trage laptop

• 

  Henk

  15-05-2012 20:54

  mijn laptop is zeer traag als ie eenmaal opgestart is,

  het lijkt zelfs of ie af en toe zelfs helemaal vast loopt

  waar kan dit aan liggen??

  ik heb de gevraagde scan's uitgevoerd.

  Malwarebytes Anti-Malware (-evaluatieversie-) 1.61.0.1400

  www.malwarebytes.org

  Databaseversie: v2012.05.15.05

  Windows Vista Service Pack 2 x86 NTFS (Veilige modus/netwerkmogelijkheden)

  Internet Explorer 9.0.8112.16421

  Gerlenda :: PC_VAN_GERLENDA

  Realtime bescherming: Uitgeschakeld

  15-5-2012 20:41:32

  mbam-log-2012-05-15 (20-41-32).txt

  Scantype: Snelle scan

  Ingeschakelde scanopties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM

  Uitgeschakelde scanopties: P2P

  Objecten gescand: 188434

  Verstreken tijd: 9 minuut/minuten, 35 seconde(n)

  Geheugenprocessen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registerwaarden gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registerdata gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Mappen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Bestanden gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  (einde)

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 20:52:43, on 15-5-2012

  Platform: Windows Vista SP2 (WinNT 6.00.1906)

  MSIE: Internet Explorer v9.00 (9.00.8112.16421)

  Boot mode: Safe mode with network support

  Running processes:

  C:\Windows\Explorer.EXE

  C:\Windows\system32\wbem\unsecapp.exe

  C:\Program Files\Windows Media Player\wmpnscfg.exe

  C:\Program Files\Google\Chrome\Application\chrome.exe

  C:\Windows\system32\igfxsrvc.exe

  C:\Windows\system32\rundll32.exe

  C:\Program Files\Google\Chrome\Application\chrome.exe

  C:\Program Files\Google\Chrome\Application\chrome.exe

  C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

  C:\Program Files\Google\Chrome\Application\chrome.exe

  C:\Windows\notepad.exe

  C:\Windows\system32\cmd.exe

  C:\Program Files\Trend Micro\Hijackthis\HijackThis.exe

  C:\Windows\system32\cmd.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nl.msn.com/?ocid=iehp

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  R3 - URLSearchHook: (no name) - {3ad798d0-4642-4c55-bc14-cfe7dd19e0d1} - (no file)

  O1 - Hosts: ::1 localhost

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - (no file)

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

  O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - (no file)

  O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - “C:\Program Files\Microsoft\BingBar\BingExt.dll” (file missing)

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

  O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - “C:\Program Files\Microsoft\BingBar\BingExt.dll” (file missing)

  O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

  O4 - HKLM\..\Run: C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

  O4 - HKLM\..\Run: C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL

  O4 - HKLM\..\Run: C:\Windows\system32\igfxpers.exe

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: C:\Windows\system32\igfxtray.exe

  O4 - HKLM\..\Run: C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP

  O4 - HKLM\..\Run: %ProgramFiles%\TOSHIBA\TBS\HSON.exe

  O4 - HKLM\..\Run: C:\Windows\system32\hkcmd.exe

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\Language\Language.exe”

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

  O4 - HKLM\..\Run: “C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe” /WinStart

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKLM\..\RunOnce: C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

  O4 - HKCU\..\Run: TOSCDSPD.EXE

  O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU “C:\Users\Gerlenda\AppData\Local\Temp\E_S5FEA.tmp” /EF “HKCU”

  O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background

  O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

  O4 - HKCU\..\Run: “C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe”

  O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

  O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

  O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra ‘Tools’ menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O11 - Options group: Accelerated graphics

  O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - http://cdn.scan.onecare.live.com/resource/download/scanner/nl-NL/wlscctrl2.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O18 - Protocol: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - (no file)

  O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - (no file)

  O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

  O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

  O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

  O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

  O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

  O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

  –

  End of file - 8574 bytes

  Rapporteren
• 

  Henk

  15-05-2012 21:06

  Ik kan op dit moment alleen normaal in de veilige modus iets op de pc doen

  dan heeft de pc nergens last van.

  Rapporteren
• 

  Ben

  15-05-2012 21:25

  Hallo Henk,

  1. Ik zie geen virusscanner of gebruik je MSE heb je er geen één dan kan je altijd een gratis scanner installeren.

  Avast

  Avira (Deze toont wel een popup na een update)

  BitDefender

  MSE

  2. Start HijackThis;

  Klik met de rechtermuis op het programma Hijackthis en kies voor “Uitvoeren als Administrator”

  Kies voor ‘Do a system scan only’.

  Selecteer alle regels die hier onder staan.

  R3 - URLSearchHook: (no name) - {3ad798d0-4642-4c55-bc14-cfe7dd19e0d1} - (no file)

  O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - (no file)

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: TmBpIeBHO - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - (no file)

  O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - “C:\Program Files\Microsoft\BingBar\BingExt.dll” (file missing)

  O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

  O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - “C:\Program Files\Microsoft\BingBar\BingExt.dll” (file missing)

  O18 - Protocol: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - (no file)

  O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - (no file)

  Sluit alle open vensters(behalve HijackThis), klik daarna op Fix checked en bevestig het door in het volgende scherm op Ja te klikken.

  3. Plaats hierna een nieuw HijackThis logje (probeer in gewone modus)

  Gr.Ben

  

  Antivirusprikbord

  Rapporteren
• 

  Henk

  15-05-2012 22:07

  Ik heb idd het anti virus program tijdelijk verwijderd maar zet hem er z.s.m. weer op

  Hier de nieuwe log…

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 22:03:33, on 15-5-2012

  Platform: Windows Vista SP2 (WinNT 6.00.1906)

  MSIE: Internet Explorer v9.00 (9.00.8112.16421)

  Boot mode: Normal

  Running processes:

  C:\Windows\system32\Dwm.exe

  C:\Windows\Explorer.EXE

  C:\Windows\system32\taskeng.exe

  C:\Program Files\Windows Defender\MSASCui.exe

  C:\Windows\RtHDVCpl.exe

  C:\Windows\System32\igfxpers.exe

  C:\Windows\System32\igfxtray.exe

  C:\Windows\System32\hkcmd.exe

  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe

  C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

  C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Windows\ehome\ehtray.exe

  C:\Program Files\Windows Media Player\wmpnscfg.exe

  C:\Windows\system32\wbem\unsecapp.exe

  C:\Windows\system32\igfxsrvc.exe

  C:\Windows\ehome\ehmsas.exe

  C:\Program Files\Google\Chrome\Application\chrome.exe

  C:\Program Files\Google\Chrome\Application\chrome.exe

  C:\Windows\System32\rundll32.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Windows\system32\rundll32.exe

  C:\Program Files\Google\Chrome\Application\chrome.exe

  C:\Program Files\Google\Chrome\Application\chrome.exe

  C:\Program Files\Google\Chrome\Application\chrome.exe

  C:\Windows\system32\Taskmgr.exe

  C:\Windows\system32\cmd.exe

  C:\Windows\system32\conime.exe

  C:\Program Files\Trend Micro\Hijackthis\HijackThis.exe

  C:\Windows\system32\cmd.exe

  C:\Windows\system32\SearchFilterHost.exe

  C:\Windows\system32\DllHost.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nl.msn.com/?ocid=iehp

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  O1 - Hosts: ::1 localhost

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - (no file)

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll

  O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

  O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

  O4 - HKLM\..\Run: C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

  O4 - HKLM\..\Run: C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL

  O4 - HKLM\..\Run: C:\Windows\system32\igfxpers.exe

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: C:\Windows\system32\igfxtray.exe

  O4 - HKLM\..\Run: C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP

  O4 - HKLM\..\Run: %ProgramFiles%\TOSHIBA\TBS\HSON.exe

  O4 - HKLM\..\Run: C:\Windows\system32\hkcmd.exe

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\Language\Language.exe”

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

  O4 - HKLM\..\Run: “C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe” /WinStart

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe” /starttray

  O4 - HKCU\..\Run: TOSCDSPD.EXE

  O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU “C:\Users\Gerlenda\AppData\Local\Temp\E_S5FEA.tmp” /EF “HKCU”

  O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background

  O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

  O4 - HKCU\..\Run: “C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe”

  O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

  O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

  O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra ‘Tools’ menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll

  O11 - Options group: Accelerated graphics

  O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - http://cdn.scan.onecare.live.com/resource/download/scanner/nl-NL/wlscctrl2.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

  O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)

  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

  O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

  O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

  O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe

  O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe

  O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe

  O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

  O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

  O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

  O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

  –

  End of file - 9781 bytes

  Rapporteren
• 

  fazantje

  15-05-2012 22:44

  Hoi Henk,

  Verwijder vanuit: start - configuratiescherm - programma's en onderdelen: Spybot SD.

  Spybot SD werkt n.l. ook zeer vertragend.

  Start na verwijdering jou laptop opnieuw op en laat Ccleaner eens draaien:

  Download Ccleaner hier.

  Bij het installeren van de nieuwste Ccleaner wordt nu ook Google Chrome (helaas) mee geinstalleerd.

  Je moet tijdens het installeren een vinkje weg halen, zodat Google Chrome niet geinstalleerd word.

  Installeer CCleaner en start CCleaner op.

  Klik in de linkse kolom op Cleaner.

  Klik achtereenvolgens op Analyseren en Opschonen.

  Klik vervolgens in de linkse kolom op Register en klik op Scan naar problemen.

  Als er fouten gevonden worden klik je op Herstel geselecteerde problemen en OK.

  Dan krijg je de vraag om een back-up te maken, klik op JA en kies dan Herstel alle geselecteerde fouten.

  Sluit hierna CCleaner af.

  Graag zou ik een nieuw HijackThis logje willen zien en horen hoe het nu gaat met de traagheid.

  We kunnen anders dieper gaan kijken.

  Succes,

  Huib;)

  

  Rapporteren
• 

  Henk

  15-05-2012 23:14

  de pc is aanzienlijk sneller

  hier nog een log file:

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 23:13:05, on 15-5-2012

  Platform: Windows Vista SP2 (WinNT 6.00.1906)

  MSIE: Internet Explorer v9.00 (9.00.8112.16421)

  Boot mode: Normal

  Running processes:

  C:\Windows\system32\taskeng.exe

  C:\Windows\system32\taskeng.exe

  F:\setup.exe

  C:\Windows\system32\Dwm.exe

  C:\Windows\Explorer.EXE

  C:\Program Files\Windows Defender\MSASCui.exe

  C:\Windows\RtHDVCpl.exe

  C:\Windows\System32\igfxpers.exe

  C:\Windows\System32\igfxtray.exe

  C:\Windows\System32\hkcmd.exe

  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Windows\ehome\ehtray.exe

  C:\Program Files\Windows Media Player\wmpnscfg.exe

  C:\Windows\system32\igfxsrvc.exe

  C:\Windows\system32\wbem\unsecapp.exe

  C:\Windows\System32\rundll32.exe

  C:\Windows\ehome\ehmsas.exe

  F:\Vizor32\VizorHtmlDialog.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Program Files\Google\Chrome\Application\chrome.exe

  C:\Program Files\Google\Chrome\Application\chrome.exe

  C:\Windows\system32\rundll32.exe

  C:\Program Files\Google\Chrome\Application\chrome.exe

  C:\Program Files\Google\Chrome\Application\chrome.exe

  C:\Windows\system32\SearchFilterHost.exe

  C:\Windows\system32\cmd.exe

  C:\Windows\system32\conime.exe

  C:\Program Files\Trend Micro\Hijackthis\HijackThis.exe

  C:\Windows\system32\cmd.exe

  C:\Windows\system32\DllHost.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nl.msn.com/?ocid=iehp

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  O1 - Hosts: ::1 localhost

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

  O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

  O4 - HKLM\..\Run: C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

  O4 - HKLM\..\Run: C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL

  O4 - HKLM\..\Run: C:\Windows\system32\igfxpers.exe

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: C:\Windows\system32\igfxtray.exe

  O4 - HKLM\..\Run: C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP

  O4 - HKLM\..\Run: %ProgramFiles%\TOSHIBA\TBS\HSON.exe

  O4 - HKLM\..\Run: C:\Windows\system32\hkcmd.exe

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\Language\Language.exe”

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

  O4 - HKLM\..\Run: “C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe” /WinStart

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKCU\..\Run: TOSCDSPD.EXE

  O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU “C:\Users\Gerlenda\AppData\Local\Temp\E_S5FEA.tmp” /EF “HKCU”

  O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background

  O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

  O4 - HKCU\..\Run: “C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe”

  O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

  O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

  O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra ‘Tools’ menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O11 - Options group: Accelerated graphics

  O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - http://cdn.scan.onecare.live.com/resource/download/scanner/nl-NL/wlscctrl2.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

  O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

  O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

  O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

  O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

  O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

  –

  End of file - 8300 bytes

  Rapporteren
• 

  Ben

  16-05-2012 08:14

  Hallo Henk,

  Zet nu eerst een virusscanner op je pc.

  Als je voor een gratis scanner kiest neem dan Avast die is zeer compleet.

  Avast

  Scan daar je pc mee en vertel of die nog wat heeft gevonden en hoe je pc nu draait.

  Gr.Ben

  

  Antivirusprikbord

  Rapporteren
• 

  Henk

  16-05-2012 21:36

  Ik heb er een betaalde antivirus programma Trendmicro internetsecurity 2011 opgezet die ik al had dus dat is weer geregeld,

  zijn er nog vreemde dingen in de laatste hijackthis scan te zien dan\??

  de laptop loopt nu wel weer een stuk sneller maar volgens mij kan ie nog beter presteren.

  Henk

  Rapporteren
• 

  Ben

  16-05-2012 21:40

  hallo Henk,

  Dan gaan we dieper kijken.

  Download ComboFix van >>Hier<<, tevens kunt u daar lezen hoe u Combofix dient te gebruiken.

  * BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op.

  1. Bij Windows XP gebruikers zal er indien nodig gevraagd worden om de "Recovery Console" te installeren, sta dit dan toe (hiervoor is een actieve internet verbinding vereist)

  2. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix.

  * ( hier of hier staat een handleiding over hoe je deze kan uitschakelen)

  3. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.

  4. Dubbelklik op "Combofix.exe" om de tool te starten.

  5. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de ‘tool’ vastlopen.

  * Noot !!! Als er een error wordt getoond met de melding “Illegal operation attempted on a registery key that has been marked for deletion.” herstart dan de computer.

  6. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

  Gr.Ben

  

  Antivirusprikbord

  Rapporteren
• 

  Henk

  16-05-2012 22:37

  hier de combofix log:

  succes met zoeken.

  ComboFix 12-05-16.02 - Gerlenda 16-05-2012 22:18:24.1.2 - x86

  Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.1013.346

  Gestart vanuit: c:\users\Gerlenda\Desktop\ComboFix.exe

  AV: Trend Micro Titanium Internet Security *Disabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}

  SP: Trend Micro Titanium Internet Security *Disabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}

  SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

  .

  .

  (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

  .

  .

  c:\programdata\xp

  c:\programdata\xp\EBLib.dll

  c:\programdata\xp\TPwSav.sys

  c:\windows\iun6002.exe

  .

  .

  (((((((((((((((((((( Bestanden Gemaakt van 2012-04-16 to 2012-05-16 ))))))))))))))))))))))))))))))

  .

  .

  2012-05-16 20:27 . 2012-05-16 20:28 ——– d—–w- c:\users\Gerlenda\AppData\Local\temp

  2012-05-16 20:27 . 2012-05-16 20:27 ——– d—–w- c:\users\Default\AppData\Local\temp

  2012-05-15 21:27 . 2010-08-08 10:18 92112 —-a-w- c:\windows\system32\drivers\tmtdi.sys

  2012-05-15 21:27 . 2010-08-08 10:18 80464 —-a-w- c:\windows\system32\drivers\tmactmon.sys

  2012-05-15 21:27 . 2010-08-08 10:18 64080 —-a-w- c:\windows\system32\drivers\tmevtmgr.sys

  2012-05-15 20:43 . 2012-04-03 08:16 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe

  2012-05-15 20:43 . 2012-04-03 08:16 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe

  2012-05-15 20:43 . 2012-04-02 13:36 2044928 —-a-w- c:\windows\system32\win32k.sys

  2012-05-15 20:17 . 2012-04-13 07:36 6734704 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4E2615A3-43FE-4C6B-9F91-CBC0D39DA82D}\mpengine.dll

  2012-05-15 17:21 . 2012-05-15 17:21 ——– d—–w- c:\users\Gerlenda\AppData\Roaming\Product_RM

  2012-05-15 17:21 . 2012-05-15 17:21 ——– d—–w- c:\programdata\PC Tools

  2012-05-15 17:14 . 2012-05-15 17:17 ——– d—–w- c:\program files\TeamViewer

  2012-05-15 17:10 . 2012-05-15 17:10 ——– d—–w- c:\users\Gerlenda\AppData\Roaming\TeamViewer

  2012-05-14 18:39 . 2012-05-14 18:39 ——– d—–w- c:\users\Gerlenda\AppData\Local\Nero_AG

  2012-04-25 18:56 . 2012-04-25 21:22 ——– d—–w- c:\programdata\Spybot - Search & Destroy

  .

  .

  .

  ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

  .

  2012-03-08 16:50 . 2012-03-08 16:50 49016 —-a-w- c:\windows\system32\sirenacm.dll

  2012-03-08 16:37 . 2012-03-08 16:37 302448 —-a-w- c:\windows\WLXPGSS.SCR

  2012-03-08 16:32 . 2012-04-09 18:47 39272 —-a-w- c:\windows\system32\drivers\fssfltr.sys

  2012-03-04 20:46 . 2011-07-14 20:41 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

  2012-02-29 15:11 . 2012-04-14 19:28 5120 —-a-w- c:\windows\system32\wmi.dll

  2012-02-29 15:11 . 2012-04-14 19:28 172032 —-a-w- c:\windows\system32\wintrust.dll

  2012-02-29 15:09 . 2012-04-14 19:28 157696 —-a-w- c:\windows\system32\imagehlp.dll

  2012-02-29 13:32 . 2012-04-14 19:28 12800 —-a-w- c:\windows\system32\drivers\fs_rec.sys

  2012-02-28 01:18 . 2012-04-14 19:30 1799168 —-a-w- c:\windows\system32\jscript9.dll

  2012-02-28 01:11 . 2012-04-14 19:29 1427456 —-a-w- c:\windows\system32\inetcpl.cpl

  2012-02-28 01:11 . 2012-04-14 19:30 1127424 —-a-w- c:\windows\system32\wininet.dll

  2012-02-28 01:03 . 2012-04-14 19:30 2382848 —-a-w- c:\windows\system32\mshtml.tlb

  2012-02-27 21:00 . 2012-02-27 21:00 1606368 —-a-w- c:\windows\system32\drivers\athw.sys

  2012-02-27 20:56 . 2012-02-27 20:56 80488 —-a-w- c:\windows\system32\RtNicProp32.dll

  2012-02-27 20:56 . 2012-02-27 20:56 305256 —-a-w- c:\windows\system32\drivers\Rtlh86.sys

  2012-02-27 20:56 . 2012-02-27 20:56 100968 —-a-w- c:\windows\system32\RTNUninst32.dll

  2012-02-23 21:41 . 2010-09-18 11:28 472808 —-a-w- c:\windows\system32\deployJava1.dll

  2012-02-23 08:18 . 2009-10-03 07:05 237072 ——w- c:\windows\system32\MpSigStub.exe

  .

  .

  ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

  .

  .

  *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

  REGEDIT4

  .

  “Sidebar”=“c:\program files\Windows Sidebar\sidebar.exe”

  “ehTray.exe”=“c:\windows\ehome\ehTray.exe”

  “WMPNSCFG”=“c:\program files\Windows Media Player\WMPNSCFG.exe”

  “swg”=“c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe”

  .

  “RtHDVCpl”=“RtHDVCpl.exe”

  “TPwrMain”=“c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE”

  “Toshiba Registration”=“c:\program files\Toshiba\Registration\ToshibaRegistration.exe”

  “SVPWUTIL”=“c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe”

  “Persistence”=“c:\windows\system32\igfxpers.exe”

  “NvSvc”=“c:\windows\system32\nvsvc.dll”

  “NvMediaCenter”=“c:\windows\system32\NvMcTray.dll”

  “NvCplDaemon”=“c:\windows\system32\NvCpl.dll”

  “IgfxTray”=“c:\windows\system32\igfxtray.exe”

  “HWSetup”=“c:\program files\TOSHIBA\Utilities\HWSetup.exe”

  “HSON”=“c:\program files\TOSHIBA\TBS\HSON.exe”

  “HotKeysCmds”=“c:\windows\system32\hkcmd.exe”

  “RemoteControl”=“c:\program files\CyberLink\PowerDVD\PDVDServ.exe”

  “LanguageShortcut”=“c:\program files\CyberLink\PowerDVD\Language\Language.exe”

  “AppleSyncNotifier”=“c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe”

  “NBAgent”=“c:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe”

  “SunJavaUpdateSched”=“c:\program files\Common Files\Java\Java Update\jusched.exe”

  “Trend Micro Titanium”=“c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe”

  “Trend Micro Client Framework”=“c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe”

  .

  “EnableUIADesktopToggle”= 0 (0x0)

  “EnableLinkedConnections”= 1 (0x1)

  .

  “aux”=wdmaud.drv

  .

  BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe

  .

  backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup

  backupExtension=.CommonStartup

  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr

  .

  2007-01-17 12:46 534648 —-a-w- c:\program files\TOSHIBA\FlashCards\TCrdMain.exe

  .

  2011-03-30 04:59 937920 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

  .

  2011-09-07 22:58 37296 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

  .

  2007-02-13 07:30 405504 —-a-w- c:\program files\Camera Assistant Software for Toshiba\traybar.exe

  .

  2007-01-25 06:00 179200 —-a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATICAE.EXE

  .

  2006-11-06 16:14 34352 —-a-w- c:\program files\TOSHIBA\Utilities\KeNotify.exe

  .

  2007-02-06 13:21 509496 —-a-w- c:\program files\TOSHIBA\SmoothView\SmoothView.exe

  .

  2009-03-20 06:36 1451304 —-a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

  .

  2007-03-02 13:10 577536 —-a-w- c:\program files\TOSHIBA\Toshiba Online Product Information\TOPI.exe

  .

  “DisableMonitoring”=dword:00000001

  .

  “DisableMonitoring”=dword:00000001

  .

  “DisableMonitoring”=dword:00000001

  .

  LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

  getPlusHelper REG_MULTI_SZ getPlusHelper

  .

  Inhoud van de ‘Gedeelde Taken’ map

  .

  2012-04-24 c:\windows\Tasks\Google Software Updater.job

  - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe

  .

  2012-05-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

  - c:\program files\Google\Update\GoogleUpdate.exe

  .

  2012-05-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

  - c:\program files\Google\Update\GoogleUpdate.exe

  .

  .

  ——- Bijkomende Scan ——-

  .

  uSearchAssistant = hxxp://www.google.com/ie

  uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

  IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

  TCP: DhcpNameServer = 192.168.2.254

  .

  - - - - ORPHANS VERWIJDERD - - - -

  .

  WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

  WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

  HKCU-Run-TOSCDSPD - TOSCDSPD.EXE

  MSConfigStartUp-NDSTray - NDSTray.exe

  .

  .

  .

  **************************************************************************

  .

  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

  Rootkit scan 2012-05-16 22:28

  Windows 6.0.6002 Service Pack 2 NTFS

  .

  scannen van verborgen processen …

  .

  scannen van verborgen autostart items …

  .

  scannen van verborgen bestanden …

  .

  Scan succesvol afgerond

  verborgen bestanden: 0

  .

  **************************************************************************

  .

  ——————— VERGRENDELDE REGISTER SLEUTELS ———————

  .

  @Denied: (A) (Users)

  @Denied: (A) (Everyone)

  @Allowed: (B 1 2 3 4 5) (S-1-5-20)

  “BlindDial”=dword:00000000

  “MSCurrentCountry”=dword:0000007b

  .

  Voltooingstijd: 2012-05-16 22:32:22

  ComboFix-quarantined-files.txt 2012-05-16 20:32

  .

  Pre-Run: 23.240.916.992 bytes beschikbaar

  Post-Run: 23.342.489.600 bytes beschikbaar

  .

  - - End Of File - - 3C24060D60EC6503746F4FCABC5DBA9D

  Rapporteren

Dit topic is gesloten, er kunnen geen reacties meer worden geplaatst.