Archief - gewoon een checkup

hier is het logje

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:08:10, on 13/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\smax4 .exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor .exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt .exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\Program Files\Brother\Brmfl04a\BrStDvPt .exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Brother\ControlCenter2\brctrcen .exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
C:\WINDOWS\system32\uykbydft.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ctfmon .exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
F3 - REG:win.ini: load=C:\WINDOWS\system32\mlljh.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\System32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4 .exe" /tray
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [946d8a77] rundll32.exe "C:\WINDOWS\system32\eqfkukrs.dll",b
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1198436318827
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\system32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\uykbydft.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6165 bytes

mvg dragon_warrior

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

logje van combofix
ComboFix 08-01-13.1 - gilber1234 2008-01-13 15:13:43.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1525 [GMT 1:00]
Running from: C:\Documents and Settings\gilber1234\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\gilber1234\Desktop\Find Spyware Remover.lnk
C:\Documents and Settings\gilber1234\Desktop\Free Online Dating.lnk
C:\Documents and Settings\gilber1234\Desktop\Go to Casino.lnk
C:\Documents and Settings\gilber1234\Start Menu\Programs\Outerinfo
C:\Documents and Settings\gilber1234\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\gilber1234\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\pos10.tmp
C:\pos100.tmp
C:\pos1000.tmp
C:\pos1001.tmp
C:\pos1002.tmp
C:\pos1003.tmp
C:\pos1006.tmp
C:\pos1007.tmp
C:\pos1008.tmp
C:\pos1009.tmp
C:\pos100A.tmp
C:\pos100B.tmp
C:\pos100C.tmp
C:\pos100D.tmp
C:\pos100E.tmp
C:\pos100F.tmp
C:\pos101.tmp
C:\pos1010.tmp
C:\pos1011.tmp
C:\pos1012.tmp
C:\pos1013.tmp
C:\pos1014.tmp
C:\pos1015.tmp
C:\pos1017.tmp
C:\pos1018.tmp
C:\pos1019.tmp
C:\pos101A.tmp
C:\pos101B.tmp
C:\pos101C.tmp
C:\pos101D.tmp
C:\pos102.tmp
C:\pos1020.tmp
C:\pos1021.tmp
C:\pos1022.tmp
C:\pos1023.tmp
C:\pos1024.tmp
C:\pos1025.tmp
C:\pos1026.tmp
C:\pos1027.tmp
C:\pos1029.tmp
C:\pos102A.tmp
C:\pos102B.tmp
C:\pos102C.tmp
C:\pos102D.tmp
C:\pos102E.tmp
C:\pos102F.tmp
C:\pos103.tmp
C:\pos1030.tmp
C:\pos1031.tmp
C:\pos1032.tmp
C:\pos1034.tmp
C:\pos1036.tmp
C:\pos1037.tmp
C:\pos1038.tmp
C:\pos1039.tmp
C:\pos103A.tmp
C:\pos103B.tmp
C:\pos103C.tmp
C:\pos103D.tmp
C:\pos103E.tmp
C:\pos104.tmp
C:\pos1040.tmp
C:\pos1041.tmp
C:\pos1042.tmp
C:\pos1043.tmp
C:\pos1046.tmp
C:\pos1047.tmp
C:\pos1048.tmp
C:\pos1049.tmp
C:\pos104A.tmp
C:\pos104B.tmp
C:\pos104C.tmp
C:\pos104D.tmp
C:\pos104F.tmp
C:\pos105.tmp
C:\pos1050.tmp
C:\pos1051.tmp
C:\pos1052.tmp
C:\pos1053.tmp
C:\pos1054.tmp
C:\pos1056.tmp
C:\pos1058.tmp
C:\pos1059.tmp
C:\pos105A.tmp
C:\pos105B.tmp
C:\pos105C.tmp
C:\pos105D.tmp
C:\pos105E.tmp
C:\pos105F.tmp
C:\pos106.tmp
C:\pos1060.tmp
C:\pos1062.tmp
C:\pos1063.tmp
C:\pos1064.tmp
C:\pos1065.tmp
C:\pos1066.tmp
C:\pos1067.tmp
C:\pos1068.tmp
C:\pos106B.tmp
C:\pos106C.tmp
C:\pos106D.tmp
C:\pos106E.tmp
C:\pos106F.tmp
C:\pos107.tmp
C:\pos1070.tmp
C:\pos1071.tmp
C:\pos1072.tmp
C:\pos1073.tmp
C:\pos1074.tmp
C:\pos1076.tmp
C:\pos1077.tmp
C:\pos1078.tmp
C:\pos1079.tmp
C:\pos107A.tmp
C:\pos107B.tmp
C:\pos107C.tmp
C:\pos107D.tmp
C:\pos107F.tmp
C:\pos108.tmp
C:\pos1081.tmp
C:\pos1082.tmp
C:\pos1083.tmp
C:\pos1084.tmp
C:\pos1085.tmp
C:\pos1086.tmp
C:\pos1087.tmp
C:\pos1088.tmp
C:\pos1089.tmp
C:\pos108A.tmp
C:\pos108B.tmp
C:\pos108C.tmp
C:\pos108D.tmp
C:\pos108E.tmp
C:\pos109.tmp
C:\pos1090.tmp
C:\pos1091.tmp
C:\pos1092.tmp
C:\pos1093.tmp
C:\pos1094.tmp
C:\pos1095.tmp
C:\pos1096.tmp
C:\pos1097.tmp
C:\pos1098.tmp
C:\pos1099.tmp
C:\pos109A.tmp
C:\pos109D.tmp
C:\pos109E.tmp
C:\pos109F.tmp
C:\pos10A.tmp
C:\pos10A0.tmp
C:\pos10A1.tmp
C:\pos10A2.tmp
C:\pos10A4.tmp
C:\pos10A5.tmp
C:\pos10A6.tmp
C:\pos10A7.tmp
C:\pos10A8.tmp
C:\pos10A9.tmp
C:\pos10AA.tmp
C:\pos10AB.tmp
C:\pos10AC.tmp
C:\pos10AD.tmp
C:\pos10AE.tmp
C:\pos10B0.tmp
C:\pos10B1.tmp
C:\pos10B3.tmp
C:\pos10B4.tmp
C:\pos10B5.tmp
C:\pos10B6.tmp
C:\pos10B7.tmp
C:\pos10B8.tmp
C:\pos10B9.tmp
C:\pos10BA.tmp
C:\pos10BB.tmp
C:\pos10BD.tmp
C:\pos10BE.tmp
C:\pos10BF.tmp
C:\pos10C.tmp
C:\pos10C0.tmp
C:\pos10C1.tmp
C:\pos10C2.tmp
C:\pos10C3.tmp
C:\pos10C4.tmp
C:\pos10C5.tmp
C:\pos10C6.tmp
C:\pos10C7.tmp
C:\pos10C8.tmp
C:\pos10C9.tmp
C:\pos10CA.tmp
C:\pos10CC.tmp
C:\pos10CD.tmp
C:\pos10CF.tmp
C:\pos10D.tmp
C:\pos10D0.tmp
C:\pos10D1.tmp
C:\pos10D2.tmp
C:\pos10D3.tmp
C:\pos10D4.tmp
C:\pos10D6.tmp
C:\pos10D7.tmp
C:\pos10D8.tmp
C:\pos10D9.tmp
C:\pos10DA.tmp
C:\pos10DB.tmp
C:\pos10DC.tmp
C:\pos10DD.tmp
C:\pos10DE.tmp
C:\pos10DF.tmp
C:\pos10E.tmp
C:\pos10E0.tmp
C:\pos10E1.tmp
C:\pos10E2.tmp
C:\pos10E3.tmp
C:\pos10E4.tmp
C:\pos10E5.tmp
C:\pos10E6.tmp
C:\pos10E7.tmp
C:\pos10E8.tmp
C:\pos10E9.tmp
C:\pos10EA.tmp
C:\pos10EB.tmp
C:\pos10EC.tmp
C:\pos10ED.tmp
C:\pos10EE.tmp
C:\pos10EF.tmp
C:\pos10F.tmp
C:\pos10F0.tmp
C:\pos10F1.tmp
C:\pos10F2.tmp
C:\pos10F3.tmp
C:\pos10F4.tmp
C:\pos10F5.tmp
C:\pos10F6.tmp
C:\pos10F7.tmp
C:\pos10F8.tmp
C:\pos10F9.tmp
C:\pos10FA.tmp
C:\pos10FB.tmp
C:\pos10FC.tmp
C:\pos10FD.tmp
C:\pos10FE.tmp
C:\pos10FF.tmp
C:\pos11.tmp
C:\pos110.tmp
C:\pos1100.tmp
C:\pos1101.tmp
C:\pos1102.tmp
C:\pos1103.tmp
C:\pos1104.tmp
C:\pos1105.tmp
C:\pos1106.tmp
C:\pos1107.tmp
C:\pos1108.tmp
C:\pos1109.tmp
C:\pos110A.tmp
C:\pos110B.tmp
C:\pos110C.tmp
C:\pos110D.tmp
C:\pos110E.tmp
C:\pos110F.tmp
C:\pos111.tmp
C:\pos1110.tmp
C:\pos1111.tmp
C:\pos1112.tmp
C:\pos1113.tmp
C:\pos1114.tmp
C:\pos1115.tmp
C:\pos1116.tmp
C:\pos1117.tmp
C:\pos1118.tmp
C:\pos1119.tmp
C:\pos111A.tmp
C:\pos111B.tmp
C:\pos111C.tmp
C:\pos111D.tmp
C:\pos111E.tmp
C:\pos111F.tmp
C:\pos112.tmp
C:\pos1120.tmp
C:\pos1121.tmp
C:\pos1122.tmp
C:\pos1123.tmp
C:\pos1124.tmp
C:\pos1125.tmp
C:\pos1126.tmp
C:\pos1127.tmp
C:\pos1128.tmp
C:\pos1129.tmp
C:\pos112A.tmp
C:\pos112B.tmp
C:\pos112C.tmp
C:\pos112D.tmp
C:\pos112E.tmp
C:\pos112F.tmp
C:\pos113.tmp
C:\pos1130.tmp
C:\pos1131.tmp
C:\pos1132.tmp
C:\pos1133.tmp
C:\pos1134.tmp
C:\pos1135.tmp
C:\pos1136.tmp
C:\pos1137.tmp
C:\pos1138.tmp
C:\pos1139.tmp
C:\pos113A.tmp
C:\pos113B.tmp
C:\pos113C.tmp
C:\pos113D.tmp
C:\pos113E.tmp
C:\pos113F.tmp
C:\pos114.tmp
C:\pos1140.tmp
C:\pos1141.tmp
C:\pos1142.tmp
C:\pos1143.tmp
C:\pos1144.tmp
C:\pos1145.tmp
C:\pos1146.tmp
C:\pos1147.tmp
C:\pos1148.tmp
C:\pos1149.tmp
C:\pos114A.tmp
C:\pos114B.tmp
C:\pos114C.tmp
C:\pos114D.tmp
C:\pos114E.tmp
C:\pos114F.tmp
C:\pos115.tmp
C:\pos1150.tmp
C:\pos1151.tmp
C:\pos1152.tmp
C:\pos1153.tmp
C:\pos1154.tmp
C:\pos1155.tmp
C:\pos1156.tmp
C:\pos1157.tmp
C:\pos1158.tmp
C:\pos1159.tmp
C:\pos115A.tmp
C:\pos115B.tmp
C:\pos115C.tmp
C:\pos115D.tmp
C:\pos115E.tmp
C:\pos115F.tmp
C:\pos1160.tmp
C:\pos1161.tmp
C:\pos1162.tmp
C:\pos1163.tmp
C:\pos1164.tmp
C:\pos1165.tmp
C:\pos1166.tmp
C:\pos1167.tmp
C:\pos1168.tmp
C:\pos1169.tmp
C:\pos116A.tmp
C:\pos116B.tmp
C:\pos116C.tmp
C:\pos116D.tmp
C:\pos116E.tmp
C:\pos116F.tmp
C:\pos117.tmp
C:\pos1170.tmp
C:\pos1171.tmp
C:\pos1172.tmp
C:\pos1173.tmp
C:\pos1174.tmp
C:\pos1175.tmp
C:\pos1176.tmp
C:\pos1177.tmp
C:\pos1178.tmp
C:\pos1179.tmp
C:\pos117A.tmp
C:\pos117B.tmp
C:\pos117C.tmp
C:\pos117D.tmp
C:\pos117E.tmp
C:\pos117F.tmp
C:\pos1180.tmp
C:\pos1181.tmp
C:\pos1182.tmp
C:\pos1183.tmp
C:\pos1184.tmp
C:\pos1185.tmp
C:\pos1186.tmp
C:\pos1187.tmp
C:\pos1188.tmp
C:\pos1189.tmp
C:\pos118A.tmp
C:\pos118B.tmp
C:\pos118C.tmp
C:\pos118D.tmp
C:\pos118E.tmp
C:\pos118F.tmp
C:\pos119.tmp
C:\pos1190.tmp
C:\pos1191.tmp
C:\pos1192.tmp
C:\pos1193.tmp
C:\pos1194.tmp
C:\pos1195.tmp
C:\pos1196.tmp
C:\pos1197.tmp
C:\pos1198.tmp
C:\pos1199.tmp
C:\pos119A.tmp
C:\pos119B.tmp
C:\pos119C.tmp
C:\pos119D.tmp
C:\pos119E.tmp
C:\pos119F.tmp
C:\pos11A.tmp
C:\pos11A0.tmp
C:\pos11A1.tmp
C:\pos11A2.tmp
C:\pos11A3.tmp
C:\pos11A4.tmp
C:\pos11A5.tmp
C:\pos11A6.tmp
C:\pos11A7.tmp
C:\pos11A8.tmp
C:\pos11A9.tmp
C:\pos11AA.tmp
C:\pos11AB.tmp
C:\pos11AC.tmp
C:\pos11AD.tmp
C:\pos11AE.tmp
C:\pos11AF.tmp
C:\pos11B.tmp
C:\pos11B0.tmp
C:\pos11B1.tmp
C:\pos11B2.tmp
C:\pos11B3.tmp
C:\pos11B4.tmp
C:\pos11B5.tmp
C:\pos11B6.tmp
C:\pos11B7.tmp
C:\pos11B8.tmp
C:\pos11B9.tmp
C:\pos11BA.tmp
C:\pos11BB.tmp
C:\pos11BC.tmp
C:\pos11BD.tmp
C:\pos11BE.tmp
C:\pos11BF.tmp
C:\pos11C.tmp
C:\pos11D.tmp
C:\pos11E.tmp
C:\pos11F.tmp
C:\pos120.tmp
C:\pos121.tmp
C:\pos122.tmp
C:\pos123.tmp
C:\pos124.tmp
C:\pos126.tmp
C:\pos127.tmp
C:\pos128.tmp
C:\pos129.tmp
C:\pos12A.tmp
C:\pos12B.tmp
C:\pos12C.tmp
C:\pos12D.tmp
C:\pos12E.tmp
C:\pos12F.tmp
C:\pos130.tmp
C:\pos133.tmp
C:\pos134.tmp
C:\pos135.tmp
C:\pos136.tmp
C:\pos137.tmp
C:\pos138.tmp
C:\pos139.tmp
C:\pos13A.tmp
C:\pos13C.tmp
C:\pos13D.tmp
C:\pos13E.tmp
C:\pos13F.tmp
C:\pos140.tmp
C:\pos143.tmp
C:\pos144.tmp
C:\pos145.tmp
C:\pos146.tmp
C:\pos147.tmp
C:\pos148.tmp
C:\pos149.tmp
C:\pos14A.tmp
C:\pos14B.tmp
C:\pos14D.tmp
C:\pos14E.tmp
C:\pos14F.tmp
C:\pos150.tmp
C:\pos151.tmp
C:\pos152.tmp
C:\pos153.tmp
C:\pos155.tmp
C:\pos156.tmp
C:\pos158.tmp
C:\pos159.tmp
C:\pos15A.tmp
C:\pos15B.tmp
C:\pos15C.tmp
C:\pos15D.tmp
C:\pos15E.tmp
C:\pos15F.tmp
C:\pos161.tmp
C:\pos162.tmp
C:\pos163.tmp
C:\pos164.tmp
C:\pos165.tmp
C:\pos166.tmp
C:\pos167.tmp
C:\pos169.tmp
C:\pos16A.tmp
C:\pos16C.tmp
C:\pos16D.tmp
C:\pos16E.tmp
C:\pos16F.tmp
C:\pos170.tmp
C:\pos171.tmp
C:\pos172.tmp
C:\pos173.tmp
C:\pos174.tmp
C:\pos175.tmp
C:\pos176.tmp
C:\pos177.tmp
C:\pos178.tmp
C:\pos17A.tmp
C:\pos17B.tmp
C:\pos17C.tmp
C:\pos17F.tmp
C:\pos18.tmp
C:\pos180.tmp
C:\pos181.tmp
C:\pos182.tmp
C:\pos183.tmp
C:\pos184.tmp
C:\pos185.tmp
C:\pos187.tmp
C:\pos188.tmp
C:\pos189.tmp
C:\pos18A.tmp
C:\pos18B.tmp
C:\pos18C.tmp
C:\pos18D.tmp
C:\pos18E.tmp
C:\pos18F.tmp
C:\pos190.tmp
C:\pos191.tmp
C:\pos192.tmp
C:\pos193.tmp
C:\pos196.tmp
C:\pos197.tmp
C:\pos198.tmp
C:\pos199.tmp
C:\pos19A.tmp
C:\pos19B.tmp
C:\pos19C.tmp
C:\pos19D.tmp
C:\pos19E.tmp
C:\pos19F.tmp
C:\pos1A1.tmp
C:\pos1A2.tmp
C:\pos1A3.tmp
C:\pos1A4.tmp
C:\pos1A5.tmp
C:\pos1A6.tmp
C:\pos1A7.tmp
C:\pos1A8.tmp
C:\pos1A9.tmp
C:\pos1AA.tmp
C:\pos1AB.tmp
C:\pos1AC.tmp
C:\pos1AE.tmp
C:\pos1B0.tmp
C:\pos1B1.tmp
C:\pos1B2.tmp
C:\pos1B3.tmp
C:\pos1B4.tmp
C:\pos1B7.tmp
C:\pos1B8.tmp
C:\pos1B9.tmp
C:\pos1BA.tmp
C:\pos1BB.tmp
C:\pos1BC.tmp
C:\pos1BD.tmp
C:\pos1BE.tmp
C:\pos1BF.tmp
C:\pos1C0.tmp
C:\pos1C1.tmp
C:\pos1C2.tmp
C:\pos1C3.tmp
C:\pos1C4.tmp
C:\pos1C5.tmp
C:\pos1C6.tmp
C:\pos1C7.tmp
C:\pos1C8.tmp
C:\pos1C9.tmp
C:\pos1CA.tmp
C:\pos1CB.tmp
C:\pos1CC.tmp
C:\pos1CD.tmp
C:\pos1CE.tmp
C:\pos1CF.tmp
C:\pos1D0.tmp
C:\pos1D1.tmp
C:\pos1D2.tmp
C:\pos1D3.tmp
C:\pos1D4.tmp
C:\pos1D5.tmp
C:\pos1D6.tmp
C:\pos1D7.tmp
C:\pos1D8.tmp
C:\pos1D9.tmp
C:\pos1DA.tmp
C:\pos1DB.tmp
C:\pos1DC.tmp
C:\pos1DD.tmp
C:\pos1DE.tmp
C:\pos1DF.tmp
C:\pos1E0.tmp
C:\pos1E1.tmp
C:\pos1E2.tmp
C:\pos1E3.tmp
C:\pos1E4.tmp
C:\pos1E5.tmp
C:\pos1E6.tmp
C:\pos1E7.tmp
C:\pos1E8.tmp
C:\pos1E9.tmp
C:\pos1EA.tmp
C:\pos1EB.tmp
C:\pos1EC.tmp
C:\pos1ED.tmp
C:\pos1EE.tmp
C:\pos1EF.tmp
C:\pos1F0.tmp
C:\pos1F1.tmp

de rest van log van combofix (want het kost er niet helemaal op)
C:\pos1F2.tmp

C:\pos1F3.tmp
C:\pos1F4.tmp
C:\pos1F5.tmp
C:\pos1F6.tmp
C:\pos1F7.tmp
C:\pos1F8.tmp
C:\pos1F9.tmp
C:\pos1FA.tmp
C:\pos1FB.tmp
C:\pos1FC.tmp
C:\pos1FD.tmp
C:\pos1FE.tmp
C:\pos1FF.tmp
C:\pos20.tmp
C:\pos200.tmp
C:\pos201.tmp
C:\pos202.tmp
C:\pos203.tmp
C:\pos204.tmp
C:\pos206.tmp
C:\pos207.tmp
C:\pos208.tmp
C:\pos209.tmp
C:\pos20A.tmp
C:\pos20B.tmp
C:\pos20C.tmp
C:\pos20D.tmp
C:\pos20E.tmp
C:\pos20F.tmp
C:\pos210.tmp
C:\pos211.tmp
C:\pos212.tmp
C:\pos213.tmp
C:\pos214.tmp
C:\pos215.tmp
C:\pos216.tmp
C:\pos217.tmp
C:\pos218.tmp
C:\pos219.tmp
C:\pos21A.tmp
C:\pos21B.tmp
C:\pos21C.tmp
C:\pos21D.tmp
C:\pos21E.tmp
C:\pos21F.tmp
C:\pos220.tmp
C:\pos221.tmp
C:\pos222.tmp
C:\pos223.tmp
C:\pos224.tmp
C:\pos225.tmp
C:\pos226.tmp
C:\pos227.tmp
C:\pos228.tmp
C:\pos22A.tmp
C:\pos22B.tmp
C:\pos22C.tmp
C:\pos22D.tmp
C:\pos22E.tmp
C:\pos22F.tmp
C:\pos230.tmp
C:\pos231.tmp
C:\pos232.tmp
C:\pos233.tmp
C:\pos234.tmp
C:\pos235.tmp
C:\pos236.tmp
C:\pos237.tmp
C:\pos238.tmp
C:\pos239.tmp
C:\pos23A.tmp
C:\pos23B.tmp
C:\pos23C.tmp
C:\pos23D.tmp
C:\pos23E.tmp
C:\pos23F.tmp
C:\pos240.tmp
C:\pos241.tmp
C:\pos242.tmp
C:\pos243.tmp
C:\pos244.tmp
C:\pos245.tmp
C:\pos246.tmp
C:\pos247.tmp
C:\pos248.tmp
C:\pos249.tmp
C:\pos24A.tmp
C:\pos24B.tmp
C:\pos24C.tmp
C:\pos24D.tmp
C:\pos24E.tmp
C:\pos24F.tmp
C:\pos250.tmp
C:\pos251.tmp
C:\pos252.tmp
C:\pos253.tmp
C:\pos254.tmp
C:\pos255.tmp
C:\pos256.tmp
C:\pos257.tmp
C:\pos258.tmp
C:\pos259.tmp
C:\pos25A.tmp
C:\pos25B.tmp
C:\pos25C.tmp
C:\pos25D.tmp
C:\pos25E.tmp
C:\pos25F.tmp
C:\pos26.tmp
C:\pos260.tmp
C:\pos29.tmp
C:\pos2D.tmp
C:\pos4.tmp
C:\pos40.tmp
C:\pos5.tmp
C:\pos55.tmp
C:\pos56.tmp
C:\pos57.tmp
C:\pos58.tmp
C:\pos59.tmp
C:\pos5A.tmp
C:\pos5B.tmp
C:\pos5C.tmp
C:\pos5D.tmp
C:\pos5E.tmp
C:\pos5F.tmp
C:\pos6.tmp
C:\pos60.tmp
C:\pos61.tmp
C:\pos62.tmp
C:\pos63.tmp
C:\pos64.tmp
C:\pos65.tmp
C:\pos66.tmp
C:\pos67.tmp
C:\pos68.tmp
C:\pos69.tmp
C:\pos6A.tmp
C:\pos6B.tmp
C:\pos6C.tmp
C:\pos6F.tmp
C:\pos7.tmp
C:\pos70.tmp
C:\pos71.tmp
C:\pos72.tmp
C:\pos73.tmp
C:\pos74.tmp
C:\pos75.tmp
C:\pos76.tmp
C:\pos77.tmp
C:\pos78.tmp
C:\pos79.tmp
C:\pos7A.tmp
C:\pos7B.tmp
C:\pos7C.tmp
C:\pos7D.tmp
C:\pos7E.tmp
C:\pos7F.tmp
C:\pos8.tmp
C:\pos80.tmp
C:\pos81.tmp
C:\pos82.tmp
C:\pos83.tmp
C:\pos84.tmp
C:\pos85.tmp
C:\pos86.tmp
C:\pos87.tmp
C:\pos88.tmp
C:\pos89.tmp
C:\pos8A.tmp
C:\pos8B.tmp
C:\pos8C.tmp
C:\pos8D.tmp
C:\pos8F.tmp
C:\pos90.tmp
C:\pos91.tmp
C:\pos92.tmp
C:\pos93.tmp
C:\pos94.tmp
C:\pos95.tmp
C:\pos96.tmp
C:\pos97.tmp
C:\pos98.tmp
C:\pos99.tmp
C:\pos9A.tmp
C:\pos9B.tmp
C:\pos9C.tmp
C:\pos9D.tmp
C:\pos9E.tmp
C:\pos9F.tmp
C:\posA.tmp
C:\posA0.tmp
C:\posA1.tmp
C:\posA4.tmp
C:\posA5.tmp
C:\posA6.tmp
C:\posA7.tmp
C:\posA8.tmp
C:\posA9.tmp
C:\posAA.tmp
C:\posAC.tmp
C:\posAD.tmp
C:\posAE.tmp
C:\posAF.tmp
C:\posB1.tmp
C:\posB3.tmp
C:\posB4.tmp
C:\posB5.tmp
C:\posB6.tmp
C:\posB7.tmp
C:\posB8.tmp
C:\posB9.tmp
C:\posBA.tmp
C:\posBB.tmp
C:\posBC.tmp
C:\posBD.tmp
C:\posBE.tmp
C:\posBF.tmp
C:\posC.tmp
C:\posC0.tmp
C:\posC1.tmp
C:\posC2.tmp
C:\posC3.tmp
C:\posC4.tmp
C:\posC5.tmp
C:\posC6.tmp
C:\posC7.tmp
C:\posC8.tmp
C:\posC9.tmp
C:\posCB.tmp
C:\posCC.tmp
C:\posCD.tmp
C:\posCE.tmp
C:\posCF.tmp
C:\posD.tmp
C:\posD0.tmp
C:\posD1.tmp
C:\posD2.tmp
C:\posD3.tmp
C:\posD4.tmp
C:\posD5.tmp
C:\posD6.tmp
C:\posD7.tmp
C:\posD8.tmp
C:\posD9.tmp
C:\posDA.tmp
C:\posDAF.tmp
C:\posDB.tmp
C:\posDB0.tmp
C:\posDB1.tmp
C:\posDB2.tmp
C:\posDB3.tmp
C:\posDB5.tmp
C:\posDB7.tmp
C:\posDB8.tmp
C:\posDB9.tmp
C:\posDBA.tmp
C:\posDBB.tmp
C:\posDBC.tmp
C:\posDBD.tmp
C:\posDBE.tmp
C:\posDBF.tmp
C:\posDC.tmp
C:\posDC0.tmp
C:\posDC1.tmp
C:\posDC2.tmp
C:\posDC3.tmp
C:\posDC4.tmp
C:\posDC5.tmp
C:\posDC6.tmp
C:\posDC7.tmp
C:\posDC8.tmp
C:\posDC9.tmp
C:\posDCA.tmp
C:\posDCB.tmp
C:\posDCC.tmp
C:\posDCD.tmp
C:\posDCE.tmp
C:\posDCF.tmp
C:\posDD.tmp
C:\posDD0.tmp
C:\posDD1.tmp
C:\posDD2.tmp
C:\posDD3.tmp
C:\posDD4.tmp
C:\posDD5.tmp
C:\posDD6.tmp
C:\posDD7.tmp
C:\posDD8.tmp
C:\posDD9.tmp
C:\posDDA.tmp
C:\posDDB.tmp
C:\posDDC.tmp
C:\posDDD.tmp
C:\posDDE.tmp
C:\posDDF.tmp
C:\posDE.tmp
C:\posDE0.tmp
C:\posDE1.tmp
C:\posDE2.tmp
C:\posDE3.tmp
C:\posDE4.tmp
C:\posDE5.tmp
C:\posDE6.tmp
C:\posDE7.tmp
C:\posDE8.tmp
C:\posDE9.tmp
C:\posDEA.tmp
C:\posDEB.tmp
C:\posDEC.tmp
C:\posDED.tmp
C:\posDEE.tmp
C:\posDEF.tmp
C:\posDF.tmp
C:\posDF0.tmp
C:\posDF1.tmp
C:\posDF2.tmp
C:\posDF3.tmp
C:\posDF4.tmp
C:\posDF5.tmp
C:\posDF6.tmp
C:\posDF7.tmp
C:\posDF8.tmp
C:\posDF9.tmp
C:\posDFA.tmp
C:\posDFB.tmp
C:\posDFC.tmp
C:\posDFD.tmp
C:\posDFE.tmp
C:\posDFF.tmp
C:\posE.tmp
C:\posE0.tmp
C:\posE00.tmp
C:\posE01.tmp
C:\posE02.tmp
C:\posE03.tmp
C:\posE04.tmp
C:\posE05.tmp
C:\posE06.tmp
C:\posE07.tmp
C:\posE08.tmp
C:\posE09.tmp
C:\posE0A.tmp
C:\posE0B.tmp
C:\posE0C.tmp
C:\posE0D.tmp
C:\posE0E.tmp
C:\posE0F.tmp
C:\posE1.tmp
C:\posE10.tmp
C:\posE11.tmp
C:\posE12.tmp
C:\posE13.tmp
C:\posE14.tmp
C:\posE15.tmp
C:\posE16.tmp
C:\posE17.tmp
C:\posE18.tmp
C:\posE19.tmp
C:\posE1A.tmp
C:\posE1B.tmp
C:\posE1C.tmp
C:\posE1D.tmp
C:\posE1E.tmp
C:\posE1F.tmp
C:\posE20.tmp
C:\posE21.tmp
C:\posE22.tmp
C:\posE23.tmp
C:\posE24.tmp
C:\posE25.tmp
C:\posE26.tmp
C:\posE27.tmp
C:\posE28.tmp
C:\posE29.tmp
C:\posE2A.tmp
C:\posE2B.tmp
C:\posE2C.tmp
C:\posE2D.tmp
C:\posE2E.tmp
C:\posE2F.tmp
C:\posE3.tmp
C:\posE30.tmp
C:\posE31.tmp
C:\posE32.tmp
C:\posE33.tmp
C:\posE34.tmp
C:\posE35.tmp
C:\posE36.tmp
C:\posE37.tmp
C:\posE38.tmp
C:\posE39.tmp
C:\posE3A.tmp
C:\posE3B.tmp
C:\posE3C.tmp
C:\posE3D.tmp
C:\posE3E.tmp
C:\posE3F.tmp
C:\posE40.tmp
C:\posE41.tmp
C:\posE42.tmp
C:\posE43.tmp
C:\posE44.tmp
C:\posE45.tmp
C:\posE46.tmp
C:\posE47.tmp
C:\posE48.tmp
C:\posE49.tmp
C:\posE4A.tmp
C:\posE4B.tmp
C:\posE4C.tmp
C:\posE4D.tmp
C:\posE4E.tmp
C:\posE4F.tmp
C:\posE5.tmp
C:\posE50.tmp
C:\posE51.tmp
C:\posE52.tmp
C:\posE53.tmp
C:\posE54.tmp
C:\posE55.tmp
C:\posE56.tmp
C:\posE57.tmp
C:\posE58.tmp
C:\posE59.tmp
C:\posE5A.tmp
C:\posE5B.tmp
C:\posE5C.tmp
C:\posE5D.tmp
C:\posE5E.tmp
C:\posE5F.tmp
C:\posE6.tmp
C:\posE60.tmp
C:\posE61.tmp
C:\posE62.tmp
C:\posE63.tmp
C:\posE64.tmp
C:\posE65.tmp
C:\posE66.tmp
C:\posE67.tmp
C:\posE68.tmp
C:\posE69.tmp
C:\posE6A.tmp
C:\posE6B.tmp
C:\posE6C.tmp
C:\posE6D.tmp
C:\posE6E.tmp
C:\posE6F.tmp
C:\posE7.tmp
C:\posE70.tmp
C:\posE71.tmp
C:\posE72.tmp
C:\posE73.tmp
C:\posE74.tmp
C:\posE75.tmp
C:\posE76.tmp
C:\posE77.tmp
C:\posE78.tmp
C:\posE79.tmp
C:\posE7A.tmp
C:\posE7B.tmp
C:\posE7C.tmp
C:\posE7D.tmp
C:\posE7E.tmp
C:\posE7F.tmp
C:\posE8.tmp
C:\posE80.tmp
C:\posE81.tmp
C:\posE82.tmp
C:\posE83.tmp
C:\posE84.tmp
C:\posE85.tmp
C:\posE86.tmp
C:\posE87.tmp
C:\posE88.tmp
C:\posE89.tmp
C:\posE8A.tmp
C:\posE8B.tmp
C:\posE8C.tmp
C:\posE8D.tmp
C:\posE8E.tmp
C:\posE8F.tmp
C:\posE9.tmp
C:\posE90.tmp
C:\posE91.tmp
C:\posE92.tmp
C:\posE93.tmp
C:\posE94.tmp
C:\posE95.tmp
C:\posE96.tmp
C:\posE97.tmp
C:\posE98.tmp
C:\posE99.tmp
C:\posE9A.tmp
C:\posE9B.tmp
C:\posE9C.tmp
C:\posE9D.tmp
C:\posE9E.tmp
C:\posE9F.tmp
C:\posEA.tmp
C:\posEA0.tmp
C:\posEA1.tmp
C:\posEA2.tmp
C:\posEA3.tmp
C:\posEA4.tmp
C:\posEA5.tmp
C:\posEA6.tmp
C:\posEA7.tmp
C:\posEA8.tmp
C:\posEA9.tmp
C:\posEAA.tmp
C:\posEAB.tmp
C:\posEAC.tmp
C:\posEAD.tmp
C:\posEAE.tmp
C:\posEAF.tmp
C:\posEB.tmp
C:\posEB0.tmp
C:\posEB1.tmp
C:\posEB2.tmp
C:\posEB3.tmp
C:\posEB4.tmp
C:\posEB5.tmp
C:\posEB6.tmp
C:\posEB7.tmp
C:\posEB8.tmp
C:\posEB9.tmp
C:\posEBA.tmp
C:\posEBB.tmp
C:\posEBC.tmp
C:\posEBD.tmp
C:\posEBE.tmp
C:\posEBF.tmp
C:\posEC.tmp
C:\posEC0.tmp
C:\posEC1.tmp
C:\posEC2.tmp
C:\posEC3.tmp
C:\posEC4.tmp
C:\posEC5.tmp
C:\posEC6.tmp
C:\posEC7.tmp
C:\posEC8.tmp
C:\posEC9.tmp
C:\posECA.tmp
C:\posECB.tmp
C:\posECC.tmp
C:\posECD.tmp
C:\posECE.tmp
C:\posECF.tmp
C:\posED.tmp
C:\posED0.tmp
C:\posED1.tmp
C:\posED2.tmp
C:\posED3.tmp
C:\posED4.tmp
C:\posED5.tmp
C:\posED6.tmp
C:\posED7.tmp
C:\posED8.tmp
C:\posED9.tmp
C:\posEDA.tmp
C:\posEDB.tmp
C:\posEDC.tmp
C:\posEDD.tmp
C:\posEDE.tmp
C:\posEDF.tmp
C:\posEE.tmp
C:\posEE0.tmp
C:\posEE1.tmp
C:\posEE2.tmp
C:\posEE3.tmp
C:\posEE4.tmp
C:\posEE5.tmp
C:\posEE6.tmp
C:\posEE7.tmp
C:\posEE8.tmp
C:\posEE9.tmp
C:\posEEA.tmp
C:\posEEB.tmp
C:\posEEC.tmp
C:\posEED.tmp
C:\posEEE.tmp
C:\posEEF.tmp
C:\posEF.tmp
C:\posEF0.tmp
C:\posEF1.tmp
C:\posEF2.tmp
C:\posEF3.tmp
C:\posEF4.tmp
C:\posEF5.tmp
C:\posEF6.tmp
C:\posEF7.tmp
C:\posEF8.tmp
C:\posEF9.tmp
C:\posEFA.tmp
C:\posEFB.tmp
C:\posEFC.tmp
C:\posEFD.tmp
C:\posEFE.tmp
C:\posEFF.tmp
C:\posF.tmp
C:\posF0.tmp
C:\posF00.tmp
C:\posF01.tmp
C:\posF02.tmp
C:\posF03.tmp
C:\posF04.tmp
C:\posF05.tmp
C:\posF06.tmp
C:\posF07.tmp
C:\posF08.tmp
C:\posF09.tmp
C:\posF0A.tmp
C:\posF0B.tmp
C:\posF0C.tmp
C:\posF0D.tmp
C:\posF0E.tmp
C:\posF0F.tmp
C:\posF1.tmp
C:\posF10.tmp
C:\posF11.tmp
C:\posF12.tmp
C:\posF13.tmp
C:\posF14.tmp
C:\posF15.tmp
C:\posF16.tmp
C:\posF17.tmp
C:\posF18.tmp
C:\posF19.tmp
C:\posF1A.tmp
C:\posF1B.tmp
C:\posF1C.tmp
C:\posF1D.tmp
C:\posF1E.tmp
C:\posF1F.tmp
C:\posF2.tmp
C:\posF20.tmp
C:\posF21.tmp
C:\posF22.tmp
C:\posF23.tmp
C:\posF24.tmp
C:\posF25.tmp
C:\posF26.tmp
C:\posF27.tmp
C:\posF28.tmp
C:\posF29.tmp
C:\posF2A.tmp
C:\posF2B.tmp
C:\posF2C.tmp
C:\posF2D.tmp
C:\posF2E.tmp
C:\posF2F.tmp
C:\posF3.tmp
C:\posF30.tmp
C:\posF31.tmp
C:\posF32.tmp
C:\posF33.tmp
C:\posF34.tmp
C:\posF35.tmp
C:\posF36.tmp
C:\posF37.tmp
C:\posF38.tmp
C:\posF39.tmp
C:\posF3A.tmp
C:\posF3B.tmp
C:\posF3C.tmp
C:\posF3D.tmp
C:\posF3E.tmp
C:\posF3F.tmp
C:\posF4.tmp
C:\posF40.tmp
C:\posF41.tmp
C:\posF42.tmp
C:\posF43.tmp
C:\posF44.tmp
C:\posF45.tmp
C:\posF46.tmp
C:\posF47.tmp
C:\posF48.tmp
C:\posF49.tmp
C:\posF4A.tmp
C:\posF4B.tmp
C:\posF4C.tmp
C:\posF4D.tmp
C:\posF4E.tmp
C:\posF4F.tmp
C:\posF5.tmp
C:\posF50.tmp
C:\posF51.tmp
C:\posF52.tmp
C:\posF53.tmp
C:\posF54.tmp
C:\posF55.tmp
C:\posF56.tmp
C:\posF57.tmp
C:\posF58.tmp
C:\posF59.tmp
C:\posF5A.tmp
C:\posF5B.tmp
C:\posF5C.tmp
C:\posF5D.tmp
C:\posF5E.tmp
C:\posF5F.tmp
C:\posF6.tmp
C:\posF60.tmp
C:\posF61.tmp
C:\posF62.tmp
C:\posF63.tmp
C:\posF64.tmp
C:\posF65.tmp
C:\posF66.tmp
C:\posF67.tmp
C:\posF68.tmp
C:\posF69.tmp
C:\posF6A.tmp
C:\posF6B.tmp
C:\posF6C.tmp
C:\posF6D.tmp
C:\posF6E.tmp
C:\posF6F.tmp
C:\posF70.tmp
C:\posF71.tmp
C:\posF72.tmp
C:\posF73.tmp
C:\posF74.tmp
C:\posF75.tmp
C:\posF76.tmp
C:\posF77.tmp
C:\posF78.tmp
C:\posF79.tmp
C:\posF7A.tmp
C:\posF7B.tmp
C:\posF7C.tmp
C:\posF7D.tmp
C:\posF7E.tmp
C:\posF7F.tmp
C:\posF8.tmp
C:\posF80.tmp
C:\posF81.tmp
C:\posF82.tmp
C:\posF83.tmp
C:\posF84.tmp
C:\posF85.tmp
C:\posF86.tmp
C:\posF87.tmp
C:\posF88.tmp
C:\posF89.tmp
C:\posF8A.tmp
C:\posF8B.tmp
C:\posF8C.tmp
C:\posF8D.tmp
C:\posF8E.tmp
C:\posF8F.tmp
C:\posF9.tmp
C:\posF90.tmp
C:\posF91.tmp
C:\posF92.tmp
C:\posF93.tmp
C:\posF94.tmp
C:\posF95.tmp
C:\posF96.tmp
C:\posF97.tmp
C:\posF98.tmp
C:\posF99.tmp
C:\posF9A.tmp
C:\posF9B.tmp
C:\posF9C.tmp
C:\posF9D.tmp
C:\posF9E.tmp
C:\posF9F.tmp
C:\posFA.tmp
C:\posFA0.tmp
C:\posFA1.tmp
C:\posFA2.tmp
C:\posFA3.tmp
C:\posFA4.tmp
C:\posFA5.tmp
C:\posFA6.tmp
C:\posFA7.tmp
C:\posFA8.tmp
C:\posFA9.tmp
C:\posFAB.tmp
C:\posFAD.tmp
C:\posFAE.tmp
C:\posFAF.tmp
C:\posFB.tmp
C:\posFB0.tmp
C:\posFB1.tmp
C:\posFB2.tmp
C:\posFB3.tmp
C:\posFB5.tmp
C:\posFB6.tmp
C:\posFB7.tmp
C:\posFB8.tmp
C:\posFBA.tmp
C:\posFBC.tmp
C:\posFBD.tmp
C:\posFBE.tmp
C:\posFBF.tmp
C:\posFC.tmp
C:\posFC0.tmp
C:\posFC1.tmp
C:\posFC2.tmp
C:\posFC3.tmp
C:\posFC4.tmp
C:\posFC5.tmp
C:\posFC6.tmp
C:\posFC7.tmp
C:\posFC8.tmp
C:\posFC9.tmp
C:\posFCA.tmp
C:\posFCB.tmp
C:\posFCC.tmp
C:\posFCD.tmp
C:\posFCE.tmp
C:\posFCF.tmp
C:\posFD.tmp
C:\posFD0.tmp
C:\posFD1.tmp
C:\posFD2.tmp
C:\posFD3.tmp
C:\posFD4.tmp
C:\posFD5.tmp
C:\posFD6.tmp
C:\posFD7.tmp
C:\posFD9.tmp
C:\posFDA.tmp
C:\posFDB.tmp
C:\posFDC.tmp
C:\posFDD.tmp
C:\posFDE.tmp
C:\posFDF.tmp
C:\posFE0.tmp
C:\posFE1.tmp
C:\posFE2.tmp
C:\posFE3.tmp
C:\posFE4.tmp
C:\posFE5.tmp
C:\posFE6.tmp
C:\posFE7.tmp
C:\posFE8.tmp
C:\posFE9.tmp
C:\posFEA.tmp
C:\posFEB.tmp
C:\posFEC.tmp
C:\posFEF.tmp
C:\posFF0.tmp
C:\posFF1.tmp
C:\posFF2.tmp
C:\posFF3.tmp
C:\posFF4.tmp
C:\posFF5.tmp
C:\posFF6.tmp
C:\posFF7.tmp
C:\posFF8.tmp
C:\posFF9.tmp
C:\posFFA.tmp
C:\posFFB.tmp
C:\posFFD.tmp
C:\posFFE.tmp
C:\posFFF.tmp
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Analog Devices\SoundMAX\smax4 .exe
C:\Program Files\Analog Devices\SoundMAX\smax4 .exe
C:\Program Files\Analog Devices\SoundMAX\smax4 .exe
C:\Program Files\Analog Devices\SoundMAX\smax4 .exe
C:\Program Files\Analog Devices\SoundMAX\smax4 .exe
C:\Program Files\Analog Devices\SoundMAX\smax4 .exe
C:\Program Files\Analog Devices\SoundMAX\smax4 .exe
C:\Program Files\Analog Devices\SoundMAX\smax4 .exe
C:\Program Files\Analog Devices\SoundMAX\smax4 .exe
C:\Program Files\Analog Devices\SoundMAX\smax4 .exe
C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Helper
C:\Program Files\Helper\Helper9.dll
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\lsass.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\FF.dll
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\OinUninstall.exe
C:\Program Files\outerinfo\OiUninstaller.exe
C:\Program Files\outerinfo\Outerinfo.dll
C:\Program Files\outerinfo\Outerinfo.exe
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\OuterinfoUpdate.exe
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\smss.exe
C:\Program Files\spoolsv.exe
C:\Program Files\ucleaner_setup.exe
C:\Program Files\Ultimate Cleaner
C:\Program Files\xloader10181.exe
C:\WINDOWS\Casino.ico
C:\WINDOWS\Free Online Dating.ico
C:\WINDOWS\JM\JMInsIDE.exe
C:\WINDOWS\lsass.exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\Spyware Remover.ico
C:\WINDOWS\system32\cbxxurr.dll
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\drvkozr.dll
C:\WINDOWS\system32\eqfkukrs.dll
C:\WINDOWS\system32\hjllm.ini
C:\WINDOWS\system32\hjllm.ini2
C:\WINDOWS\System32\JMRaidSetup.exe
C:\WINDOWS\system32\mlljh.dll
C:\WINDOWS\system32\mlljh.exe
C:\WINDOWS\system32\nbvntqze.dll
C:\WINDOWS\system32\nbvntqze.dllbox
C:\WINDOWS\system32\niydvsym.dll
C:\WINDOWS\system32\pmnnoom.dll
C:\WINDOWS\system32\pmnomki.dll
C:\WINDOWS\system32\RCX38.tmp
C:\WINDOWS\system32\RCX57.tmp
C:\WINDOWS\system32\RCX59.tmp
C:\WINDOWS\system32\RCX61.tmp
C:\WINDOWS\system32\RCX64.tmp
C:\WINDOWS\system32\RCX71.tmp
C:\WINDOWS\system32\RCX84.tmp
C:\WINDOWS\system32\srkukfqe.ini
C:\WINDOWS\system32\ugnqcbth.dll
C:\WINDOWS\system32\uykbydft.exe
C:\WINDOWS\system32\winrnt32.dll

.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2007-12-13 to 2008-01-13 )))))))))))))))))))))))))))))))
.

2008-01-13 15:12 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-13 14:57 . 2008-01-13 14:57 106 --a------ C:\temp.bat
2008-01-13 14:49 . 2008-01-13 14:49 103,424 --a------ C:\WINDOWS\system32\drvkoz.dll
2008-01-13 14:49 . 2008-01-13 14:49 12,288 --a------ C:\WINDOWS\system32\wupeng.exe
2008-01-13 14:08 . 2008-01-13 14:08 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-13 14:04 . 2008-01-13 14:04 <DIR> d-------- C:\Documents and Settings\gilber1234\Application Data\Grisoft
2008-01-13 14:03 . 2008-01-13 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-13 14:03 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-12 19:04 . 2008-01-12 19:04 <DIR> dr-h----- C:\Documents and Settings\gilber1234\Application Data\SecuROM
2008-01-12 19:04 . 2008-01-12 19:04 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-01-12 12:08 . 2008-01-12 12:08 348,160 --a------ C:\WINDOWS\system32\RCXCCE.tmp
2008-01-12 09:54 . 2008-01-12 09:54 348,160 --a------ C:\WINDOWS\system32\RCXCBA.tmp
2008-01-10 20:36 . 2008-01-10 20:36 <DIR> d-------- C:\Program Files\Common Files\MOVAVI
2008-01-10 20:01 . 2008-01-10 20:02 <DIR> d-------- C:\temp
2008-01-01 12:23 . 2008-01-13 14:07 1,953,792 --a------ C:\WINDOWS\system32\JMRaidSetup.exe
2007-12-31 17:33 . 2007-12-31 17:33 <DIR> d-------- C:\Documents and Settings\gilber1234\Application Data\InstallShield Installation Information
2007-12-31 17:18 . 2007-12-31 17:18 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2007-12-31 17:18 . 2007-12-31 17:18 <DIR> d-------- C:\Program Files\AGEIA Technologies
2007-12-31 17:16 . 2008-01-13 15:17 <DIR> d-------- C:\Program Files\DAEMON Tools Pro
2007-12-28 20:57 . 2007-12-28 20:57 <DIR> dr------- C:\Documents and Settings\gilber1234\Application Data\Brother
2007-12-28 20:51 . 2007-12-28 20:51 <DIR> d--h----- C:\Program Files\Zero G Registry
2007-12-28 20:51 . 2007-12-29 13:10 <DIR> d-------- C:\Program Files\Maple 11
2007-12-28 20:50 . 2007-12-28 20:50 <DIR> d--h----- C:\Documents and Settings\gilber1234\InstallAnywhere
2007-12-28 16:55 . 2007-12-28 16:55 <DIR> d-------- C:\Program Files\Apple Software Update
2007-12-28 16:55 . 2007-12-28 16:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-28 16:55 . 2007-12-28 16:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-12-28 16:55 . 2008-01-10 20:36 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-28 16:55 . 2007-12-28 16:56 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-27 22:26 . 2007-12-27 22:26 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2007-12-27 22:25 . 2007-12-27 22:25 <DIR> d-------- C:\WINDOWS\Sun
2007-12-27 22:25 . 2007-12-27 22:25 <DIR> d-------- C:\Program Files\Java
2007-12-27 22:25 . 2007-12-27 22:25 <DIR> d-------- C:\Program Files\Common Files\Java
2007-12-27 22:25 . 2007-12-27 22:26 <DIR> d-------- C:\Documents and Settings\gilber1234\Application Data\SystemRequirementsLab
2007-12-27 22:25 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-12-27 10:21 . 2007-12-27 10:22 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-12-25 18:48 . 2007-12-25 18:48 <DIR> d-------- C:\Program Files\Lavasoft
2007-12-25 18:48 . 2007-12-31 17:18 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-25 18:48 . 2007-12-25 18:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-25 18:45 . 2007-12-25 18:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-25 12:25 . 2007-12-25 12:25 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-12-24 13:56 . 2007-12-24 13:56 <DIR> d-------- C:\Documents and Settings\gilber1234\Application Data\Microsoft Games
2007-12-24 13:55 . 2007-12-24 13:56 <DIR> d-------- C:\WINDOWS\NV40003736.TMP
2007-12-24 13:55 . 2007-12-17 13:53 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb
2007-12-24 13:55 . 2007-12-24 13:55 0 --a------ C:\WINDOWS\Brownie.ini
2007-12-24 13:54 . 2007-12-24 13:54 <DIR> d-------- C:\NVIDIA
2007-12-24 12:42 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2007-12-24 12:42 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2007-12-24 12:42 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2007-12-24 12:07 . 2007-12-24 12:08 <DIR> d-------- C:\Program Files\Microsoft Games
2007-12-24 11:57 . 2007-12-24 11:57 <DIR> d-------- C:\Program Files\Brother
2007-12-24 11:32 . 2007-12-24 11:32 14,682 --a------ C:\WINDOWS\Ascd_tmp.ini
2007-12-24 10:00 . 2007-12-24 10:00 <DIR> d-------- C:\Program Files\MSBuild
2007-12-24 10:00 . 2007-12-24 10:00 <DIR> d-------- C:\Program Files\Microsoft Works
2007-12-24 10:00 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2007-12-24 10:00 . 2006-10-26 19:58 30,512 --a------ C:\WINDOWS\system32\mdimon.dll
2007-12-24 09:57 . 2007-12-24 09:57 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-12-24 09:57 . 2008-01-07 17:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-24 09:55 . 2007-12-24 09:55 <DIR> dr-h----- C:\MSOCache
2007-12-24 09:32 . 2003-09-24 11:37 27,134 --a------ C:\WINDOWS\maxlink.ini
2007-12-24 09:31 . 2007-12-24 09:31 <DIR> d-------- C:\Program Files\ScanSoft
2007-12-24 09:31 . 2007-12-24 09:31 <DIR> d-------- C:\Program Files\Common Files\ScanSoft Shared
2007-12-24 09:31 . 2007-12-24 09:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ScanSoft
2007-12-24 09:15 . 2004-08-04 00:56 152,576 --a------ C:\WINDOWS\system32\irftp.exe
2007-12-24 09:15 . 2004-08-04 00:56 152,576 --a--c--- C:\WINDOWS\system32\dllcache\irftp.exe
2007-12-24 09:15 . 2004-08-04 00:56 27,136 --a------ C:\WINDOWS\system32\irmon.dll
2007-12-24 09:15 . 2004-08-04 00:56 27,136 --a--c--- C:\WINDOWS\system32\dllcache\irmon.dll
2007-12-24 09:15 . 2004-08-04 00:56 8,192 --a------ C:\WINDOWS\system32\wshirda.dll
2007-12-24 09:15 . 2004-08-04 00:56 8,192 --a--c--- C:\WINDOWS\system32\dllcache\wshirda.dll
2007-12-24 09:08 . 2007-07-09 14:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-12-24 09:05 . 2007-03-17 14:43 292,864 -----c--- C:\WINDOWS\system32\dllcache\winsrv.dll
2007-12-24 09:05 . 2006-10-12 12:09 256,512 -----c--- C:\WINDOWS\system32\dllcache\agentsvr.exe
2007-12-24 09:05 . 2007-03-09 14:46 57,344 --a--c--- C:\WINDOWS\system32\dllcache\agentdpv.dll
2007-12-24 09:05 . 2006-10-12 15:02 42,496 -----c--- C:\WINDOWS\system32\dllcache\agentdp2.dll
2007-12-24 09:04 . 2007-04-16 16:52 984,576 -----c--- C:\WINDOWS\system32\dllcache\kernel32.dll
2007-12-24 09:04 . 2006-05-05 10:41 453,120 -----c--- C:\WINDOWS\system32\dllcache\mrxsmb.sys
2007-12-24 09:04 . 2006-05-05 10:47 174,592 -----c--- C:\WINDOWS\system32\dllcache\rdbss.sys
2007-12-23 22:13 . 2007-07-06 13:46 660,992 -----c--- C:\WINDOWS\system32\dllcache\mqqm.dll
2007-12-23 22:13 . 2007-07-06 13:46 471,552 -----c--- C:\WINDOWS\system32\dllcache\mqutil.dll
2007-12-23 22:13 . 2007-07-06 13:46 177,152 -----c--- C:\WINDOWS\system32\dllcache\mqrt.dll
2007-12-23 22:13 . 2007-07-06 13:46 138,240 -----c--- C:\WINDOWS\system32\dllcache\mqad.dll
2007-12-23 22:13 . 2007-07-06 13:46 95,744 -----c--- C:\WINDOWS\system32\dllcache\mqsec.dll
2007-12-23 22:13 . 2007-07-06 11:05 72,960 -----c--- C:\WINDOWS\system32\dllcache\mqac.sys
2007-12-23 22:13 . 2007-07-06 13:46 48,640 -----c--- C:\WINDOWS\system32\dllcache\mqupgrd.dll
2007-12-23 22:13 . 2007-07-06 13:46 47,104 -----c--- C:\WINDOWS\system32\dllcache\mqdscli.dll
2007-12-23 22:13 . 2007-07-06 13:46 16,896 -----c--- C:\WINDOWS\system32\dllcache\mqise.dll
2007-12-23 22:08 . 2007-12-23 22:08 <DIR> d-------- C:\Program Files\Analog Devices
2007-12-23 22:07 . 2006-07-10 14:42 49,152 --a------ C:\WINDOWS\system32\DSndUp.exe
2007-12-23 22:07 . 2002-04-17 14:05 45,056 --a------ C:\WINDOWS\system32\CleanUp.exe
2007-12-23 22:02 . 2007-12-23 22:02 319 --a------ C:\WINDOWS\game.ini
2007-12-23 21:50 . 2007-12-23 21:50 <DIR> d-------- C:\Program Files\Activision
2007-12-23 21:49 . 2008-01-09 16:47 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-12-23 21:46 . 2007-12-23 21:46 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-12-23 21:43 . 2007-12-23 21:43 <DIR> d-------- C:\Documents and Settings\gilber1234\Application Data\DAEMON Tools Pro
2007-12-23 21:43 . 2007-12-31 17:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
2007-12-23 21:42 . 2007-12-23 21:42 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-12-23 21:38 . 2007-12-23 21:39 <DIR> d-------- C:\Program Files\Winamp
2007-12-23 21:38 . 2007-12-30 18:11 <DIR> d-------- C:\Documents and Settings\gilber1234\Application Data\Winamp
2007-12-23 21:28 . 2008-01-10 20:36 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2007-12-23 21:20 . 2007-12-23 21:20 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2007-12-23 21:19 . 2004-08-04 00:56 2,897,920 --a------ C:\WINDOWS\system32\xpsp2res.dll

de rest van combofix
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-24 16:15 --------- d-----w C:\Program Files\MSN Messenger
2007-12-24 11:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-24 10:39 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-23 18:50 --------- d-----w C:\Program Files\Realtek
2007-12-23 18:41 --------- d-----w C:\Program Files\Intel
2007-12-23 18:23 --------- d-----w C:\Documents and Settings\gilber1234\Application Data\MSN6
2007-12-23 18:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6
2007-12-23 18:18 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-05 00:41 7,435,392 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
.


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AB692F9B-27FE-4511-8885-ED62BB45197B}]
2007-12-16 17:30 200704 --a------ C:\WINDOWS\system32\webperform.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2008-01-13 14:07 133576]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-01-13 14:07 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2008-01-13 14:07 36864]
"JMB36X Configure"="C:\WINDOWS\System32\JMRaidSetup.exe" [2008-01-13 14:07 1953792]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [ ]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\smax4 .exe" [ ]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 110592 C:\WINDOWS\system32\bthprops.cpl]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2008-01-13 14:07 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2008-01-13 14:07 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2008-01-13 14:07 40960]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-01-13 14:07 31016]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe" [2008-01-13 14:07 49152]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2008-01-13 14:07 851968]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-13 14:07 40048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2008-01-13 14:07 132496]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2007-12-11 10:56 286720]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [ ]
"Winupdate Engine"="C:\WINDOWS\system32\wupeng.exe" [2008-01-13 14:49 12288]
"MalwareCrush"="C:\Program Files\MalwareCrush\MalwareCrush.exe" [2007-12-30 14:18 1613824]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2007-12-24 11:57:32]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bfadcfabcbaf]
C:\WINDOWS\system32\bfadcfabcbaf.dll 2008-01-13 15:20 119825 C:\WINDOWS\system32\bfadcfabcbaf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayxwvt]
yayxwvt.dll

R3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2003-12-19 21:15]
R3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-06-12 05:27]
R3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 04:28]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-13 15:18:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\bfadcfabcbaf.dll 119825 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\bfadcfabcbaf.dll
.
Completion time: 2008-01-13 15:22:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-13 14:22:10
.
2008-01-09 21:08:25 --- E O F ---

hij wil hijackthis niet meer openen
mvg dragon_warrior

* Is systeemherstel ingeschakeld?


* Download OTMoveIt.exe en plaats het op je bureaublad:
http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

* Open OTMoveIt.exe.
In het linkerpaneel, waar het zegt: "Paste List of Files/Folders to be Moved" ,kopieer en plak onderstaand gedeelte:

C:\WINDOWS\system32\drvkoz.dll
C:\WINDOWS\system32\wupeng.exe
C:\WINDOWS\system32\RCXCCE.tmp
C:\WINDOWS\system32\RCXCBA.tmp
C:\WINDOWS\system32\bfadcfabcbaf.dll

Daarna klik de MoveIt knop onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in volgende map: C:\_OTMoveIt\MovedFiles.
Kopieer en plak de inhoud van die log in je volgende post en probeer een ieuw hijackthis logje hier te posten.

hier is het logje van ot move it
DllUnregisterServer procedure not found in C:\WINDOWS\system32\drvkoz.dll
C:\WINDOWS\system32\drvkoz.dll NOT unregistered.
C:\WINDOWS\system32\drvkoz.dll moved successfully.
C:\WINDOWS\system32\wupeng.exe moved successfully.
C:\WINDOWS\system32\RCXCCE.tmp moved successfully.
C:\WINDOWS\system32\RCXCBA.tmp moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\bfadcfabcbaf.dll
C:\WINDOWS\system32\bfadcfabcbaf.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\bfadcfabcbaf.dll scheduled to be moved on reboot.

Created on 01/13/2008 22:07:16



en het lukt zelf niet meer om hijackthis te downloaden nog in te voeren in google voor te downloaden ik druk dan op enter en google sluit automatisch af ( telkens als ik iets aanklik met het woord "hijackthis" erin sluit hij ook automatisch af )
(mijn pc heeft iets tegen hijackthis denk ik)
mvg dragon_warrior

Post eens een nieuw logje van combofix hier.

hier is het logje van combofix

ComboFix 08-01-13.1 - gilber1234 2008-01-14 18:23:46.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1685 [GMT 1:00]
Running from: C:\Documents and Settings\gilber1234\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\MalwareCrush
C:\Program Files\MalwareCrush\ignored.lst
C:\Program Files\MalwareCrush\MalwareCrush.exe
C:\Program Files\MalwareCrush\mc.ini
C:\WINDOWS\system32\bfadcfabcbaf.dll

.
((((((((((((((((((((((((( Files Created from 2007-12-14 to 2008-01-14 )))))))))))))))))))))))))))))))
.

2008-01-13 15:25 . 2008-01-13 15:25 167,953 --a------ C:\WINDOWS\system32\ssa.dll
2008-01-13 15:12 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-13 14:57 . 2008-01-13 14:57 106 --a------ C:\temp.bat
2008-01-13 14:08 . 2008-01-13 14:08 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-13 14:04 . 2008-01-13 14:04 <DIR> d-------- C:\Documents and Settings\gilber1234\Application Data\Grisoft
2008-01-13 14:03 . 2008-01-13 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-13 14:03 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-12 19:04 . 2008-01-12 19:04 <DIR> dr-h----- C:\Documents and Settings\gilber1234\Application Data\SecuROM
2008-01-12 19:04 . 2008-01-12 19:04 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-01-10 20:36 . 2008-01-10 20:36 <DIR> d-------- C:\Program Files\Common Files\MOVAVI
2008-01-10 20:01 . 2008-01-10 20:02 <DIR> d-------- C:\temp
2008-01-01 12:23 . 2008-01-13 14:07 1,953,792 --a------ C:\WINDOWS\system32\JMRaidSetup.exe
2007-12-31 17:33 . 2007-12-31 17:33 <DIR> d-------- C:\Documents and Settings\gilber1234\Application Data\InstallShield Installation Information
2007-12-31 17:18 . 2007-12-31 17:18 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2007-12-31 17:18 . 2007-12-31 17:18 <DIR> d-------- C:\Program Files\AGEIA Technologies
2007-12-31 17:16 . 2008-01-13 15:17 <DIR> d-------- C:\Program Files\DAEMON Tools Pro
2007-12-28 20:57 . 2007-12-28 20:57 <DIR> dr------- C:\Documents and Settings\gilber1234\Application Data\Brother
2007-12-28 20:51 . 2007-12-28 20:51 <DIR> d--h----- C:\Program Files\Zero G Registry
2007-12-28 20:51 . 2007-12-29 13:10 <DIR> d-------- C:\Program Files\Maple 11
2007-12-28 20:50 . 2007-12-28 20:50 <DIR> d--h----- C:\Documents and Settings\gilber1234\InstallAnywhere
2007-12-28 16:55 . 2007-12-28 16:55 <DIR> d-------- C:\Program Files\Apple Software Update
2007-12-28 16:55 . 2007-12-28 16:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-28 16:55 . 2007-12-28 16:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-12-28 16:55 . 2008-01-10 20:36 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-28 16:55 . 2007-12-28 16:56 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-27 22:26 . 2007-12-27 22:26 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2007-12-27 22:25 . 2007-12-27 22:25 <DIR> d-------- C:\WINDOWS\Sun
2007-12-27 22:25 . 2007-12-27 22:25 <DIR> d-------- C:\Program Files\Java
2007-12-27 22:25 . 2007-12-27 22:25 <DIR> d-------- C:\Program Files\Common Files\Java
2007-12-27 22:25 . 2007-12-27 22:26 <DIR> d-------- C:\Documents and Settings\gilber1234\Application Data\SystemRequirementsLab
2007-12-27 22:25 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-12-27 10:21 . 2007-12-27 10:22 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-12-25 18:48 . 2007-12-25 18:48 <DIR> d-------- C:\Program Files\Lavasoft
2007-12-25 18:48 . 2007-12-31 17:18 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-25 18:48 . 2007-12-25 18:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-25 18:45 . 2007-12-25 18:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-25 12:25 . 2007-12-25 12:25 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-12-24 13:56 . 2007-12-24 13:56 <DIR> d-------- C:\Documents and Settings\gilber1234\Application Data\Microsoft Games
2007-12-24 13:55 . 2007-12-24 13:56 <DIR> d-------- C:\WINDOWS\NV40003736.TMP
2007-12-24 13:55 . 2007-12-17 13:53 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb
2007-12-24 13:55 . 2007-12-24 13:55 0 --a------ C:\WINDOWS\Brownie.ini
2007-12-24 13:54 . 2007-12-24 13:54 <DIR> d-------- C:\NVIDIA
2007-12-24 12:42 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2007-12-24 12:42 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2007-12-24 12:42 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2007-12-24 12:07 . 2007-12-24 12:08 <DIR> d-------- C:\Program Files\Microsoft Games
2007-12-24 11:57 . 2007-12-24 11:57 <DIR> d-------- C:\Program Files\Brother
2007-12-24 11:32 . 2007-12-24 11:32 14,682 --a------ C:\WINDOWS\Ascd_tmp.ini
2007-12-24 10:00 . 2007-12-24 10:00 <DIR> d-------- C:\Program Files\MSBuild
2007-12-24 10:00 . 2007-12-24 10:00 <DIR> d-------- C:\Program Files\Microsoft Works
2007-12-24 10:00 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2007-12-24 10:00 . 2006-10-26 19:58 30,512 --a------ C:\WINDOWS\system32\mdimon.dll
2007-12-24 09:57 . 2007-12-24 09:57 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-12-24 09:57 . 2008-01-07 17:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-24 09:55 . 2007-12-24 09:55 <DIR> dr-h----- C:\MSOCache
2007-12-24 09:32 . 2003-09-24 11:37 27,134 --a------ C:\WINDOWS\maxlink.ini
2007-12-24 09:31 . 2007-12-24 09:31 <DIR> d-------- C:\Program Files\ScanSoft
2007-12-24 09:31 . 2007-12-24 09:31 <DIR> d-------- C:\Program Files\Common Files\ScanSoft Shared
2007-12-24 09:31 . 2007-12-24 09:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ScanSoft
2007-12-24 09:15 . 2004-08-04 00:56 152,576 --a------ C:\WINDOWS\system32\irftp.exe
2007-12-24 09:15 . 2004-08-04 00:56 152,576 --a--c--- C:\WINDOWS\system32\dllcache\irftp.exe
2007-12-24 09:15 . 2004-08-04 00:56 27,136 --a------ C:\WINDOWS\system32\irmon.dll
2007-12-24 09:15 . 2004-08-04 00:56 27,136 --a--c--- C:\WINDOWS\system32\dllcache\irmon.dll
2007-12-24 09:15 . 2004-08-04 00:56 8,192 --a------ C:\WINDOWS\system32\wshirda.dll
2007-12-24 09:15 . 2004-08-04 00:56 8,192 --a--c--- C:\WINDOWS\system32\dllcache\wshirda.dll
2007-12-24 09:08 . 2007-07-09 14:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-12-24 09:05 . 2007-03-17 14:43 292,864 -----c--- C:\WINDOWS\system32\dllcache\winsrv.dll
2007-12-24 09:05 . 2006-10-12 12:09 256,512 -----c--- C:\WINDOWS\system32\dllcache\agentsvr.exe
2007-12-24 09:05 . 2007-03-09 14:46 57,344 --a--c--- C:\WINDOWS\system32\dllcache\agentdpv.dll
2007-12-24 09:05 . 2006-10-12 15:02 42,496 -----c--- C:\WINDOWS\system32\dllcache\agentdp2.dll
2007-12-24 09:04 . 2007-04-16 16:52 984,576 -----c--- C:\WINDOWS\system32\dllcache\kernel32.dll
2007-12-24 09:04 . 2006-05-05 10:41 453,120 -----c--- C:\WINDOWS\system32\dllcache\mrxsmb.sys
2007-12-24 09:04 . 2006-05-05 10:47 174,592 -----c--- C:\WINDOWS\system32\dllcache\rdbss.sys
2007-12-23 22:13 . 2007-07-06 13:46 660,992 -----c--- C:\WINDOWS\system32\dllcache\mqqm.dll
2007-12-23 22:13 . 2007-07-06 13:46 471,552 -----c--- C:\WINDOWS\system32\dllcache\mqutil.dll
2007-12-23 22:13 . 2007-07-06 13:46 177,152 -----c--- C:\WINDOWS\system32\dllcache\mqrt.dll
2007-12-23 22:13 . 2007-07-06 13:46 138,240 -----c--- C:\WINDOWS\system32\dllcache\mqad.dll
2007-12-23 22:13 . 2007-07-06 13:46 95,744 -----c--- C:\WINDOWS\system32\dllcache\mqsec.dll
2007-12-23 22:13 . 2007-07-06 11:05 72,960 -----c--- C:\WINDOWS\system32\dllcache\mqac.sys
2007-12-23 22:13 . 2007-07-06 13:46 48,640 -----c--- C:\WINDOWS\system32\dllcache\mqupgrd.dll
2007-12-23 22:13 . 2007-07-06 13:46 47,104 -----c--- C:\WINDOWS\system32\dllcache\mqdscli.dll
2007-12-23 22:13 . 2007-07-06 13:46 16,896 -----c--- C:\WINDOWS\system32\dllcache\mqise.dll
2007-12-23 22:08 . 2007-12-23 22:08 <DIR> d-------- C:\Program Files\Analog Devices
2007-12-23 22:07 . 2006-07-10 14:42 49,152 --a------ C:\WINDOWS\system32\DSndUp.exe
2007-12-23 22:07 . 2002-04-17 14:05 45,056 --a------ C:\WINDOWS\system32\CleanUp.exe
2007-12-23 22:02 . 2007-12-23 22:02 319 --a------ C:\WINDOWS\game.ini
2007-12-23 21:50 . 2007-12-23 21:50 <DIR> d-------- C:\Program Files\Activision
2007-12-23 21:49 . 2008-01-09 16:47 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-12-23 21:46 . 2007-12-23 21:46 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-12-23 21:43 . 2007-12-23 21:43 <DIR> d-------- C:\Documents and Settings\gilber1234\Application Data\DAEMON Tools Pro
2007-12-23 21:43 . 2007-12-31 17:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
2007-12-23 21:42 . 2007-12-23 21:42 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-12-23 21:38 . 2007-12-23 21:39 <DIR> d-------- C:\Program Files\Winamp
2007-12-23 21:38 . 2007-12-30 18:11 <DIR> d-------- C:\Documents and Settings\gilber1234\Application Data\Winamp
2007-12-23 21:28 . 2008-01-10 20:36 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2007-12-23 21:20 . 2007-12-23 21:20 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2007-12-23 21:19 . 2004-08-04 00:56 2,897,920 --a------ C:\WINDOWS\system32\xpsp2res.dll
2007-12-23 21:18 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-12-23 21:18 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\002369_.tmp
2007-12-23 21:17 . 2007-12-23 21:17 <DIR> d-------- C:\WINDOWS\EHome

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-24 16:15 --------- d-----w C:\Program Files\MSN Messenger
2007-12-24 11:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-24 10:39 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-23 18:50 --------- d-----w C:\Program Files\Realtek
2007-12-23 18:41 --------- d-----w C:\Program Files\Intel
2007-12-23 18:23 --------- d-----w C:\Documents and Settings\gilber1234\Application Data\MSN6
2007-12-23 18:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6
2007-12-23 18:18 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-05 00:41 7,435,392 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
.


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0391AAD0-AB5A-4338-B6DC-BB8405EB1C58}]
2008-01-13 15:25 167953 --a------ C:\WINDOWS\system32\ssa.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AB692F9B-27FE-4511-8885-ED62BB45197B}]
2007-12-16 17:30 200704 --a------ C:\WINDOWS\system32\webperform.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2008-01-13 14:07 133576]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2008-01-13 14:07 36864]
"JMB36X Configure"="C:\WINDOWS\System32\JMRaidSetup.exe" [2008-01-13 14:07 1953792]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [ ]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\smax4 .exe" [ ]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 110592 C:\WINDOWS\system32\bthprops.cpl]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2008-01-13 14:07 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2008-01-13 14:07 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2008-01-13 14:07 40960]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-01-13 14:07 31016]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe" [2008-01-13 14:07 49152]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2008-01-13 14:07 851968]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-13 14:07 40048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2008-01-13 14:07 132496]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2007-12-11 10:56 286720]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [ ]
"Winupdate Engine"="C:\WINDOWS\system32\wupeng.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2007-12-24 11:57:32]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayxwvt]
yayxwvt.dll

R3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2003-12-19 21:15]
R3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-06-12 05:27]
R3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 04:28]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-14 18:27:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-14 18:30:28 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-14 17:30:14
ComboFix2.txt 2008-01-13 16:19:50
ComboFix3.txt 2008-01-13 14:22:29
.
2008-01-09 21:08:25 --- E O F ---

maar hoe installeer je de recovery console??

mvg dragon_warrior

Hoe bedoel je "installeren"?

er staat
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
dus ik denk dat ik dat moet instaleren

het gaat niet voor te instaleren hij zegt dat mijn versie van windows op mijn pc nieuwer is dan op de cd daarom gaat het niet
mvg dragon_warrior

Mja ik zou het ook niet zoooo ernstig nemen.

ok
en is mijn pc nu weer in orde?
mvg dragon_warior

Logs zien er goed uit.

ok bedankt
mvg dragon_warrior

No prob.