LifeCam\LifeExp.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: “C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Electronic Arts\EADM\Core.exe” -silent

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\KiesHelper.exe /s

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

  O4 - HKCU\..\Run: “C:\Users\Jacky\AppData\Local\Google\Update\GoogleUpdate.exe” /c

  O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

  O4 - HKCU\..\RunOnce: C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729; OfficeLiveConnector.1.5; OfficeLivePatch.1.3; .NET4.0C; AskTbNRO/5.13.1.18107)” -“http://www.dadsproject.com/Klokkijken/klokkijken.php”

  O4 - HKCU\..\RunOnce: C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe monthly

  O4 - HKUS\S-1-5-18\..\RunOnce: C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe monthly (User ‘SYSTEEM’)

  O4 - HKUS\.DEFAULT\..\RunOnce: C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe monthly (User ‘Default user’)

  O4 - Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

  O4 - Startup: Rainmeter (2).lnk = C:\Program Files\Rainmeter\Rainmeter.exe

  O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

  O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

  O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

  O9 - Extra ‘Tools’ menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

  O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

  O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O9 - Extra ‘Tools’ menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

  O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe

  O16 - DPF: Yahoo! Word Racer - http://origin.games.yahoo.net/games/clients/y/wt1_x.cab

  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab

  O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.13.0.cab

  O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldnl-nl.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll

  O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

  O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe

  O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe

  O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

  O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

  O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

  O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe

  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

  O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)

  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

  O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - Unknown owner - C:\Program Files\PC Tools Firewall Plus\FWService.exe

  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

  O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

  O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

  O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

  –

  End of file - 14008 bytes

  Malwarebytes Anti-Malware 1.60.1.1000

  www.malwarebytes.org

  Databaseversie: v2012.04.05.10

  Windows Vista Service Pack 2 x86 NTFS

  Internet Explorer 7.0.6002.18005

  J :: PC_VAN_J

  6-4-2012 2:11:21

  mbam-log-2012-04-06 (02-16-31).txt

  Scantype: Snelle scan

  Ingeschakelde scanopties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM

  Uitgeschakelde scanopties: P2P

  Objecten gescand: 193073

  Verstreken tijd: 4 minuut/minuten, 23 seconde(n)

  Geheugenprocessen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registerwaarden gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registerdata gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Mappen gedetecteerd: 1

  C:\Users\Jacky\AppData\Roaming\Personal Security Sentinel (Rogue.PersonalSecuritySentinel) -> Geen actie ondernomen.

  Bestanden gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  (einde)

  Rapporteren
• 

  Ben

  06-04-2012 09:11

  Hallo Kevin,

  Verwijder Ad-Aware die vertraagd je pc behoorlijk.

  Klik op Start > (Instellingen) > Configuratiescherm > Een programma verwijderen:

  Ad-Aware

  Ask Toolbar

  Laat Mbam opnieuw scannen (eerst weer updaten)

  En laat dan het genen wat gevonden is Verwijderen!

  Wanneer de scan voltooid is, klik op OK, daarna “Bekijk Resultaten” om de resultaten te zien.

  Zorg ervoor dat daar alles aangevinkt is, daarna klik op: Verwijder geselecteerde.

  Plaats hierna het Mbam logje en een nieuw HijackThis logje.

  Gr.Ben

  

  Antivirusprikbord

  Rapporteren
• 

  Kevin

  07-04-2012 00:52

  Malwarebytes Anti-Malware 1.60.1.1000

  www.malwarebytes.org

  Databaseversie: v2012.04.06.08

  Windows Vista Service Pack 2 x86 NTFS

  Internet Explorer 7.0.6002.18005

  J :: PC_VAN_J

  7-4-2012 0:38:35

  mbam-log-2012-04-07 (00-45-17).txt

  Scantype: Snelle scan

  Ingeschakelde scanopties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM

  Uitgeschakelde scanopties: P2P

  Objecten gescand: 195129

  Verstreken tijd: 6 minuut/minuten, 1 seconde(n)

  Geheugenprocessen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registerwaarden gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registerdata gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Mappen gedetecteerd: 1

  C:\Users\Jacky\AppData\Roaming\Personal Security Sentinel (Rogue.PersonalSecuritySentinel) -> Geen actie ondernomen.

  Bestanden gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  (einde)

  Rapporteren
• 

  Ben

  07-04-2012 08:54

  Hallo Kevin,

  Je heb mbam nog niet Rogue.PersonalSecuritySentinel laten verwijderen!

  Mappen gedetecteerd: 1

  C:\Users\Jacky\AppData\Roaming\Personal Security Sentinel (Rogue.PersonalSecuritySentinel) -> Geen actie ondernomen.

  Hier de handleiding hoe je mbam moet gebruiken: Klik

  Doe daarna:

  Verwijder Ad-Aware die vertraagd je pc behoorlijk.

  Klik op Start > (Instellingen) > Configuratiescherm > Een programma verwijderen:

  Ad-Aware

  Ask Toolbar

  Plaats hierna het Mbam logje en een nieuw HijackThis logje.

  Hierna kunnen we je pas helpen.

  Gr.Ben

  

  Antivirusprikbord

  Rapporteren
• 

  Kevin

  11-04-2012 12:41

  Ik kon ad-aware niet verwijderen, dus had het via een andere programma gedaan, maar het is uiteindelijk gelukt;

  Hier is m'n log;

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 12:40:56, on 11-4-2012

  Platform: Windows Vista SP2 (WinNT 6.00.1906)

  MSIE: Internet Explorer v7.00 (7.00.6002.18005)

  Boot mode: Normal

  Running processes:

  C:\Windows\system32\Dwm.exe

  C:\Windows\Explorer.EXE

  C:\Windows\system32\taskeng.exe

  C:\Program Files\Acer\Empowering Technology\SysMonitor.exe

  C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe

  C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

  C:\Windows\RtHDVCpl.exe

  C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe

  C:\Windows\System32\rundll32.exe

  C:\Windows\WindowsMobile\wmdSync.exe

  C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  C:\Program Files\AVG\AVG10\avgtray.exe

  C:\Program Files\Ask.com\Updater\Updater.exe

  C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\Windows\ehome\ehtray.exe

  C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe

  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

  C:\Windows\ehome\ehmsas.exe

  C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

  C:\Program Files\Windows Media Player\wmpnscfg.exe

  C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

  C:\Program Files\Rainmeter\Rainmeter.exe

  C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

  C:\Program Files\Windows Live\Messenger\msnmsgr.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Windows\system32\SearchFilterHost.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=1&o=vp32&d=1208&m=aspire_x1700

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O1 - Hosts: ::1 localhost

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll

  O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

  O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.415.1646\swg.dll

  O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll

  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

  O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll

  O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\SysMonitor.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe

  O4 - HKLM\..\Run: “C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe” -s

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: %windir%\WindowsMobile\wmdSync.exe

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  O4 - HKLM\..\Run: C:\Program Files\AVG\AVG10\avgtray.exe

  O4 - HKLM\..\Run: “C:\Program Files\Ask.com\Updater\Updater.exe”

  O4 - HKLM\..\Run: C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft LifeCam\LifeExp.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: “C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Electronic Arts\EADM\Core.exe” -silent

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\KiesHelper.exe /s

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

  O4 - HKCU\..\Run: “C:\Users\Jacky\AppData\Local\Google\Update\GoogleUpdate.exe” /c

  O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

  O4 - HKCU\..\RunOnce: C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729; OfficeLiveConnector.1.5; OfficeLivePatch.1.3; .NET4.0C; AskTbNRO/5.13.1.18107)” -“http://www.dadsproject.com/Klokkijken/klokkijken.php”

  O4 - HKUS\S-1-5-18\..\RunOnce: C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe monthly (User ‘SYSTEEM’)

  O4 - HKUS\.DEFAULT\..\RunOnce: C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe monthly (User ‘Default user’)

  O4 - Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

  O4 - Startup: Rainmeter (2).lnk = C:\Program Files\Rainmeter\Rainmeter.exe

  O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

  O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

  O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

  O9 - Extra ‘Tools’ menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

  O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

  O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O9 - Extra ‘Tools’ menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

  O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe

  O16 - DPF: Yahoo! Word Racer - http://origin.games.yahoo.net/games/clients/y/wt1_x.cab

  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab

  O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.13.0.cab

  O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldnl-nl.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll

  O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

  O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe

  O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe

  O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

  O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

  O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

  O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe

  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (file missing)

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

  O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)

  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

  O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - Unknown owner - C:\Program Files\PC Tools Firewall Plus\FWService.exe

  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

  O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

  O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

  O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

  –

  End of file - 13753 bytes

  Malwarebytes Anti-Malware 1.60.1.1000

  www.malwarebytes.org

  Databaseversie: v2012.04.06.08

  Windows Vista Service Pack 2 x86 NTFS

  Internet Explorer 7.0.6002.18005

  J :: PC_VAN_J

  11-4-2012 12:18:40

  mbam-log-2012-04-11 (12-18-40).txt

  Scantype: Snelle scan

  Ingeschakelde scanopties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM

  Uitgeschakelde scanopties: P2P

  Objecten gescand: 193492

  Verstreken tijd: 5 minuut/minuten, 38 seconde(n)

  Geheugenprocessen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registerwaarden gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registerdata gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Mappen gedetecteerd: 1

  C:\Users\Jacky\AppData\Roaming\Personal Security Sentinel (Rogue.PersonalSecuritySentinel) -> Succesvol in quarantaine geplaatst en verwijderd.

  Bestanden gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  (einde)

  Rapporteren
• 

  Ben

  11-04-2012 13:41

  Hallo Kevin,

  1. Klik op Start > (Instellingen) > Configuratiescherm > Een programma verwijderen (indien aanwezig)

  Ask Toolbar

  2. Start HijackThis;

  Klik met de rechtermuis op het programma Hijackthis en kies voor “Uitvoeren als Administrator”

  Kies voor ‘Do a system scan only’.

  Selecteer alle regels die hier onder staan: (indien aanwezig)

  R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O4 - HKLM\..\Run: “C:\Program Files\Ask.com\Updater\Updater.exe”

  Sluit alle open vensters(behalve HijackThis), klik daarna op Fix checked en bevestig het door in het volgende scherm op Ja te klikken.

  Herstart je pc.

  3. Download ComboFix van >>Hier<<, tevens kunt u daar lezen hoe u Combofix dient te gebruiken.

  * BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op.

  * Bij Windows XP gebruikers zal er indien nodig gevraagd worden om de "Recovery Console" te installeren, sta dit dan toe (hiervoor is een actieve internet verbinding vereist)

  * Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix.

  * ( hier of hier staat een handleiding over hoe je deze kan uitschakelen)

  * Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.

  * Dubbelklik op "Combofix.exe" om de tool te starten.

  * Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de ‘tool’ vastlopen.

  * Noot !!! Als er een error wordt getoond met de melding “Illegal operation attempted on a registery key that has been marked for deletion.” herstart dan de computer.

  * Wanneer ComboFix klaar is, zal het het een logbestand voor je maken.

  Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht samen met een nieuw HijackThis logje.

  Gr.Ben

  

  Antivirusprikbord

  Rapporteren
• 

  Kevin

  13-04-2012 02:23

  Ask toolbar kan ik niet verwijderen, zie het namelijk niet staan bij programma's onderdelen..

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 2:22:02, on 13-4-2012

  Platform: Windows Vista SP2 (WinNT 6.00.1906)

  MSIE: Internet Explorer v7.00 (7.00.6002.18005)

  Boot mode: Normal

  Running processes:

  C:\Windows\system32\Dwm.exe

  C:\Windows\system32\taskeng.exe

  C:\Windows\Explorer.EXE

  C:\Program Files\Acer\Empowering Technology\SysMonitor.exe

  C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe

  C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

  C:\Windows\RtHDVCpl.exe

  C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe

  C:\Windows\System32\rundll32.exe

  C:\Windows\WindowsMobile\wmdSync.exe

  C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  C:\Program Files\AVG\AVG10\avgtray.exe

  C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

  C:\Windows\ehome\ehtray.exe

  C:\Windows\ehome\ehmsas.exe

  C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe

  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

  C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

  C:\Program Files\Windows Media Player\wmpnscfg.exe

  C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

  C:\Program Files\Rainmeter\Rainmeter.exe

  C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Windows\system32\NOTEPAD.EXE

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  C:\Windows\system32\SearchFilterHost.exe

  C:\Users\Jacky\Downloads\HijackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=1&o=vp32&d=1208&m=aspire_x1700

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll

  O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

  O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.415.1646\swg.dll

  O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll

  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

  O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\SysMonitor.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe

  O4 - HKLM\..\Run: “C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe” -s

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: %windir%\WindowsMobile\wmdSync.exe

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  O4 - HKLM\..\Run: C:\Program Files\AVG\AVG10\avgtray.exe

  O4 - HKLM\..\Run: C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft LifeCam\LifeExp.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: “C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\KiesHelper.exe /s

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

  O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

  O4 - Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

  O4 - Startup: Rainmeter (2).lnk = C:\Program Files\Rainmeter\Rainmeter.exe

  O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

  O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

  O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

  O9 - Extra ‘Tools’ menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

  O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

  O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O9 - Extra ‘Tools’ menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

  O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe

  O16 - DPF: Yahoo! Word Racer - http://origin.games.yahoo.net/games/clients/y/wt1_x.cab

  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab

  O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.13.0.cab

  O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldnl-nl.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll

  O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

  O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe

  O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe

  O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

  O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

  O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

  O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe

  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (file missing)

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

  O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)

  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

  O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - Unknown owner - C:\Program Files\PC Tools Firewall Plus\FWService.exe

  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

  O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

  O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

  O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

  –

  End of file - 12363 bytes

  ComboFix 12-04-12.03 - Jacky 13-04-2012 1:58.3.4 - x86

  Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.3071.1790

  Gestart vanuit: c:\users\Jacky\Desktop\ComboFix.exe

  AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

  FW: PC Tools Firewall Plus *Enabled* {7352CBFB-3EEC-25C5-276E-DC9378FC688F}

  SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

  SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

  .

  .

  (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

  .

  .

  c:\users\Jacky\AppData\Local\Temp\ae201572-4813-4010-9ed2-ee29ddec066a\CliSecureRT.dll

  .

  —- Voorgaande Run ——-

  .

  c:\users\Jacky\AppData\Local\Temp\ae201572-4813-4010-9ed2-ee29ddec066a\CliSecureRT.dll

  c:\windows\Downloaded Program Files\popcaploader.inf

  c:\windows\system32\muzapp.exe

  c:\windows\system32\system32\3DAudio.ax

  c:\windows\system32\system32\avrt.dll

  c:\windows\system32\system32\cis-2.4.dll

  c:\windows\system32\system32\issacapi_bs-2.3.dll

  c:\windows\system32\system32\issacapi_pe-2.3.dll

  c:\windows\system32\system32\issacapi_se-2.3.dll

  c:\windows\system32\system32\MACXMLProto.dll

  c:\windows\system32\system32\MaDRM.dll

  c:\windows\system32\system32\MaJGUILib.dll

  c:\windows\system32\system32\MAMACExtract.dll

  c:\windows\system32\system32\MASetupCleaner.exe

  c:\windows\system32\system32\MaXMLProto.dll

  c:\windows\system32\system32\mfplat.dll

  c:\windows\system32\system32\MK_Lyric.dll

  c:\windows\system32\system32\MSCLib.dll

  c:\windows\system32\system32\MSFLib.dll

  c:\windows\system32\system32\MSLUR71.dll

  c:\windows\system32\system32\msvcp60.dll

  c:\windows\system32\system32\MTTELECHIP.dll

  c:\windows\system32\system32\MTXSYNCICON.dll

  c:\windows\system32\system32\muzaf1.dll

  c:\windows\system32\system32\muzapp.dll

  c:\windows\system32\system32\muzapp.exe

  c:\windows\system32\system32\muzdecode.ax

  c:\windows\system32\system32\muzeffect.ax

  c:\windows\system32\system32\muzmp4sp.ax

  c:\windows\system32\system32\muzmpgsp.ax

  c:\windows\system32\system32\muzoggsp.ax

  c:\windows\system32\system32\muzwmts.dll

  c:\windows\system32\system32\psapi.dll

  .

  .

  (((((((((((((((((((( Bestanden Gemaakt van 2012-03-13 to 2012-04-13 ))))))))))))))))))))))))))))))

  .

  .

  2012-04-13 00:04 . 2012-04-13 00:04 ——– d—–w- c:\users\Default\AppData\Local\temp

  2012-04-11 10:06 . 2012-04-11 10:06 ——– d—–w- c:\users\Jacky\AppData\Local\VS Revo Group

  2012-04-11 10:06 . 2009-12-30 08:21 27192 —-a-w- c:\windows\system32\drivers\revoflt.sys

  2012-04-11 10:06 . 2012-04-11 10:06 ——– d—–w- c:\program files\VS Revo Group

  2012-04-05 22:51 . 2011-10-27 08:01 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe

  2012-04-05 22:47 . 2012-01-31 10:59 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat

  2012-03-26 16:13 . 2012-03-26 16:13 9310 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC(23)\TEXTBOX.JS

  2012-03-16 22:33 . 2012-03-16 22:33 9310 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC(27)\TEXTBOX.JS

  .

  .

  .

  ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

  .

  2012-02-21 08:15 . 2011-05-14 20:10 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

  2011-11-08 20:34 . 2011-11-08 20:34 4995584 —-a-w- c:\program files\PortableFotoSketcher.exe

  .

  .

  ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

  .

  .

  *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

  REGEDIT4

  .

  2011-11-17 18:29 1515688 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

  .

  “{D4027C7F-154A-4066-A1AD-4243D8127440}”= “c:\program files\Ask.com\GenericAskToolbar.dll”

  .

  .

  @=“{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}”

  2008-07-29 16:52 121392 —-a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

  .

  “ehTray.exe”=“c:\windows\ehome\ehTray.exe”

  “TomTomHOME.exe”=“c:\program files\TomTom HOME 2\TomTomHOMERunner.exe”

  “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe”

  “KiesHelper”=“c:\program files\Samsung\Kies\KiesHelper.exe”

  “KiesTrayAgent”=“c:\program files\Samsung\Kies\KiesTrayAgent.exe”

  “KiesPDLR”=“c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe”

  “WMPNSCFG”=“c:\program files\Windows Media Player\WMPNSCFG.exe”

  .

  “Acer Empowering Technology Monitor”=“c:\program files\Acer\Empowering Technology\SysMonitor.exe”

  “EmpoweringTechnology”=“c:\program files\Acer\Empowering Technology\Framework.Launcher.exe”

  “eDataSecurity Loader”=“c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe”

  “PCMMediaSharing”=“c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe”

  “RtHDVCpl”=“RtHDVCpl.exe”

  “WarReg_PopUp”=“c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe”

  “00PCTFW”=“c:\program files\PC Tools Firewall Plus\FirewallGUI.exe”

  “NvCplDaemon”=“c:\windows\system32\NvCpl.dll”

  “NvMediaCenter”=“c:\windows\system32\NvMcTray.dll”

  “Windows Mobile-based device management”=“c:\windows\WindowsMobile\wmdSync.exe”

  “NeroFilterCheck”=“c:\program files\Common Files\Ahead\Lib\NeroCheck.exe”

  “KiesTrayAgent”=“c:\program files\Samsung\Kies\KiesTrayAgent.exe”

  “AVG_TRAY”=“c:\program files\AVG\AVG10\avgtray.exe”

  “PlusService”=“c:\program files\Yuna Software\Messenger Plus!\PlusService.exe”

  “SunJavaUpdateSched”=“c:\program files\Common Files\Java\Java Update\jusched.exe”

  “LifeCam”=“c:\program files\Microsoft LifeCam\LifeExp.exe”

  “Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe”

  “Adobe ARM”=“c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  .

  “EnableLUA”= 0 (0x0)

  “EnableUIADesktopToggle”= 0 (0x0)

  .

  BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

  .

  @=“Service”

  .

  path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk

  backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup

  backupExtension=.CommonStartup

  .

  2010-09-16 19:03 4425048 —-a-w- c:\program files\AIM\aim.exe

  .

  2009-10-08 11:01 107864 —-a-w- c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe

  .

  2008-04-25 20:36 28672 —-a-w- c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe

  .

  2005-12-22 15:55 2002432 —-a-w- c:\program files\Casema\casema.exe

  .

  2008-12-29 10:40 687560 —-a-w- c:\program files\DAEMON Tools Lite\daemon.exe

  .

  2009-03-19 12:38 5395288 —-a-w- c:\program files\DriverMax\devices.exe

  .

  2012-01-13 12:53 981680 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

  .

  2011-10-13 10:45 19550344 —-a-r- c:\program files\Skype\Phone\Skype.exe

  .

  “DisableMonitoring”=dword:00000001

  .

  “EnableNotificationsRef”=dword:00000006

  “EnableNotifications”=dword:00000001

  .

  S2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe

  .

  .

  LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

  WindowsMobile REG_MULTI_SZ wcescomm rapimgr

  LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

  .

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

  UxTuneUp

  .

  Inhoud van de ‘Gedeelde Taken’ map

  .

  2012-04-13 c:\windows\Tasks\1-klik Onderhoud.job

  - c:\program files\TuneUp Utilities 2009\OneClickStarter.exe

  .

  2012-04-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-213022234-2777563534-4171869386-1000Core.job

  - c:\users\Jacky\AppData\Local\Google\Update\GoogleUpdate.exe

  .

  2012-04-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-213022234-2777563534-4171869386-1000UA.job

  - c:\users\Jacky\AppData\Local\Google\Update\GoogleUpdate.exe

  .

  .

  ——- Bijkomende Scan ——-

  .

  uStart Page = hxxp://www.google.nl/

  mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=1&o=vp32&d=1208&m=aspire_x1700

  IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

  IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

  IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

  IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

  IE: {{C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - c:\microgaming\Poker\UnibetpokerMPP\MPPoker.exe

  TCP: DhcpNameServer = 212.54.40.25 212.54.35.25

  DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab

  DPF: Yahoo! Word Racer - hxxp://origin.games.yahoo.net/games/clients/y/wt1_x.cab

  FF - ProfilePath - c:\users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\

  FF - prefs.js: browser.startup.homepage - www.google.nl

  FF - prefs.js: keyword.URL - hxxp://www.samenc.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=peBfhbuR&q=

  FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

  FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

  FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

  FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

  FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

  FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

  FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

  FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

  FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

  FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

  FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

  FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

  FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

  FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\AVG\AVG10\Firefox

  FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

  FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com

  FF - user.js: keyword.URL - hxxp://www.samenc.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=peBfhbuR&q=

  FF - user.js: network.protocol-handler.warn-external.dnupdate - false

  .

  - - - - ORPHANS VERWIJDERD - - - -

  .

  HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe

  HKLM-Run-NPSStartup - (no file)

  HKU-Default-RunOnce-AutoLaunch - c:\program files\Lavasoft\Ad-Aware\AutoLaunch.exe

  AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe

  AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe

  AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe

  AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe

  AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe

  AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe

  AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe

  AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe

  AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe

  AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe

  AddRemove-15_Symbian_Samsung_PC_DLC_Driver - c:\program files\Samsung\USB Drivers\15_Symbian_Samsung_PC_DLC_Driver\Uninstall.exe

  AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe

  AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe

  AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe

  AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe

  AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe

  AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe

  AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe

  AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe

  AddRemove-{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} - c:\programdata\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe

  .

  .

  .

  **************************************************************************

  .

  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

  Rootkit scan 2012-04-13 02:06

  Windows 6.0.6002 Service Pack 2 NTFS

  .

  scannen van verborgen processen …

  .

  scannen van verborgen autostart items …

  .

  scannen van verborgen bestanden …

  .

  Scan succesvol afgerond

  verborgen bestanden: 0

  .

  **************************************************************************

  .

  ——————— VERGRENDELDE REGISTER SLEUTELS ———————

  .

  @Class=“Shell”

  @Allowed: (Read) (RestrictedCode)

  .

  @Class=“Shell”

  .

  @Class=“Shell”

  @Allowed: (Read) (RestrictedCode)

  .

  @Class=“Shell”

  .

  @Class=“Shell”

  @Allowed: (Read) (RestrictedCode)

  .

  @Class=“Shell”

  .

  @Denied: (A) (Users)

  @Denied: (A) (Everyone)

  @Allowed: (B 1 2 3 4 5) (S-1-5-20)

  “BlindDial”=dword:00000000

  .

  @Denied: (A) (Users)

  @Denied: (A) (Everyone)

  @Allowed: (B 1 2 3 4 5) (S-1-5-20)

  “BlindDial”=dword:00000000

  .

  @Denied: (A) (Users)

  @Denied: (A) (Everyone)

  @Allowed: (B 1 2 3 4 5) (S-1-5-20)

  “BlindDial”=dword:00000000

  .

  @Denied: (A) (Users)

  @Denied: (A) (Everyone)

  @Allowed: (B 1 2 3 4 5) (S-1-5-20)

  “BlindDial”=dword:00000000

  .

  ——————— DLLs Geladen Onder Lopende Processen ———————

  .

  - - - - - - - > ‘Explorer.exe’(5716)

  c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

  c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll

  .

  ———————— Andere Aktieve Processen ————————

  .

  c:\progra~1\AVG\AVG10\avgchsvx.exe

  c:\windows\system32\nvvsvc.exe

  c:\windows\system32\rundll32.exe

  c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

  c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

  c:\program files\Acer\Empowering Technology\Service\ETService.exe

  c:\windows\system32\FsUsbExService.Exe

  c:\program files\Common Files\LightScribe\LSSrvc.exe

  c:\program files\Microsoft LifeCam\MSCamS32.exe

  c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

  c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

  c:\program files\PC Tools Firewall Plus\FWService.exe

  c:\windows\system32\conime.exe

  c:\windows\system32\IoctlSvc.exe

  c:\program files\CyberLink\Shared Files\RichVideo.exe

  c:\windows\System32\tcpsvcs.exe

  c:\program files\TomTom HOME 2\TomTomHOMEService.exe

  c:\windows\System32\TUProgSt.exe

  c:\program files\AVG\AVG10\avgnsx.exe

  c:\program files\AVG\AVG10\avgemcx.exe

  c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

  c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

  c:\windows\RtHDVCpl.exe

  c:\windows\System32\rundll32.exe

  c:\windows\ehome\ehmsas.exe

  c:\program files\Microsoft Office\Office12\ONENOTEM.EXE

  c:\program files\Rainmeter\Rainmeter.exe

  c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe

  c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  c:\program files\Windows Media Player\wmpnetwk.exe

  c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

  c:\program files\PC Connectivity Solution\ServiceLayer.exe

  c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe

  c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe

  c:\\?\c:\windows\system32\wbem\WMIADAP.EXE

  c:\progra~1\AVG\AVG10\avgrsx.exe

  c:\program files\AVG\AVG10\avgcsrvx.exe

  .

  **************************************************************************

  .

  Voltooingstijd: 2012-04-13 02:12:36 - machine werd herstart

  ComboFix-quarantined-files.txt 2012-04-13 00:12

  .

  Pre-Run: 25.631.592.448 bytes beschikbaar

  Post-Run: 25.516.052.480 bytes beschikbaar

  .

  - - End Of File - - A40933A421089F468FD8A21096192D8D

  Rapporteren

Dit topic is gesloten, er kunnen geen reacties meer worden geplaatst.