Archief - log

veel virussen, en een soort trojan die ze lijkt te produceren. ik heb verschillende scanners gebruikt, maar deze vinden allemaal verschillende namen, dus ik heb niet een echte oplossing omdat ik niet weet wat ik moet zoeken.
hopelijk kan iemand hier me verderhelpen, ongeveer alles loopt vast dus veel kan ik niet meer proberen.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:34:14, on 3/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\System32\rundll32.exe
C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\BTTray.exe
C:\Users\Mertens - Taeymans\QuickDCF2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9d.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Windows\system32\SearchFilterHost.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_be&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_be&c=81&bd=Pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {F535AA22-81FC-4ADD-8CF6-D1D9DDE7B56B} - C:\Windows\system32\khffcBro.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
O4 - HKLM\..\Run: [Ulead Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\khffcBro.dll,#1
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [OutpostMonitor] C:\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Agnitum\Outpost Antivirus Pro\feedback.exe" /dumps_startup
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [CTZDetec.exe] C:\Users\Mertens - Taeymans\Desktop\Creative Media Lite\CTZDetec.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\MERTEN~1\AppData\Local\Temp\rqrqNeBs.dll,c
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\MERTEN~1\AppData\Local\Temp\hggFXroo.dll,#1
O4 - HKCU\..\Run: [7964c320] rundll32.exe "C:\Users\MERTEN~1\AppData\Local\Temp\bptswxrb.dll",b
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [BM7a57f0bc] Rundll32.exe "C:\Users\MERTEN~1\AppData\Local\Temp\rswfvkfa.dll",s
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: ExifLauncher2.lnk = C:\Users\Mertens - Taeymans\QuickDCF2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth-apparaat... - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://jessemientje.spaces.live.com/PhotoUpload/VistaMsnPUpldnl-be.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylom.com/activex/zylomgamesplayer.cab
O20 - AppInit_DLLs: c:\agnitum\outpos~1\wl_hook.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\Agnitum\OUTPOS~1\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Planner voor Automatische LiveUpdate (Automatic LiveUpdate Scheduler) - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 13919 bytes

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

ComboFix 08-06-03.1 - Mertens - Taeymans 2008-06-04 12:19:10.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1043.18.1983 [GMT 2:00]
Gestart vanuit: C:\Users\Mertens - Taeymans\Desktop\ComboFix.exe
.

(((((((((((((((((((( Bestanden Gemaakt van 2008-05-04 to 2008-06-04 ))))))))))))))))))))))))))))))
.

2008-06-04 12:05 . 2008-06-04 12:18 <DIR> d-------- C:\327882R2FWJFW
2008-06-03 21:33 . 2008-06-03 21:34 <DIR> d-------- C:\HijackThis
2008-06-03 20:30 . 2008-06-03 20:32 <DIR> d-------- C:\Windows\System32\Filt
2008-06-03 20:30 . 2008-06-03 20:30 <DIR> d-------- C:\Agnitum
2008-06-03 20:30 . 2008-02-21 18:31 1,073,745 --a------ C:\Windows\System32\drivers\VBEngNT.sys
2008-06-03 20:30 . 2008-03-12 12:31 449,184 --a------ C:\Windows\System32\drivers\SandBox.sys
2008-06-03 20:30 . 2008-02-27 18:26 215,056 --a------ C:\Windows\System32\drivers\afw.sys
2008-06-03 20:30 . 2007-10-25 19:17 49 --a------ C:\Windows\transp.gif
2008-06-03 20:29 . 2008-06-03 20:29 <DIR> d-------- C:\ProgramData\Agnitum
2008-06-03 17:52 . 2008-06-03 17:52 <DIR> d-------- C:\Program Files\Alwil Software
2008-06-03 17:52 . 2008-05-16 01:18 50,768 --a------ C:\Windows\System32\drivers\aswMonFlt.sys
2008-06-02 22:06 . 2008-06-02 22:06 <DIR> d-------- C:\Program Files\Panda Security
2008-06-02 21:50 . 2008-06-02 21:52 <DIR> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-06-02 21:50 . 2008-06-02 21:50 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-02 21:38 . 2008-06-03 19:53 <DIR> d-a------ C:\ProgramData\TEMP
2008-06-02 21:38 . 2008-06-02 21:41 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-06-02 21:38 . 2005-08-25 18:19 115,920 --a------ C:\Windows\System32\MSINET.OCX
2008-05-31 21:26 . 2008-05-31 21:27 <DIR> d-------- C:\Program Files\SureThing CD Labeler 5
2008-05-31 21:26 . 2008-05-31 21:26 <DIR> d-------- C:\Program Files\Common Files\SureThing Shared
2008-05-31 21:26 . 2006-09-21 07:42 487,424 --a------ C:\Windows\System32\msvcp70.dll
2008-05-31 21:26 . 2006-09-21 07:42 344,064 --a------ C:\Windows\System32\msvcr70.dll
2008-05-31 21:26 . 2008-05-31 21:26 59,392 --a------ C:\Windows\System32\khffcBro.dll
2008-05-31 20:52 . 2008-05-31 20:52 <DIR> d-------- C:\Users\Mertens - Taeymans\AppData\Roaming\Ahead
2008-05-31 20:33 . 2008-05-31 20:33 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-05-31 20:27 . 2008-05-31 20:27 <DIR> d-------- C:\ProgramData\LightScribe
2008-05-28 21:44 . 2008-03-08 02:37 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-05-28 21:44 . 2008-03-08 06:30 1,686,528 --a------ C:\Windows\System32\gameux.dll

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-02 11:34 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\uTorrent
2008-05-28 21:03 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\mIRC
2008-05-23 16:27 --------- d-----w C:\Program Files\Windows Mail
2008-05-23 16:21 --------- d-----w C:\Program Files\Common Files\Steam
2008-05-23 15:25 28,570 ----a-w C:\Users\Mertens - Taeymans\AppData\Roaming\nvModes.dat
2008-05-23 14:00 --------- d-----w C:\ProgramData\Symantec
2008-04-22 13:42 2,828 --sha-w C:\Windows\System32\KGyGaAvL.sys
2008-04-22 11:37 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\Image Zone Express
2008-04-21 06:29 202,240 ----a-w C:\Windows\System32\Pimboli Zolder.scr
2008-04-21 06:27 --------- d-----w C:\Program Files\Diddl Screenmate
2008-04-20 10:43 --------- d-----w C:\ProgramData\OberonGames
2008-04-19 14:00 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\PlayFirst
2008-04-19 14:00 --------- d-----w C:\ProgramData\PlayFirst
2008-04-19 11:55 --------- d-----w C:\Program Files\HP
2008-04-19 11:55 --------- d-----w C:\Program Files\Hewlett-Packard
2008-04-17 19:58 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\LimeWire
2008-04-15 19:10 --------- d-----w C:\ProgramData\Gogii
2008-04-15 19:09 --------- d-----w C:\ProgramData\AirportMania
2008-04-15 06:48 --------- d-----w C:\ProgramData\Legacy Interactive
2008-04-14 15:39 --------- d-----w C:\ProgramData\GoBit Games
2008-04-14 14:17 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\Meridian93
2008-04-14 14:17 --------- d-----w C:\ProgramData\Meridian93
2008-04-11 19:54 --------- d-----w C:\ProgramData\Enkord
2008-04-07 19:41 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\EleFun Games
2008-04-07 16:46 --------- d-----w C:\ProgramData\Gameeel
2008-04-06 21:12 --------- d-----w C:\ProgramData\Playrix Entertainment
2008-04-06 20:42 --------- d-----w C:\ProgramData\Forge of Games
2008-04-06 20:17 --------- d-----w C:\ProgramData\SpinTop Games
2008-04-06 16:02 --------- d-----w C:\ProgramData\Alawar Stargaze
2008-04-06 15:59 --------- d-----w C:\ProgramData\Sandlot Games
2008-04-06 15:49 --------- d-----w C:\Program Files\Common Files\Sandlot Shared
2008-03-25 17:31 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-03-25 17:31 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-03-25 17:31 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-03-25 17:31 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-03-25 17:31 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-03-25 17:31 299,008 ----a-w C:\Windows\System32\wlansec.dll
2008-03-25 17:31 289,280 ----a-w C:\Windows\System32\wlanmsm.dll
2008-03-25 17:31 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-03-25 17:31 2,923,520 ----a-w C:\Windows\explorer.exe
2008-03-25 17:30 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-03-25 17:28 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-03-25 17:28 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-03-25 17:28 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-03-25 17:28 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-03-25 17:27 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-03-25 17:27 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-03-25 17:27 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-03-25 17:27 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-03-25 17:27 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-03-25 17:27 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-03-25 17:27 2,048 ----a-w C:\Windows\System32\asferror.dll
2008-03-25 17:27 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-03-25 17:27 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-03-25 17:26 84,480 ----a-w C:\Windows\System32\INETRES.dll
2008-03-25 17:26 737,792 ----a-w C:\Windows\System32\inetcomm.dll
2008-03-25 17:26 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-03-25 17:25 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
2008-03-25 17:24 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-03-25 17:20 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2008-03-25 17:05 80,896 ----a-w C:\Windows\System32\wudriver.dll
2008-03-25 17:05 549,720 ----a-w C:\Windows\System32\wuapi.dll
2008-03-25 17:05 53,080 ----a-w C:\Windows\System32\wuauclt.exe
2008-03-25 17:05 43,352 ----a-w C:\Windows\System32\wups2.dll
2008-03-25 17:05 33,624 ----a-w C:\Windows\System32\wups.dll
2008-03-25 17:05 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
2008-03-25 17:05 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
2008-03-25 17:04 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-03-25 17:04 163,000 ----a-w C:\Windows\System32\wuwebv.dll
2008-03-08 04:30 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-03-08 04:30 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-03-08 04:30 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-03-08 04:30 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-03-08 00:22 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2007-11-28 05:59 174 --sha-w C:\Program Files\desktop.ini
2007-06-25 17:12 1,089,536 ----a-w C:\Users\Mertens - Taeymans\FinePixViewer.exe
2007-04-13 12:53 4,509,696 ----a-w C:\Users\Mertens - Taeymans\fpv4print.exe
2007-03-05 13:35 49,152 ----a-w C:\Users\Mertens - Taeymans\terminate.exe
2007-02-16 19:01 81,920 ----a-w C:\Users\Mertens - Taeymans\wia_register_event.dll
2007-02-16 18:59 94,208 ----a-w C:\Users\Mertens - Taeymans\ptp_util_usbscan.dll
2007-01-30 11:02 303,104 ----a-w C:\Users\Mertens - Taeymans\QuickDCF2.exe
2007-01-29 21:18 98,304 ----a-w C:\Users\Mertens - Taeymans\APSwitch.exe
2006-12-14 22:45 45,056 ----a-w C:\Users\Mertens - Taeymans\FSA04cb2k.dll
2006-12-13 09:23 57,344 ----a-w C:\Users\Mertens - Taeymans\FSA04cb98.dll
2006-09-17 17:21 69,632 ----a-w C:\Users\Mertens - Taeymans\fpv4folder.dll
2006-08-29 10:30 1,847,296 ----a-w C:\Users\Mertens - Taeymans\DPEditor2.exe
2006-03-22 15:57 15,360 ----a-w C:\Users\Mertens - Taeymans\PTPBRIDGE.exe
2006-02-28 18:41 376,832 ----a-w C:\Users\Mertens - Taeymans\Upload.exe
2005-12-21 21:18 53,248 ----a-w C:\Users\Mertens - Taeymans\fgsrapi.dll
2005-12-06 22:12 86,016 ----a-w C:\Users\Mertens - Taeymans\fgmlapi.dll
2005-01-28 18:38 155,648 ----a-w C:\Users\Mertens - Taeymans\OPSwitch.exe
2005-01-25 01:46 200,704 ----a-w C:\Users\Mertens - Taeymans\NETINFapi.dll
2004-12-21 12:02 77,824 ----a-w C:\Users\Mertens - Taeymans\ShowContents.dll
2004-11-30 21:58 32,768 ----a-w C:\Users\Mertens - Taeymans\fpv4layoutdb.dll
2004-06-19 12:51 114,688 ----a-w C:\Users\Mertens - Taeymans\WMFSDK.dll
2004-06-09 06:17 536,576 ----a-w C:\Users\Mertens - Taeymans\Exif.dll
2003-11-21 14:11 258,048 ----a-w C:\Users\Mertens - Taeymans\FXMJPLib.dll
2003-03-06 16:42 24,576 ----a-w C:\Users\Mertens - Taeymans\fpv4mailto.dll
2002-12-03 03:07 155,648 ----a-w C:\Users\Mertens - Taeymans\REREDUCT.DLL
2002-11-30 17:28 57,344 ----a-w C:\Users\Mertens - Taeymans\updater.exe
.

------- Sigcheck -------

.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
2007-08-25 04:51 316784 --a------ c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-03-25 19:17 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F535AA22-81FC-4ADD-8CF6-D1D9DDE7B56B}]
2008-05-31 21:26 59392 --a------ C:\Windows\system32\khffcBro.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= "c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll" [2007-08-25 04:51 316784]

[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-03-25 19:26 1232896]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-17 17:59 2289664]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
"CTZDetec.exe"="C:\Users\Mertens - Taeymans\Desktop\Creative Media Lite\CTZDetec.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-19 22:05 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-19 22:05 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-19 22:05 81920]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 10:29 102400]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 15:34 634880]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-17 15:27 4702208 C:\Windows\RtHDVCpl.exe]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-07-25 08:02 174616]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-09-30 20:34 181544]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 15:31 202032]
"OnScreenDisplay"="C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 14:54 554320]
"UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-17 00:13 218408]
"DpAgent"="C:\Program Files\DigitalPersona\Bin\dpagent.exe" [2007-09-20 12:12 671744]
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 12:01 51048]
"HP Health Check Scheduler"="[ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [ ]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 09:47 480560]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 16:53 311296]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 05:00 132496]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-12-10 22:52 49152]
"Ulead AutoDetector"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe" [2005-07-28 09:32 94208]
"Ulead Calendar Checker"="C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe" [ ]
"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-28 13:00 531272]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 17:40 155648]
"MSServer"="C:\Windows\system32\khffcBro.dll" [2008-05-31 21:26 59392]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"OutpostMonitor"="C:\Agnitum\OUTPOS~1\op_mon.exe" [2008-04-28 13:44 1186624]
"OutpostFeedBack"="C:\Agnitum\Outpost Antivirus Pro\feedback.exe" [2008-04-28 13:23 413696]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\BTTray.exe [2006-04-12 10:37:48 643133]
ExifLauncher2.lnk - C:\Users\Mertens - Taeymans\QuickDCF2.exe [2008-03-27 20:36:13 303104]
HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-01-02 22:40:10 210520]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 11:01:04 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{F535AA22-81FC-4ADD-8CF6-D1D9DDE7B56B}"= C:\Windows\system32\khffcBro.dll [2008-05-31 21:26 59392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{479D9012-2DA8-42A9-AE78-A70E91C23A64}"= C:\Program Files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{44B21FA7-9DF0-4F6D-87D3-67773C796F7C}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{D86E4FED-1DCB-478E-B72D-763DEAD49FC5}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{DE076487-2CF0-4B39-A964-3CFF884EA035}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{30E07366-46E7-4592-83A1-CC3B1A4061C3}"= UDP:C:\Users\Mertens - Taeymans\Desktop\programma's\LimeWire\LimeWire.exe:LimeWire
"{E1C5CDC1-CBB3-4A2F-8C46-5664A32C2E44}"= TCP:C:\Users\Mertens - Taeymans\Desktop\programma's\LimeWire\LimeWire.exe:LimeWire

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 afw;Agnitum Firewall Driver;C:\Windows\system32\DRIVERS\afw.sys [2008-02-27 18:26]
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\ipsdefs\20080522.001\IDSvix86.sys [2008-02-13 18:18]
R1 SandBox;SandBox;C:\Windows\system32\DRIVERS\SandBox.sys [2008-03-12 12:31]
R2 acssrv;Agnitum Client Security Service;C:\Agnitum\OUTPOS~1\acs.exe [2008-04-28 13:24]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
R2 LiveUpdate Notice;LiveUpdate Notice;"c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
R2 QPCapSvc;QuickPlay Background Capture Service (QBCS);"C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe" [2007-09-30 20:34]
R2 QPSched;QuickPlay Task Scheduler (QTS);"C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe" [2007-09-30 20:34]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2007-08-31 16:46]
R3 COH_Mon;COH_Mon;C:\Windows\system32\Drivers\COH_Mon.sys [2008-03-06 22:32]
R3 HpqRemHid;HP Remote Control HID Device;C:\Windows\system32\DRIVERS\HpqRemHid.sys [2007-07-11 11:30]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-08-13 21:50]
S3 ASWFilt;ASWFilt;C:\Windows\system32\Filt\ASWFilt.dll [2008-03-12 12:32]
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver;C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 09:30]
S3 btwaudio;Bluetooth-audioapparaat;C:\Windows\system32\drivers\btwaudio.sys [2007-09-18 15:12]
S3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2007-09-18 15:12]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-09-18 15:12]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-04-29 15:20]
S3 VBEngNT;VBEngNT;C:\Windows\system32\DRIVERS\VBEngNT.sys [2008-02-21 18:31]
S3 VBFilt;VBFilt;C:\Windows\system32\Filt\VBFilt.dll [2008-03-12 12:32]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

*Newly Created Service* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Inhoud van de 'Gedeelde Taken' map
"2008-05-12 18:37:06 C:\Windows\Tasks\Norton Internet Security - Volledige systeemscan uitvoeren - Mertens - Taeymans.job"
- c:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeB/TASK:
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-04 12:23:01
Windows 6.0.6000 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
Voltooingstijd: 2008-06-04 12:24:29
ComboFix-quarantined-files.txt 2008-06-04 10:24:13

Pre-Run: 76,704,350,208 bytes beschikbaar
Post-Run: 77,440,294,912 bytes beschikbaar

272 --- E O F --- 2008-06-03 16:33:22

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:29:33, on 4/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\BTTray.exe
C:\Users\Mertens - Taeymans\QuickDCF2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_be&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_be&c=81&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {F535AA22-81FC-4ADD-8CF6-D1D9DDE7B56B} - C:\Windows\system32\khffcBro.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
O4 - HKLM\..\Run: [Ulead Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\khffcBro.dll,#1
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [OutpostMonitor] C:\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Agnitum\Outpost Antivirus Pro\feedback.exe" /dumps_startup
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [CTZDetec.exe] C:\Users\Mertens - Taeymans\Desktop\Creative Media Lite\CTZDetec.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: ExifLauncher2.lnk = C:\Users\Mertens - Taeymans\QuickDCF2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth-apparaat... - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm (file missing)
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://jessemientje.spaces.live.com/PhotoUpload/VistaMsnPUpldnl-be.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylom.com/activex/zylomgamesplayer.cab
O20 - AppInit_DLLs: c:\agnitum\outpos~1\wl_hook.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\Agnitum\OUTPOS~1\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Planner voor Automatische LiveUpdate (Automatic LiveUpdate Scheduler) - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 12356 bytes

* Fix de volgende regel in hijackthis:

O2 - BHO: (no name) - {F535AA22-81FC-4ADD-8CF6-D1D9DDE7B56B} - C:\Windows\system32\khffcBro.dll

* Download OTMoveIt.exe en plaats het op je bureaublad:
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

* Open OTMoveIt.exe.
In het linkerpaneel, waar het zegt: "Paste List of Files/Folders to be Moved" ,kopieer en plak onderstaand gedeelte:

C:\Windows\system32\khffcBro.dll

Daarna klik de MoveIt knop onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in volgende map: C:\_OTMoveIt\MovedFiles.
Kopieer en plak de inhoud van die log in je volgende post met een nieuw hijackthis logje.

het werkt niet
als ik in hijack de regel fix krijg ik een melding van men antivirus, het bestand "Win32:yundrop(drp) word aangemaakt en als ik opnieuw scan staat deze regel er terug.

bij OTMoveIt krijg ik dit:

LoadLibrary failed for C:\Windows\system32\khffcBro.dll
C:\Windows\system32\khffcBro.dll NOT unregistered.
File move failed. C:\Windows\system32\khffcBro.dll scheduled to be moved on reboot.

OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 06062008_144240

Files moved on Reboot...
LoadLibrary failed for C:\Windows\system32\khffcBro.dll
C:\Windows\system32\khffcBro.dll NOT unregistered.
File move failed. C:\Windows\system32\khffcBro.dll scheduled to be moved on reboot.


als ik dan opnieuw opstart krijg ik nog steeds een error over het bestand khffcBro.dll

Open een kladblokbestand.
Kopieer het ondestaande vetgedrukte, en plak dit in het kladblokbestand.
Sla het kladblokbestand op als CFScript.txt
Sleep nu het bestand CFScript.txt in het bestand ComboFix.exe

ComboFix zal opnieuw starten.
Wanneer ComboFix klaar is, dit kan na een herstart zijn, opent er een logfile.
Post de inhoud van de logfile.
Maak een nieuwe hijackthislog en post deze ook.

tijdens de scan kreeg ik een keer of 20 een error dat het bestand c:/SMft beschadigd is, maar ik kan dit nergens op mijn C terugvinden.
na herstarten had ik weer die khffcBro.dll error.


ComboFix 08-06-03.1 - Mertens - Taeymans 2008-06-07 10:42:00.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1043.18.1955 [GMT 2:00]
Gestart vanuit: C:\Users\Mertens - Taeymans\Desktop\ComboFix.exe
Command switches used :: C:\Users\Mertens - Taeymans\Desktop\CFScript.txt
* Nieuw herstelpunt werd aangemaakt

FILE ::
C:\Windows\system32\khffcBro.dll
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\khffcBro.dll

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-05-07 to 2008-06-07 ))))))))))))))))))))))))))))))
.

2008-06-06 20:56 . 2008-06-06 20:56 <DIR> d-------- C:\Users\Mertens - Taeymans\AppData\Roaming\iWin
2008-06-06 19:29 . 2008-06-06 19:29 <DIR> d-------- C:\Users\Mertens - Taeymans\AppData\Roaming\ITTNord
2008-06-06 18:44 . 2008-06-06 18:44 <DIR> d-------- C:\Users\Mertens - Taeymans\AppData\Roaming\Magic Seeds
2008-06-06 14:35 . 2008-06-06 14:35 <DIR> d-------- C:\_OTMoveIt
2008-06-05 22:21 . 2008-06-05 22:21 <DIR> d-------- C:\Users\Public\CyberLink
2008-06-05 20:51 . 2008-06-05 21:14 <DIR> d-------- C:\ProgramData\DVD Shrink
2008-06-05 20:51 . 2008-06-05 20:51 <DIR> d-------- C:\Program Files\DVD Shrink
2008-06-05 20:49 . 2008-06-05 20:49 <DIR> d-------- C:\Program Files\DVD Decrypter
2008-06-04 22:11 . 2008-06-04 22:11 <DIR> d-------- C:\ProgramData\Fugazo
2008-06-04 18:48 . 2008-06-04 18:48 <DIR> d-------- C:\ProgramData\Hot Lava Games
2008-06-04 12:05 . 2008-06-07 10:41 <DIR> d-------- C:\327882R2FWJFW
2008-06-03 21:33 . 2008-06-06 14:30 <DIR> d-------- C:\HijackThis
2008-06-03 20:30 . 2008-06-06 17:59 <DIR> d-------- C:\Windows\System32\Filt
2008-06-03 20:30 . 2008-06-03 20:30 <DIR> d-------- C:\Agnitum
2008-06-03 20:30 . 2008-02-21 18:31 1,073,745 --a------ C:\Windows\System32\drivers\VBEngNT.sys
2008-06-03 20:30 . 2008-03-12 12:31 449,184 --a------ C:\Windows\System32\drivers\SandBox.sys
2008-06-03 20:30 . 2008-02-27 18:26 215,056 --a------ C:\Windows\System32\drivers\afw.sys
2008-06-03 20:30 . 2007-10-25 19:17 49 --a------ C:\Windows\transp.gif
2008-06-03 20:29 . 2008-06-03 20:29 <DIR> d-------- C:\ProgramData\Agnitum
2008-06-03 17:52 . 2008-06-03 17:52 <DIR> d-------- C:\Program Files\Alwil Software
2008-06-03 17:52 . 2008-05-16 01:18 50,768 --a------ C:\Windows\System32\drivers\aswMonFlt.sys
2008-06-02 22:06 . 2008-06-02 22:06 <DIR> d-------- C:\Program Files\Panda Security
2008-06-02 21:50 . 2008-06-02 21:52 <DIR> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-06-02 21:50 . 2008-06-02 21:50 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-02 21:38 . 2008-06-03 19:53 <DIR> d-a------ C:\ProgramData\TEMP
2008-06-02 21:38 . 2008-06-02 21:41 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-06-02 21:38 . 2005-08-25 18:19 115,920 --a------ C:\Windows\System32\MSINET.OCX
2008-05-31 21:26 . 2008-05-31 21:27 <DIR> d-------- C:\Program Files\SureThing CD Labeler 5
2008-05-31 21:26 . 2008-05-31 21:26 <DIR> d-------- C:\Program Files\Common Files\SureThing Shared
2008-05-31 21:26 . 2006-09-21 07:42 487,424 --a------ C:\Windows\System32\msvcp70.dll
2008-05-31 21:26 . 2006-09-21 07:42 344,064 --a------ C:\Windows\System32\msvcr70.dll
2008-05-31 20:52 . 2008-05-31 20:52 <DIR> d-------- C:\Users\Mertens - Taeymans\AppData\Roaming\Ahead
2008-05-31 20:33 . 2008-05-31 20:33 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-05-31 20:27 . 2008-05-31 20:27 <DIR> d-------- C:\ProgramData\LightScribe
2008-05-28 21:44 . 2008-03-08 02:37 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-05-28 21:44 . 2008-03-08 06:30 1,686,528 --a------ C:\Windows\System32\gameux.dll

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-06 22:07 28,570 ----a-w C:\Users\Mertens - Taeymans\AppData\Roaming\nvModes.dat
2008-06-05 20:22 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\CyberLink
2008-06-04 19:43 --------- d-----w C:\ProgramData\HipSoft
2008-06-04 16:23 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\PlayFirst
2008-06-04 16:23 --------- d-----w C:\ProgramData\PlayFirst
2008-06-02 11:34 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\uTorrent
2008-05-28 21:03 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\mIRC
2008-05-23 16:27 --------- d-----w C:\Program Files\Windows Mail
2008-05-23 16:21 --------- d-----w C:\Program Files\Common Files\Steam
2008-05-23 14:00 --------- d-----w C:\ProgramData\Symantec
2008-04-22 13:42 2,828 --sha-w C:\Windows\System32\KGyGaAvL.sys
2008-04-22 11:37 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\Image Zone Express
2008-04-21 06:29 202,240 ----a-w C:\Windows\System32\Pimboli Zolder.scr
2008-04-21 06:27 --------- d-----w C:\Program Files\Diddl Screenmate
2008-04-20 10:43 --------- d-----w C:\ProgramData\OberonGames
2008-04-19 11:55 --------- d-----w C:\Program Files\HP
2008-04-19 11:55 --------- d-----w C:\Program Files\Hewlett-Packard
2008-04-17 19:58 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\LimeWire
2008-04-15 19:10 --------- d-----w C:\ProgramData\Gogii
2008-04-15 19:09 --------- d-----w C:\ProgramData\AirportMania
2008-04-15 06:48 --------- d-----w C:\ProgramData\Legacy Interactive
2008-04-14 15:39 --------- d-----w C:\ProgramData\GoBit Games
2008-04-14 14:17 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\Meridian93
2008-04-14 14:17 --------- d-----w C:\ProgramData\Meridian93
2008-04-11 19:54 --------- d-----w C:\ProgramData\Enkord
2008-04-07 19:41 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\EleFun Games
2008-04-07 16:46 --------- d-----w C:\ProgramData\Gameeel
2008-03-25 17:31 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-03-25 17:31 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-03-25 17:31 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-03-25 17:31 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-03-25 17:31 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-03-25 17:31 299,008 ----a-w C:\Windows\System32\wlansec.dll
2008-03-25 17:31 289,280 ----a-w C:\Windows\System32\wlanmsm.dll
2008-03-25 17:31 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-03-25 17:31 2,923,520 ----a-w C:\Windows\explorer.exe
2008-03-25 17:30 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-03-25 17:28 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-03-25 17:28 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-03-25 17:28 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-03-25 17:28 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-03-25 17:27 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-03-25 17:27 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-03-25 17:27 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-03-25 17:27 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-03-25 17:27 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-03-25 17:27 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-03-25 17:27 2,048 ----a-w C:\Windows\System32\asferror.dll
2008-03-25 17:27 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-03-25 17:27 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-03-25 17:26 84,480 ----a-w C:\Windows\System32\INETRES.dll
2008-03-25 17:26 737,792 ----a-w C:\Windows\System32\inetcomm.dll
2008-03-25 17:26 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-03-25 17:25 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
2008-03-25 17:24 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-03-25 17:20 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2008-03-25 17:05 80,896 ----a-w C:\Windows\System32\wudriver.dll
2008-03-25 17:05 549,720 ----a-w C:\Windows\System32\wuapi.dll
2008-03-25 17:05 53,080 ----a-w C:\Windows\System32\wuauclt.exe
2008-03-25 17:05 43,352 ----a-w C:\Windows\System32\wups2.dll
2008-03-25 17:05 33,624 ----a-w C:\Windows\System32\wups.dll
2008-03-25 17:05 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
2008-03-25 17:05 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
2008-03-25 17:04 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-03-25 17:04 163,000 ----a-w C:\Windows\System32\wuwebv.dll
2008-03-08 04:30 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-03-08 04:30 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-03-08 04:30 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-03-08 04:30 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-03-08 00:22 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2007-11-28 05:59 174 --sha-w C:\Program Files\desktop.ini
2007-06-25 17:12 1,089,536 ----a-w C:\Users\Mertens - Taeymans\FinePixViewer.exe
2007-04-13 12:53 4,509,696 ----a-w C:\Users\Mertens - Taeymans\fpv4print.exe
2007-03-05 13:35 49,152 ----a-w C:\Users\Mertens - Taeymans\terminate.exe
2007-02-16 19:01 81,920 ----a-w C:\Users\Mertens - Taeymans\wia_register_event.dll
2007-02-16 18:59 94,208 ----a-w C:\Users\Mertens - Taeymans\ptp_util_usbscan.dll
2007-01-30 11:02 303,104 ----a-w C:\Users\Mertens - Taeymans\QuickDCF2.exe
2007-01-29 21:18 98,304 ----a-w C:\Users\Mertens - Taeymans\APSwitch.exe
2006-12-14 22:45 45,056 ----a-w C:\Users\Mertens - Taeymans\FSA04cb2k.dll
2006-12-13 09:23 57,344 ----a-w C:\Users\Mertens - Taeymans\FSA04cb98.dll
2006-09-17 17:21 69,632 ----a-w C:\Users\Mertens - Taeymans\fpv4folder.dll
2006-08-29 10:30 1,847,296 ----a-w C:\Users\Mertens - Taeymans\DPEditor2.exe
2006-03-22 15:57 15,360 ----a-w C:\Users\Mertens - Taeymans\PTPBRIDGE.exe
2006-02-28 18:41 376,832 ----a-w C:\Users\Mertens - Taeymans\Upload.exe
2005-12-21 21:18 53,248 ----a-w C:\Users\Mertens - Taeymans\fgsrapi.dll
2005-12-06 22:12 86,016 ----a-w C:\Users\Mertens - Taeymans\fgmlapi.dll
2005-01-28 18:38 155,648 ----a-w C:\Users\Mertens - Taeymans\OPSwitch.exe
2005-01-25 01:46 200,704 ----a-w C:\Users\Mertens - Taeymans\NETINFapi.dll
2004-12-21 12:02 77,824 ----a-w C:\Users\Mertens - Taeymans\ShowContents.dll
2004-11-30 21:58 32,768 ----a-w C:\Users\Mertens - Taeymans\fpv4layoutdb.dll
2004-06-19 12:51 114,688 ----a-w C:\Users\Mertens - Taeymans\WMFSDK.dll
2004-06-09 06:17 536,576 ----a-w C:\Users\Mertens - Taeymans\Exif.dll
2003-11-21 14:11 258,048 ----a-w C:\Users\Mertens - Taeymans\FXMJPLib.dll
2003-03-06 16:42 24,576 ----a-w C:\Users\Mertens - Taeymans\fpv4mailto.dll
2002-12-03 03:07 155,648 ----a-w C:\Users\Mertens - Taeymans\REREDUCT.DLL
2002-11-30 17:28 57,344 ----a-w C:\Users\Mertens - Taeymans\updater.exe
2002-11-30 17:23 57,344 ----a-w C:\Users\Mertens - Taeymans\download.exe
2002-03-30 00:26 299,008 ----a-w C:\Users\Mertens - Taeymans\GF2RSIZE.DLL
2001-12-12 15:36 530,944 ----a-w C:\Users\Mertens - Taeymans\gfnapapi.dll
2001-07-29 17:01 24,576 ----a-w C:\Users\Mertens - Taeymans\gfnp2lib.dll
.

------- Sigcheck -------

.
((((((((((((((((((((((((((((( snapshot@2008-06-04_12.23.44.50 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-04 10:14:35 67,584 --s-a-w C:\Windows\bootstat.dat
+ 2008-06-07 08:32:31 67,584 --s-a-w C:\Windows\bootstat.dat
- 2008-06-04 10:14:37 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-06-07 08:32:31 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-06-04 10:14:37 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-06-07 08:32:31 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-06-04 10:16:51 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-06-07 08:34:41 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-06-07 08:34:41 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-06-03 19:45:52 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-06-06 13:43:37 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-06-03 19:45:52 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-06 13:43:37 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-06-03 19:45:52 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-06-06 13:43:37 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-06-04 10:16:43 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-06-07 08:34:46 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-06-07 08:34:46 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-06-04 10:14:46 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-06-06 21:32:44 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-06-04 10:14:46 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-06 21:32:44 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-06-04 10:14:46 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-06-06 21:32:44 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-06-04 09:21:07 103,924 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-06-07 08:40:59 103,924 ----a-w C:\Windows\System32\perfc009.dat
- 2008-06-04 09:21:07 122,796 ----a-w C:\Windows\System32\perfc013.dat
+ 2008-06-07 08:40:59 122,796 ----a-w C:\Windows\System32\perfc013.dat
- 2008-06-04 09:21:07 610,142 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-06-07 08:40:59 610,142 ----a-w C:\Windows\System32\perfh009.dat
- 2008-06-04 09:21:07 689,618 ----a-w C:\Windows\System32\perfh013.dat
+ 2008-06-07 08:40:59 689,618 ----a-w C:\Windows\System32\perfh013.dat
- 2008-06-04 10:17:18 7,368 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-876805522-2989408422-899400923-1000_UserData.bin
+ 2008-06-07 08:34:50 8,260 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-876805522-2989408422-899400923-1000_UserData.bin
- 2008-06-04 10:17:18 72,970 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-06-07 08:34:50 74,650 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-06-03 18:49:10 40,794 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-06-07 08:34:49 44,238 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
2007-08-25 04:51 316784 --a------ c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-03-25 19:17 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= "c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll" [2007-08-25 04:51 316784]

[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-03-25 19:26 1232896]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-17 17:59 2289664]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
"CTZDetec.exe"="C:\Users\Mertens - Taeymans\Desktop\Creative Media Lite\CTZDetec.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-19 22:05 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-19 22:05 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-19 22:05 81920]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 10:29 102400]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 15:34 634880]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-17 15:27 4702208 C:\Windows\RtHDVCpl.exe]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-07-25 08:02 174616]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-09-30 20:34 181544]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 15:31 202032]
"OnScreenDisplay"="C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 14:54 554320]
"UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-17 00:13 218408]
"DpAgent"="C:\Program Files\DigitalPersona\Bin\dpagent.exe" [2007-09-20 12:12 671744]
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 12:01 51048]
"HP Health Check Scheduler"="[ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [ ]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 09:47 480560]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 16:53 311296]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 05:00 132496]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2006-12-10 22:52 49152]
"Ulead AutoDetector"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe" [2005-07-28 09:32 94208]
"Ulead Calendar Checker"="C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe" [ ]
"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-28 13:00 531272]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 17:40 155648]
"MSServer"="C:\Windows\system32\khffcBro.dll" [ ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"OutpostMonitor"="C:\Agnitum\OUTPOS~1\op_mon.exe" [2008-04-28 13:44 1186624]
"OutpostFeedBack"="C:\Agnitum\Outpost Antivirus Pro\feedback.exe" [2008-04-28 13:23 413696]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\BTTray.exe [2006-04-12 10:37:48 643133]
ExifLauncher2.lnk - C:\Users\Mertens - Taeymans\QuickDCF2.exe [2008-03-27 20:36:13 303104]
HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-01-02 22:40:10 210520]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 11:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{479D9012-2DA8-42A9-AE78-A70E91C23A64}"= C:\Program Files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{44B21FA7-9DF0-4F6D-87D3-67773C796F7C}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{D86E4FED-1DCB-478E-B72D-763DEAD49FC5}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{DE076487-2CF0-4B39-A964-3CFF884EA035}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{30E07366-46E7-4592-83A1-CC3B1A4061C3}"= UDP:C:\Users\Mertens - Taeymans\Desktop\programma's\LimeWire\LimeWire.exe:LimeWire
"{E1C5CDC1-CBB3-4A2F-8C46-5664A32C2E44}"= TCP:C:\Users\Mertens - Taeymans\Desktop\programma's\LimeWire\LimeWire.exe:LimeWire

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 afw;Agnitum Firewall Driver;C:\Windows\system32\DRIVERS\afw.sys [2008-02-27 18:26]
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\ipsdefs\20080522.001\IDSvix86.sys [2008-02-13 18:18]
R1 SandBox;SandBox;C:\Windows\system32\DRIVERS\SandBox.sys [2008-03-12 12:31]
R2 acssrv;Agnitum Client Security Service;C:\Agnitum\OUTPOS~1\acs.exe [2008-04-28 13:24]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
R2 LiveUpdate Notice;LiveUpdate Notice;"c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
R2 QPCapSvc;QuickPlay Background Capture Service (QBCS);"C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe" [2007-09-30 20:34]
R2 QPSched;QuickPlay Task Scheduler (QTS);"C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe" [2007-09-30 20:34]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2007-08-31 16:46]
R3 HpqRemHid;HP Remote Control HID Device;C:\Windows\system32\DRIVERS\HpqRemHid.sys [2007-07-11 11:30]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-08-13 21:50]
S3 ASWFilt;ASWFilt;C:\Windows\system32\Filt\ASWFilt.dll [2008-03-12 12:32]
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver;C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 09:30]
S3 btwaudio;Bluetooth-audioapparaat;C:\Windows\system32\drivers\btwaudio.sys [2007-09-18 15:12]
S3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2007-09-18 15:12]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-09-18 15:12]
S3 COH_Mon;COH_Mon;C:\Windows\system32\Drivers\COH_Mon.sys [2008-03-06 22:32]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-04-29 15:20]
S3 VBEngNT;VBEngNT;C:\Windows\system32\DRIVERS\VBEngNT.sys [2008-02-21 18:31]
S3 VBFilt;VBFilt;C:\Windows\system32\Filt\VBFilt.dll [2008-03-12 12:32]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

*Newly Created Service* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Inhoud van de 'Gedeelde Taken' map
"2008-05-12 18:37:06 C:\Windows\Tasks\Norton Internet Security - Volledige systeemscan uitvoeren - Mertens - Taeymans.job"
- c:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeB/TASK:
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-07 10:45:44
Windows 6.0.6000 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
Voltooingstijd: 2008-06-07 10:47:24
ComboFix-quarantined-files.txt 2008-06-07 08:46:57
ComboFix2.txt 2008-06-04 10:24:30

Pre-Run: 76,036,300,800 bytes beschikbaar
Post-Run: 76,016,291,840 bytes beschikbaar

329 --- E O F --- 2008-06-06 12:34:22

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:59:10, on 7/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\BTTray.exe
C:\Users\Mertens - Taeymans\QuickDCF2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_be&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_be&c=81&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
O4 - HKLM\..\Run: [Ulead Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\khffcBro.dll,#1
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [OutpostMonitor] C:\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Agnitum\Outpost Antivirus Pro\feedback.exe" /dumps_startup
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [CTZDetec.exe] C:\Users\Mertens - Taeymans\Desktop\Creative Media Lite\CTZDetec.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: ExifLauncher2.lnk = C:\Users\Mertens - Taeymans\QuickDCF2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth-apparaat... - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm (file missing)
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://jessemientje.spaces.live.com/PhotoUpload/VistaMsnPUpldnl-be.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylom.com/activex/zylomgamesplayer.cab
O20 - AppInit_DLLs: c:\agnitum\outpos~1\wl_hook.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\Agnitum\OUTPOS~1\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Planner voor Automatische LiveUpdate (Automatic LiveUpdate Scheduler) - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 12268 bytes

* Fix de volgende regel in hijackthis:

O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\khffcBro.dll,#1

* Herstart dan je pc en vertel hoe alles verder werkt.

de opstart error is verdwenen, alle virusscanners zijn stil, nog een logje voor de zekerheid:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:38:18, on 7/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\BTTray.exe
C:\Users\Mertens - Taeymans\QuickDCF2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_be&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_be&c=81&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
O4 - HKLM\..\Run: [Ulead Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [OutpostMonitor] C:\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Agnitum\Outpost Antivirus Pro\feedback.exe" /dumps_startup
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [CTZDetec.exe] C:\Users\Mertens - Taeymans\Desktop\Creative Media Lite\CTZDetec.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: ExifLauncher2.lnk = C:\Users\Mertens - Taeymans\QuickDCF2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth-apparaat... - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm (file missing)
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://jessemientje.spaces.live.com/PhotoUpload/VistaMsnPUpldnl-be.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylom.com/activex/zylomgamesplayer.cab
O20 - AppInit_DLLs: c:\agnitum\outpos~1\wl_hook.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\Agnitum\OUTPOS~1\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Planner voor Automatische LiveUpdate (Automatic LiveUpdate Scheduler) - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 12093 bytes

Clean.

dankudankudanku!

No prob.

het probleem is terug, meer nu erger dan voordien.
virusscanner geeft 18 problemen, mn buroblad is volledig leeg en ik vermoed dat er ook programmas verdwenen zijn.
de pc is 1 keer gebruikt sinds hij clean was, alleen op legale sites gezeten, en 10 minuten later was het al prijs.

ik vroeg me ook af of hijack al je schijven scant, of enkel die waar het programma staat geinstaleerd? want volgens de virusscan staan er ook op men E schijf, maar hierop staat maar 1 bestandje , recovery ofzoiets.

de log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:34:09, on 15/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\BTTray.exe
C:\Users\Mertens - Taeymans\QuickDCF2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\rundll32.exe
C:\HijackThis\HijackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\rundll32.exe
D:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_be&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_be&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_be&c=81&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [DpAgent] C:\Program Files\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [OutpostMonitor] C:\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Agnitum\Outpost Antivirus Pro\feedback.exe" /dumps_startup
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\pmnoNDWp.dll,#1
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\TEMP\AppData\Local\Temp\tuvWomLC.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\TEMP\AppData\Local\Temp\tuvVNFXo.dll,c
O4 - HKCU\..\Run: [7964c320] rundll32.exe "C:\Users\TEMP\AppData\Local\Temp\ifakvpkd.dll",b
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: ExifLauncher2.lnk = C:\Users\Mertens - Taeymans\QuickDCF2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://jessemientje.spaces.live.com/PhotoUpload/VistaMsnPUpldnl-be.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylom.com/activex/zylomgamesplayer.cab
O20 - AppInit_DLLs: c:\agnitum\outpos~1\wl_hook.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\Agnitum\OUTPOS~1\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Planner voor Automatische LiveUpdate (Automatic LiveUpdate Scheduler) - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Users\Mertens - Taeymans\Desktop\programma's\d-link bluetooth\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHostW.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 12157 bytes

Post eens een ieuw logje van combofix hier, en je moet wel iets verkeerds gedaan hebben anders zou het niet zomaar terugkomen...

combofix doet het niet meer, ik had enkel nog een lege map over, heb dan opnieuw gedownload, en als ik het nu opstart krijg ik een groene laadbalk maar als deze vol is sluit het terug af.

ik vermoed dat ik ergens een fout heb gemaakt bij het opkuisen/opnieuw installeren van het programma, dit is de eerste keer dat ik vista gebruik dus ik ben niet helemaal zeker of alles wel juist gedaan is.

jeske2006 zei:

combofix doet het niet meer, ik had enkel nog een lege map over, heb dan opnieuw gedownload, en als ik het nu opstart krijg ik een groene laadbalk maar als deze vol is sluit het terug af.

ik vermoed dat ik ergens een fout heb gemaakt bij het opkuisen/opnieuw installeren van het programma, dit is de eerste keer dat ik vista gebruik dus ik ben niet helemaal zeker of alles wel juist gedaan is.

Klik om te vergroten...

Herstart je pc eens en download combofix opnieuw.

ik heb een vermoeden van wat is fout gegaan.
"In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren." => dit start bij mij vanzelf, is dat een slecht teken?
hier is de nieuwe log:

ComboFix 08-06-16.2 - Mertens - Taeymans 2008-06-17 12:51:26.4 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1043.18.1838 [GMT 2:00]
Gestart vanuit: C:\Users\Mertens - Taeymans\Desktop\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Antivirus 2008 PRO
C:\Program Files\Antivirus 2008 PRO\vscan.tsi
C:\Program Files\Antivirus 2008 PRO\zlib.dll
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus 2008 PRO
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus 2008 PRO\antivirus-2008pro.lnk
C:\Users\Mertens - Taeymans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antivirus 2008 PRO
C:\Windows\system32\efcARiGW.dll
C:\Windows\system32\pmnoNDWp.dll

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-05-17 to 2008-06-17 ))))))))))))))))))))))))))))))
.

2008-06-15 12:48 . 2008-06-17 12:50 <DIR> d-------- C:\327882R2FWJFW
2008-06-15 11:23 . 2008-06-16 10:23 <DIR> d--h----- C:\Users\TEMP\AppData
2008-06-15 11:23 . 2008-06-16 10:23 <DIR> d-------- C:\Users\TEMP
2008-06-15 03:21 . 2008-06-15 03:21 <DIR> d--hs---- C:\found.000
2008-06-14 18:51 . 2008-04-23 06:27 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-06-14 18:51 . 2008-04-23 06:27 428,032 --a------ C:\Windows\System32\EncDec.dll
2008-06-14 18:51 . 2008-04-23 06:27 292,352 --a------ C:\Windows\System32\psisdecd.dll
2008-06-14 18:51 . 2008-04-23 06:26 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-06-14 18:51 . 2008-04-23 06:26 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-06-14 18:51 . 2008-04-23 06:26 68,608 --a------ C:\Windows\System32\Mpeg2Data.ax
2008-06-14 18:51 . 2008-04-23 06:26 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-06-07 11:44 . 2008-06-07 11:45 <DIR> d-------- C:\Program Files\Google
2008-06-06 20:56 . 2008-06-06 20:56 <DIR> d-------- C:\Users\Mertens - Taeymans\AppData\Roaming\iWin
2008-06-06 19:29 . 2008-06-06 19:29 <DIR> d-------- C:\Users\Mertens - Taeymans\AppData\Roaming\ITTNord
2008-06-06 18:44 . 2008-06-06 18:44 <DIR> d-------- C:\Users\Mertens - Taeymans\AppData\Roaming\Magic Seeds
2008-06-06 14:35 . 2008-06-06 14:35 <DIR> d-------- C:\_OTMoveIt
2008-06-05 22:21 . 2008-06-05 22:21 <DIR> d-------- C:\Users\Public\CyberLink
2008-06-05 20:51 . 2008-06-05 21:14 <DIR> d-------- C:\ProgramData\DVD Shrink
2008-06-05 20:51 . 2008-06-05 20:51 <DIR> d-------- C:\Program Files\DVD Shrink
2008-06-05 20:49 . 2008-06-05 20:49 <DIR> d-------- C:\Program Files\DVD Decrypter
2008-06-04 22:11 . 2008-06-04 22:11 <DIR> d-------- C:\ProgramData\Fugazo
2008-06-04 18:48 . 2008-06-04 18:48 <DIR> d-------- C:\ProgramData\Hot Lava Games
2008-06-03 21:33 . 2008-06-15 11:29 <DIR> d-------- C:\HijackThis
2008-06-03 20:30 . 2008-06-17 12:39 <DIR> d-------- C:\Windows\System32\Filt
2008-06-03 20:30 . 2008-06-03 20:30 <DIR> d-------- C:\Agnitum
2008-06-03 20:30 . 2008-02-21 18:31 1,073,745 --a------ C:\Windows\System32\drivers\VBEngNT.sys
2008-06-03 20:30 . 2008-03-12 12:31 449,184 --a------ C:\Windows\System32\drivers\SandBox.sys
2008-06-03 20:30 . 2008-02-27 18:26 215,056 --a------ C:\Windows\System32\drivers\afw.sys
2008-06-03 20:30 . 2007-10-25 19:17 49 --a------ C:\Windows\transp.gif
2008-06-03 20:29 . 2008-06-03 20:29 <DIR> d-------- C:\ProgramData\Agnitum
2008-06-03 17:52 . 2008-06-03 17:52 <DIR> d-------- C:\Program Files\Alwil Software
2008-06-03 17:52 . 2008-05-16 01:18 50,768 --a------ C:\Windows\System32\drivers\aswMonFlt.sys
2008-06-02 22:06 . 2008-06-02 22:06 <DIR> d-------- C:\Program Files\Panda Security
2008-06-02 21:50 . 2008-06-02 21:52 <DIR> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-06-02 21:50 . 2008-06-02 21:50 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-02 21:38 . 2008-06-07 11:38 <DIR> d-a------ C:\ProgramData\TEMP
2008-06-02 21:38 . 2008-06-02 21:41 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-06-02 21:38 . 2005-08-25 18:19 115,920 --a------ C:\Windows\System32\MSINET.OCX
2008-05-31 21:26 . 2008-05-31 21:27 <DIR> d-------- C:\Program Files\SureThing CD Labeler 5
2008-05-31 21:26 . 2008-05-31 21:26 <DIR> d-------- C:\Program Files\Common Files\SureThing Shared
2008-05-31 21:26 . 2006-09-21 07:42 487,424 --a------ C:\Windows\System32\msvcp70.dll
2008-05-31 21:26 . 2006-09-21 07:42 344,064 --a------ C:\Windows\System32\msvcr70.dll
2008-05-31 20:52 . 2008-05-31 20:52 <DIR> d-------- C:\Users\Mertens - Taeymans\AppData\Roaming\Ahead
2008-05-31 20:33 . 2008-05-31 20:33 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2008-05-31 20:27 . 2008-05-31 20:27 <DIR> d-------- C:\ProgramData\LightScribe
2008-05-28 21:44 . 2008-03-08 02:37 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-05-28 21:44 . 2008-03-08 06:30 1,686,528 --a------ C:\Windows\System32\gameux.dll

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-14 22:02 28,570 ----a-w C:\Users\Mertens - Taeymans\AppData\Roaming\nvModes.dat
2008-06-14 22:02 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\mIRC
2008-06-14 18:21 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-13 21:03 --------- d-----w C:\Program Files\Windows Mail
2008-06-07 09:44 --------- d-----w C:\Program Files\Java
2008-06-05 20:22 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\CyberLink
2008-06-04 19:43 --------- d-----w C:\ProgramData\HipSoft
2008-06-04 16:23 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\PlayFirst
2008-06-04 16:23 --------- d-----w C:\ProgramData\PlayFirst
2008-06-02 11:34 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\uTorrent
2008-05-23 16:21 --------- d-----w C:\Program Files\Common Files\Steam
2008-05-23 14:00 --------- d-----w C:\ProgramData\Symantec
2008-05-10 03:30 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-05-10 01:21 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys
2008-04-29 03:50 181,760 ----a-w C:\Windows\System32\fsquirt.exe
2008-04-29 01:42 29,184 ----a-w C:\Windows\system32\drivers\BTHUSB.SYS
2008-04-29 01:42 220,160 ----a-w C:\Windows\system32\drivers\bthport.sys
2008-04-29 01:42 19,456 ----a-w C:\Windows\system32\drivers\bthenum.sys
2008-04-26 08:02 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-04-25 04:23 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-04-25 04:23 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-25 04:22 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-04-22 13:42 2,828 --sha-w C:\Windows\System32\KGyGaAvL.sys
2008-04-22 11:37 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\Image Zone Express
2008-04-21 06:29 202,240 ----a-w C:\Windows\System32\Pimboli Zolder.scr
2008-04-21 06:27 --------- d-----w C:\Program Files\Diddl Screenmate
2008-04-20 10:43 --------- d-----w C:\ProgramData\OberonGames
2008-04-19 11:55 --------- d-----w C:\Program Files\HP
2008-04-19 11:55 --------- d-----w C:\Program Files\Hewlett-Packard
2008-04-17 19:58 --------- d-----w C:\Users\Mertens - Taeymans\AppData\Roaming\LimeWire
2008-03-25 17:31 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-03-25 17:31 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-03-25 17:31 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-03-25 17:31 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-03-25 17:31 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-03-25 17:31 299,008 ----a-w C:\Windows\System32\wlansec.dll
2008-03-25 17:31 289,280 ----a-w C:\Windows\System32\wlanmsm.dll
2008-03-25 17:31 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-03-25 17:31 2,923,520 ----a-w C:\Windows\explorer.exe
2008-03-25 17:30 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-03-25 17:28 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-03-25 17:28 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-03-25 17:28 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-03-25 17:28 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-03-25 17:27 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-03-25 17:27 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-03-25 17:27 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-03-25 17:27 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-03-25 17:27 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-03-25 17:27 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-03-25 17:27 2,048 ----a-w C:\Windows\System32\asferror.dll
2008-03-25 17:27 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-03-25 17:26 84,480 ----a-w C:\Windows\System32\INETRES.dll
2008-03-25 17:26 737,792 ----a-w C:\Windows\System32\inetcomm.dll
2008-03-25 17:26 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-03-25 17:25 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
2008-03-25 17:24 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-03-25 17:05 80,896 ----a-w C:\Windows\System32\wudriver.dll
2008-03-25 17:05 549,720 ----a-w C:\Windows\System32\wuapi.dll
2008-03-25 17:05 53,080 ----a-w C:\Windows\System32\wuauclt.exe
2008-03-25 17:05 43,352 ----a-w C:\Windows\System32\wups2.dll
2008-03-25 17:05 33,624 ----a-w C:\Windows\System32\wups.dll
2008-03-25 17:05 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
2008-03-25 17:05 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
2008-03-25 17:04 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-03-25 17:04 163,000 ----a-w C:\Windows\System32\wuwebv.dll
2007-11-28 05:59 174 --sha-w C:\Program Files\desktop.ini
2007-06-25 17:12 1,089,536 ----a-w C:\Users\Mertens - Taeymans\FinePixViewer.exe
2007-04-13 12:53 4,509,696 ----a-w C:\Users\Mertens - Taeymans\fpv4print.exe
2007-03-05 13:35 49,152 ----a-w C:\Users\Mertens - Taeymans\terminate.exe
2007-02-16 19:01 81,920 ----a-w C:\Users\Mertens - Taeymans\wia_register_event.dll
2007-02-16 18:59 94,208 ----a-w C:\Users\Mertens - Taeymans\ptp_util_usbscan.dll
2007-01-30 11:02 303,104 ----a-w C:\Users\Mertens - Taeymans\QuickDCF2.exe
2007-01-29 21:18 98,304 ----a-w C:\Users\Mertens - Taeymans\APSwitch.exe
2006-12-14 22:45 45,056 ----a-w C:\Users\Mertens - Taeymans\FSA04cb2k.dll
2006-12-13 09:23 57,344 ----a-w C:\Users\Mertens - Taeymans\FSA04cb98.dll
2006-09-17 17:21 69,632 ----a-w C:\Users\Mertens - Taeymans\fpv4folder.dll
2006-08-29 10:30 1,847,296 ----a-w C:\Users\Mertens - Taeymans\DPEditor2.exe
2006-03-22 15:57 15,360 ----a-w C:\Users\Mertens - Taeymans\PTPBRIDGE.exe
2006-02-28 18:41 376,832 ----a-w C:\Users\Mertens - Taeymans\Upload.exe
2005-12-21 21:18 53,248 ----a-w C:\Users\Mertens - Taeymans\fgsrapi.dll
2005-12-06 22:12 86,016 ----a-w C:\Users\Mertens - Taeymans\fgmlapi.dll
2005-01-28 18:38 155,648 ----a-w C:\Users\Mertens - Taeymans\OPSwitch.exe
2005-01-25 01:46 200,704 ----a-w C:\Users\Mertens - Taeymans\NETINFapi.dll
2004-12-21 12:02 77,824 ----a-w C:\Users\Mertens - Taeymans\ShowContents.dll
2004-11-30 21:58 32,768 ----a-w C:\Users\Mertens - Taeymans\fpv4layoutdb.dll
2004-06-19 12:51 114,688 ----a-w C:\Users\Mertens - Taeymans\WMFSDK.dll
2004-06-09 06:17 536,576 ----a-w C:\Users\Mertens - Taeymans\Exif.dll
2003-11-21 14:11 258,048 ----a-w C:\Users\Mertens - Taeymans\FXMJPLib.dll
2003-03-06 16:42 24,576 ----a-w C:\Users\Mertens - Taeymans\fpv4mailto.dll
2002-12-03 03:07 155,648 ----a-w C:\Users\Mertens - Taeymans\REREDUCT.DLL
2002-11-30 17:28 57,344 ----a-w C:\Users\Mertens - Taeymans\updater.exe
2002-11-30 17:23 57,344 ----a-w C:\Users\Mertens - Taeymans\download.exe
2002-03-30 00:26 299,008 ----a-w C:\Users\Mertens - Taeymans\GF2RSIZE.DLL
2001-12-12 15:36 530,944 ----a-w C:\Users\Mertens - Taeymans\gfnapapi.dll
2001-07-29 17:01 24,576 ----a-w C:\Users\Mertens - Taeymans\gfnp2lib.dll
2001-07-29 16:03 13,312 ----a-w C:\Users\Mertens - Taeymans\gfnp2bc.dll
2001-07-29 02:50 1,512,960 ----a-w C:\Users\Mertens - Taeymans\ibmxmlbc.dll
2001-06-23 22:24 147,456 ----a-w C:\Users\Mertens - Taeymans\ssleay32.dll
.

((((((((((((((((((((((((((((( snapshot_2008-06-07_10.46.27,50 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-11-02 12:35:33 136,192 ----a-w C:\Windows\assembly\GAC_32\mcupdate\6.0.6000.0__31bf3856ad364e35\mcupdate.exe
+ 2008-04-23 04:28:09 136,704 ----a-w C:\Windows\assembly\GAC_32\mcupdate\6.0.6000.0__31bf3856ad364e35\mcupdate.exe
- 2008-03-25 17:20:45 864,256 ----a-w C:\Windows\assembly\GAC_MSIL\ehepg\6.0.6000.0__31bf3856ad364e35\ehepg.dll
+ 2008-04-23 04:27:53 864,256 ----a-w C:\Windows\assembly\GAC_MSIL\ehepg\6.0.6000.0__31bf3856ad364e35\ehepg.dll
- 2008-03-25 17:20:42 135,168 ----a-w C:\Windows\assembly\GAC_MSIL\ehexthost\6.0.6000.0__31bf3856ad364e35\ehexthost.exe
+ 2008-04-23 04:27:55 135,168 ----a-w C:\Windows\assembly\GAC_MSIL\ehexthost\6.0.6000.0__31bf3856ad364e35\ehexthost.exe
- 2008-03-25 17:20:45 77,824 ----a-w C:\Windows\assembly\GAC_MSIL\ehiExtens\6.0.6000.0__31bf3856ad364e35\ehiExtens.dll
+ 2008-04-23 04:27:56 77,824 ----a-w C:\Windows\assembly\GAC_MSIL\ehiExtens\6.0.6000.0__31bf3856ad364e35\ehiExtens.dll
- 2008-03-25 17:20:42 4,370,432 ----a-w C:\Windows\assembly\GAC_MSIL\ehshell\6.0.6000.0__31bf3856ad364e35\ehshell.dll
+ 2008-04-23 04:27:59 4,374,528 ----a-w C:\Windows\assembly\GAC_MSIL\ehshell\6.0.6000.0__31bf3856ad364e35\ehshell.dll
- 2008-03-25 17:20:42 1,196,032 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.Shell.dll
+ 2008-04-23 04:28:14 1,196,032 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.Shell.dll
- 2008-03-25 17:20:42 2,342,912 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 04:28:14 2,342,912 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.UI.dll
- 2008-03-25 17:20:43 217,088 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.dll
+ 2008-04-23 04:28:13 217,088 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.dll
+ 2008-06-15 01:29:22 2,469,888 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\ehepg\3e10833eb7f83e11eec3a970f528ac8d\ehepg.ni.dll
+ 2008-06-15 01:29:49 360,448 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\ehepgdat\b5dcaeaa218eb42931b96193b5e4074f\ehepgdat.ni.dll
+ 2008-06-15 01:30:19 45,056 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtCOM\c8abe4268ada1cfa408dc4330e37817d\ehExtCOM.ni.dll
+ 2008-06-15 01:29:30 274,432 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost\c11ea9504a5e5464b1850f98d3d381f1\ehExtHost.ni.exe
+ 2008-06-15 01:29:32 192,512 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiExtens\96751ef49f528415c45537453f9c4d28\ehiExtens.ni.dll
+ 2008-06-15 01:29:49 1,941,504 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\51b3eff44264e4f79d17c953207a7e6b\ehRecObj.ni.dll
+ 2008-06-15 01:29:47 12,963,840 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\ehshell\368930610e62dcd81dc7ab18a8336131\ehshell.ni.dll
+ 2008-06-15 01:29:33 765,952 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\mcstore\f50c33f0c4356099d7969e18aeb3f9bf\mcstore.ni.dll
+ 2008-06-15 01:29:50 266,240 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\mcupdate\2b7d84415dee2bae7b5238a3a14d0add\mcupdate.ni.exe
+ 2008-06-15 01:29:29 6,115,328 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\6871abee28a9ed5eb7a878013664eb52\Microsoft.MediaCenter.UI.ni.dll
+ 2008-06-15 01:29:35 712,704 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\ceac290fb6cdaa39fcc449543998fd01\Microsoft.MediaCenter.Sports.ni.dll
+ 2008-06-15 01:29:32 282,624 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\cf87f745aab458d62d1c4f238c46689d\Microsoft.MediaCenter.Shell.ni.dll
+ 2008-06-15 01:29:31 634,880 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\fb91a2c47ac4978a5c9d28cc4cdf6fee\Microsoft.MediaCenter.ni.dll
- 2008-06-07 08:32:31 67,584 --s-a-w C:\Windows\bootstat.dat
+ 2008-06-17 10:38:13 67,584 --s-a-w C:\Windows\bootstat.dat
- 2008-03-25 17:20:44 21,504 ----a-w C:\Windows\ehome\ehdebug.dll
+ 2008-04-23 04:27:00 21,504 ----a-w C:\Windows\ehome\ehdebug.dll
- 2008-03-25 17:20:45 864,256 ----a-w C:\Windows\ehome\ehepg.dll
+ 2008-04-23 04:27:53 864,256 ----a-w C:\Windows\ehome\ehepg.dll
- 2008-03-25 17:20:42 135,168 ----a-w C:\Windows\ehome\ehexthost.exe
+ 2008-04-23 04:27:55 135,168 ----a-w C:\Windows\ehome\ehexthost.exe
- 2006-11-02 12:35:32 372,224 ----a-w C:\Windows\ehome\ehglid.dll
+ 2008-04-23 04:27:00 372,224 ----a-w C:\Windows\ehome\ehglid.dll
- 2008-03-25 17:20:45 77,824 ----a-w C:\Windows\ehome\ehiExtens.dll
+ 2008-04-23 04:27:56 77,824 ----a-w C:\Windows\ehome\ehiExtens.dll
- 2008-03-25 17:20:42 103,936 ----a-w C:\Windows\ehome\ehPresenter.dll
+ 2008-04-23 04:27:00 105,472 ----a-w C:\Windows\ehome\ehPresenter.dll
- 2008-03-25 17:20:44 252,416 ----a-w C:\Windows\ehome\ehReplay.dll
+ 2008-04-23 04:27:00 252,416 ----a-w C:\Windows\ehome\ehReplay.dll
- 2008-03-25 17:20:43 10,094,080 ----a-w C:\Windows\ehome\ehres.dll
+ 2008-04-23 04:22:35 10,094,080 ----a-w C:\Windows\ehome\ehres.dll
- 2008-03-25 17:20:42 4,370,432 ----a-w C:\Windows\ehome\ehshell.dll
+ 2008-04-23 04:27:59 4,374,528 ----a-w C:\Windows\ehome\ehshell.dll
- 2008-03-25 17:20:43 18,944 ----a-w C:\Windows\ehome\ehtrace.dll
+ 2008-04-23 04:27:00 18,944 ----a-w C:\Windows\ehome\ehtrace.dll
- 2008-03-25 17:20:43 517,120 ----a-w C:\Windows\ehome\ehui.dll
+ 2008-04-23 04:27:00 517,632 ----a-w C:\Windows\ehome\ehui.dll
- 2008-03-25 17:20:42 1,497,600 ----a-w C:\Windows\ehome\ehuihlp.dll
+ 2008-04-23 04:27:00 1,497,600 ----a-w C:\Windows\ehome\ehuihlp.dll
- 2008-03-25 17:20:44 6,656 ----a-w C:\Windows\ehome\McrMgr.dll
+ 2008-04-23 04:27:01 6,656 ----a-w C:\Windows\ehome\McrMgr.dll
- 2008-03-25 17:20:44 173,056 ----a-w C:\Windows\ehome\McrMgr.exe
+ 2008-04-23 04:26:31 173,056 ----a-w C:\Windows\ehome\McrMgr.exe
- 2006-11-02 12:35:33 136,192 ----a-w C:\Windows\ehome\mcupdate.exe
+ 2008-04-23 04:28:09 136,704 ----a-w C:\Windows\ehome\mcupdate.exe
- 2008-03-25 17:20:43 217,088 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.dll
+ 2008-04-23 04:28:13 217,088 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.dll
- 2008-03-25 17:20:42 1,196,032 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.Shell.dll
+ 2008-04-23 04:28:14 1,196,032 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.Shell.dll
- 2008-03-25 17:20:42 2,342,912 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 04:28:14 2,342,912 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.UI.dll
- 2008-04-10 10:55:15 665,600 ----a-w C:\Windows\inf\drvindex.dat
+ 2008-06-13 21:03:08 665,600 ----a-w C:\Windows\inf\drvindex.dat
- 2008-06-03 18:31:51 51,200 ----a-w C:\Windows\inf\infpub.dat
+ 2008-06-13 21:03:36 51,200 ----a-w C:\Windows\inf\infpub.dat
- 2008-06-03 18:31:51 86,016 ----a-w C:\Windows\inf\infstor.dat
+ 2008-06-13 21:03:08 86,016 ----a-w C:\Windows\inf\infstor.dat
- 2008-06-03 18:31:51 86,016 ----a-w C:\Windows\inf\infstrng.dat
+ 2008-06-13 21:03:36 86,016 ----a-w C:\Windows\inf\infstrng.dat
- 2008-06-07 08:32:31 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-06-17 10:38:14 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-06-07 08:32:31 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-06-17 10:38:14 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-06-07 08:34:41 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-06-17 10:38:54 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-06-17 10:38:54 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-06-06 13:43:37 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-06-17 10:48:32 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-06-06 13:43:37 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-17 10:48:32 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-06-06 13:43:37 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-06-17 10:48:32 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-06-07 08:34:46 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-06-17 10:39:03 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
- 2008-02-21 04:43:34 124,928 ----a-w C:\Windows\System32\advpack.dll
+ 2008-04-25 04:23:05 124,928 ----a-w C:\Windows\System32\advpack.dll
- 2008-06-06 21:32:44 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-06-17 10:38:28 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-06-06 21:32:44 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-17 10:38:28 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-06-06 21:32:44 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-06-17 10:38:28 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-06-04 10:07:22 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2008-06-17 10:51:12 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2008-06-17 10:51:12 262,144 ---ha-w C:\Windows\System32\config\systemprofile\ntuser.dat.LOG1
+ 2008-04-29 01:42:12 19,456 ----a-w C:\Windows\System32\DriverStore\FileRepository\bth.inf_c206c850\bthenum.sys
+ 2008-04-29 01:42:12 220,160 ----a-w C:\Windows\System32\DriverStore\FileRepository\bth.inf_c206c850\bthport.sys
+ 2008-04-29 01:42:08 29,184 ----a-w C:\Windows\System32\DriverStore\FileRepository\bth.inf_c206c850\BTHUSB.SYS
+ 2008-04-29 03:50:12 181,760 ----a-w C:\Windows\System32\DriverStore\FileRepository\bth.inf_c206c850\fsquirt.exe
- 2008-02-21 04:43:35 347,136 ----a-w C:\Windows\System32\dxtmsft.dll
+ 2008-04-25 04:23:06 347,136 ----a-w C:\Windows\System32\dxtmsft.dll
- 2008-02-21 04:43:35 214,528 ----a-w C:\Windows\System32\dxtrans.dll
+ 2008-04-25 04:23:06 214,528 ----a-w C:\Windows\System32\dxtrans.dll
- 2008-02-21 04:43:35 63,488 ----a-w C:\Windows\System32\icardie.dll
+ 2008-04-25 04:23:06 63,488 ----a-w C:\Windows\System32\icardie.dll
- 2008-02-21 04:43:03 70,656 ----a-w C:\Windows\System32\ie4uinit.exe
+ 2008-04-25 04:22:36 70,656 ----a-w C:\Windows\System32\ie4uinit.exe
- 2008-02-21 04:43:35 383,488 ----a-w C:\Windows\System32\ieapfltr.dll
+ 2008-04-25 04:23:06 383,488 ----a-w C:\Windows\System32\ieapfltr.dll
- 2008-02-21 04:43:35 6,066,176 ----a-w C:\Windows\System32\ieframe.dll
+ 2008-04-25 04:23:06 6,066,176 ----a-w C:\Windows\System32\ieframe.dll
- 2008-02-21 04:43:36 44,544 ----a-w C:\Windows\System32\iernonce.dll
+ 2008-04-25 04:23:06 44,544 ----a-w C:\Windows\System32\iernonce.dll
- 2008-02-21 04:43:36 180,736 ----a-w C:\Windows\System32\ieui.dll
+ 2008-04-25 04:23:06 180,736 ----a-w C:\Windows\System32\ieui.dll
- 2007-07-12 00:22:00 135,168 ----a-w C:\Windows\System32\java.exe
+ 2008-02-21 23:23:35 135,168 ----a-w C:\Windows\System32\java.exe
- 2007-07-12 00:22:04 135,168 ----a-w C:\Windows\System32\javaw.exe
+ 2008-02-21 23:23:39 135,168 ----a-w C:\Windows\System32\javaw.exe
- 2007-07-12 01:22:38 139,264 ----a-w C:\Windows\System32\javaws.exe
+ 2008-02-22 00:33:32 139,264 ----a-w C:\Windows\System32\javaws.exe
- 2008-02-21 04:43:36 27,648 ----a-w C:\Windows\System32\jsproxy.dll
+ 2008-04-25 04:23:06 27,648 ----a-w C:\Windows\System32\jsproxy.dll
- 2008-02-21 04:43:42 64,512 ----a-w C:\Windows\System32\migration\WininetPlugin.dll
+ 2008-04-25 04:23:11 64,512 ----a-w C:\Windows\System32\migration\WininetPlugin.dll
- 2008-05-09 21:35:04 16,863,864 ----a-w C:\Windows\System32\mrt.exe
+ 2008-05-29 23:35:11 17,486,968 ----a-w C:\Windows\System32\mrt.exe
- 2008-02-21 04:43:36 3,591,680 ----a-w C:\Windows\System32\mshtml.dll
+ 2008-04-25 04:23:07 3,591,680 ----a-w C:\Windows\System32\mshtml.dll
- 2008-02-21 04:43:36 478,208 ----a-w C:\Windows\System32\mshtmled.dll
+ 2008-04-25 04:23:07 478,208 ----a-w C:\Windows\System32\mshtmled.dll
- 2008-02-21 04:43:37 671,232 ----a-w C:\Windows\System32\mstime.dll
+ 2008-04-25 04:23:09 671,232 ----a-w C:\Windows\System32\mstime.dll
- 2008-06-07 08:40:59 103,924 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-06-17 10:46:13 103,924 ----a-w C:\Windows\System32\perfc009.dat
- 2008-06-07 08:40:59 122,796 ----a-w C:\Windows\System32\perfc013.dat
+ 2008-06-17 10:46:13 122,796 ----a-w C:\Windows\System32\perfc013.dat
- 2008-06-07 08:40:59 610,142 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-06-17 10:46:13 610,142 ----a-w C:\Windows\System32\perfh009.dat
- 2008-06-07 08:40:59 689,618 ----a-w C:\Windows\System32\perfh013.dat
+ 2008-06-17 10:46:13 689,618 ----a-w C:\Windows\System32\perfh013.dat
- 2008-02-21 04:43:38 44,544 ----a-w C:\Windows\System32\pngfilt.dll
+ 2008-04-25 04:23:10 44,544 ----a-w C:\Windows\System32\pngfilt.dll
- 2008-05-30 15:57:01 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2008-06-15 01:07:51 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
- 2008-02-21 04:43:41 1,159,680 ----a-w C:\Windows\System32\urlmon.dll
+ 2008-04-25 04:23:11 1,159,680 ----a-w C:\Windows\System32\urlmon.dll