Op deze website gebruiken we cookies om content en advertenties te personaliseren, om functies voor social media te bieden en om ons websiteverkeer te analyseren. Ook delen we informatie over uw gebruik van onze site met onze partners voor social media, adverteren en analyse. Deze partners kunnen deze gegevens combineren met andere informatie die u aan ze heeft verstrekt of die ze hebben verzameld op basis van uw gebruik van hun services. Meer informatie.

Akkoord

Vraag & Antwoord

Beveiliging & privacy

Hulp nodig bij verwijderen startsear.ch

Abraham54
30 antwoorden
  • Hallo,

    Gister wilde ik live Nederland-Zweden kijken op m'n pc. Heb toen vShare plugin gedownload, helaas met Startsear.ch tot gevolg. Startsear.ch is een nogal irritante hijacker van de browsers die ik gebruik. Meteen MBAM gebruikt, kon helaas niks vinden.
    Heb weinig tot geen ervaring met het verwijderen van dit soort virussen.


    Nu heb ik HJT geinstalleerd en ook meteen een system scan laten doen maar er kwam gelijk een fout dat mijn PC weigert toegang te geven tot de "Hosts file", en dat ik dan zelf het bestand zou moeten wijzigen. (C:\Windows\System32\drivers\etc\hosts

    Logfile staat in het bericht hieronder.

    Alvast hartelijk bedankt!
  • Hier de logfile, is toch nog gelukt:

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 15:50:37, on 12-10-2011
    Platform: Windows 7 SP1 (WinNT 6.00.3505)
    MSIE: Internet Explorer v9.00 (9.00.8112.16421)
    Boot mode: Normal

    Running processes:
    C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe
    C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
    C:\Advanced Wheel Mouse\wh_exec.exe
    E:\Muziek\iTunes\iTunesHelper.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe
    C:\Windows\SysWOW64\DllHost.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://igoogle.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
    O2 - BHO: Aanmeldhulp voor Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
    O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Programma's\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [WheelMouse] C:\ADVANC~1\wh_exec.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "E:\Muziek\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
    O4 - HKCU\..\Run: [Google Update] "C:\Users\Kylian\AppData\Local\Google\Update\GoogleUpdate.exe" /c
    O4 - Startup: OpenOffice.org 3.2 .lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
    O8 - Extra context menu item: &Verzenden naar OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
    O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: &Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
    O9 - Extra button: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    O9 - Extra 'Tools' menuitem: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
    O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
    O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
    O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
    O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
    O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
    O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
    O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
    O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: Process Monitor (LVPrcS64) - Unknown owner - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe (file missing)
    O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
    O23 - Service: @%SystemRoot%\System32
    etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
    O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
    O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
    O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
    O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
    O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)


    End of file - 8544 bytes
  • Je gebruikt Eset/NOD32.

    Is dat een legitieme versie, of heb je een Fix gebruikt!

    En om voetbal live te bekijken op je PC heb je gewoon SopCast en PCStreams 2.0 nodig!
  • Is een fix.

    Klopt normaal gebruik ik dat ook. Kijk altijd via livetv.ru (hadden ze gister geen sopcast link) dus had maar voor vShare gekozen.
    NOD werkt overigens wel perfect.
  • Heb overigens het gevoel dat de infectie erger wordt, kan dit kloppen? (heel af en toe minimaliseert IE zonder reden en dat soort grappen)
  • nod32 met een fix gebruiken, lijkt mij vragen om moeilijkheden.
    Neem dan gewoon avast free
  • Is Security Essentials ook een goed alternatief? Een andere pc van mij (weliswaar een wat oudere) wordt er erg traag van…
    Zal NOD32 nu meteen uninstallen.
  • Ik heb een heel tpic gewijd hoe je gratis Windows goed kan beveiligen.
    Avast staat op de eerste plaats en MSE bungelt ergens onderaan.

    Maar we gaan nu eerst jouw Windows reinigen voordat we de antivirus gaan veranderen:

    [b:58ac34394e]Ik wil graag dat jij je tijdens de fix aan onderstaande regels houdt:[/b:58ac34394e]
    [list:58ac34394e][*:58ac34394e]Lees alle instrukties goed door.
    [*:58ac34394e]Maak je fouten bij de uitvoering van tools tijdens de fix, kan dat serieuze problemen in Windows veroorzaken.
    [*:58ac34394e]Onthou je van het gebruik van tools cq. updates anders dan die ik jou adviseer te gebruiken.
    [*:58ac34394e]Gebruik altijd één scanner per keer, nooit meerdere tegelijk gebruiken.
    [*:58ac34394e]Hou mij op de hoogte hoe jou computer op de fix reageert - goed of slecht.
    [*:58ac34394e]De fix, eenmaal gestart, moet afgewerkt worden. Zelfs indien jij denkt dat alles in orde is, zijn er mogelijk nog steeds infecties.[/list:u:58ac34394e][/color:58ac34394e]

    [b:58ac34394e]Stap •1•[/b:58ac34394e][/color:58ac34394e]
    [b:58ac34394e]Download LopSD of LOPSD naar je Bureaublad.[/b:58ac34394e]
    [list:58ac34394e][*:58ac34394e] [b:58ac34394e]De-activeer bij dit tooltje je antispyware en virusscanner.[/b:58ac34394e]
    [list:58ac34394e][*:58ac34394e][b:58ac34394e]Vista- en Windows 7 gebruikers: rechtsklik op LopSD en kies voor "Als Administrator uitvoeren"![/list:u:58ac34394e]
    [*:58ac34394e] Kies Optie N en Enter
    [*:58ac34394e] Klik OK bij het informatie venter
    [*:58ac34394e] Kies Optie 2 en Enter
    [*:58ac34394e] Aan het eind verschijnt een log ( LopR.txt ) plaats de inhoud ervan in je volgende antwoord[/b:58ac34394e][/list:u:58ac34394e]
    [b:58ac34394e]Stap •2•[/b:58ac34394e][/color:58ac34394e]
    [b:58ac34394e]Welk programma[/b:58ac34394e]: Microsoft Safety Scanner
    [b:58ac34394e]Waarvoor/waarom[/b:58ac34394e]: specialistische scanner van Microsoft om Windows snel te onderzoeken op- en te ontdoen van spy- & malware.
    [b:58ac34394e]Moeilijkheidsgraad[/b:58ac34394e]: geen.
    [quote:58ac34394e][b:58ac34394e]Opmerking: Microsoft Safety Scanner verloopt 10 dagen nadat het is gedownload.
    Als u opnieuw een scan wilt uitvoeren met de nieuwste definities ter voorkoming van schadelijke software,
    downloadt u Microsoft Safety Scanner opnieuw en voert u het opnieuw uit.[/color:58ac34394e][/b:58ac34394e][/quote:58ac34394e]
    Dowload de [b:58ac34394e]Microsoft Safety Scanner [/b:58ac34394e]hier.

    Windows 2000 en Windows XP: start Microsoft's Safety Scanner middels dubbelklik op de snelkoppeling.
    Windows Vista en Windows 7: start Microsoft's Safety Scanner middels rechtsklik op de snelkoppeling en dan kiezen voor Als Administrator uitvoeren.
    Zet vervolgens een vinkje bij "Ik accepteer de voorwaarden van de bovenstaande gebruiksovereenkomst".

    [b:58ac34394e]Scannen[/b:58ac34394e]:
    [list:58ac34394e][*:58ac34394e] Bij het starten van 'Microsoft's Safety Scanner', klik op de knop "Volgende", vervolgens kies je voor 'Snelle Scan'.
    [*:58ac34394e]Het scannen duurt wel even, dus wees geduldig.[/list:u:58ac34394e]

    [b:58ac34394e]Stap •3•[/b:58ac34394e][/color:58ac34394e]
    [b:58ac34394e]Welk programma[/b:58ac34394e]: Malwarebytes MBAM
    [b:58ac34394e]Waarvoor/waarom[/b:58ac34394e]: specialistische scanner om Windows snel te onderzoeken op- en te ontdoen van spy- & malware.
    [b:58ac34394e]Moeilijkheidsgraad[/b:58ac34394e]: geen.

    [b:58ac34394e]Download Malwarebytes MBAM via één van deze locaties[/b:58ac34394e]:
    [list:58ac34394e][*:58ac34394e][b:58ac34394e]Download.com[/b:58ac34394e]
    [*:58ac34394e][b:58ac34394e]Softpedia.com[/b:58ac34394e][*:58ac34394e][b:58ac34394e]Majorgeeks.com[/b:58ac34394e][/list:u:58ac34394e]
    [b:58ac34394e]Allereerst[/b:58ac34394e]:[list:58ac34394e][*:58ac34394e] Al meteen na de installatie wil 'MBAM' zijn database opwaarderen – toestaan dus.
    [*:58ac34394e] Ook bij herhaald gebruik: eerst 'MBAM' updaten via de tab 'Update'!
    [/list:u:58ac34394e]
    [b:58ac34394e]Malwarebytes MBAM opstarten[/b:58ac34394e]:
    Windows 2000 en Windows XP: start MBAM middels dubbelklik op de snelkoppeling.
    Windows Vista en Windows 7: start MBAM middels rechtsklik op de snelkoppeling en dan kiezen voor Als Administrator uitvoeren.
    [list:58ac34394e][*:58ac34394e][b:58ac34394e]Let op:[/b:58ac34394e]
    [list:58ac34394e][*:58ac34394e]Malwarebytes verstrekt nu de volledige versie van MBAM.
    [*:58ac34394e]Bij de eerstse start kijg je de mogelijkheid de volledige versie te gebruiken of de gratis versie.
    [*:58ac34394e]Onafhankelijk van welke antivirusprogramma in jouw Windows adviseer ik dan de optie "Weigeren" te gebruiken.
    [*:58ac34394e]Zodoende zal MBAM als gratis versie verder te gebruiken zijn[/list:u:58ac34394e][/list:u:58ac34394e]
    [img:58ac34394e]http://img30.imageshack.us/img30/3928/mbam2.png[/img:58ac34394e]

    [list:58ac34394e][*:58ac34394e][b:58ac34394e]Doe ook nog het volgende:[/b:58ac34394e]
    [list:58ac34394e][*:58ac34394e]Zodra het programma gestart is, ga dan naar het tabblad "[b:58ac34394e]Instellingen[/b:58ac34394e]".
    [*:58ac34394e]Vink hier aan: "[b:58ac34394e]Sluit Internet Explorer tijdens verwijdering van malware[/b:58ac34394e]".[/list:u:58ac34394e][/list:u:58ac34394e]

    [b:58ac34394e]Scannen[/b:58ac34394e]:
    [list:58ac34394e][*:58ac34394e] Bij het starten van 'MBAM' kies je voor 'Snelle Scan'.
    [*:58ac34394e]Het scannen kan een tijdje duren, dus wees geduldig. Indien de scan voltooid is, klik dan op de knop 'OK'.
    [*:58ac34394e]Klik daarna op de knop 'Bekijk Resultaten' om de resultaten te zien.[/list:u:58ac34394e]
    [b:58ac34394e]Infecties gevonden[/b:58ac34394e]:
    [list:58ac34394e][*:58ac34394e]Klik nu eerst op OK om de melding weg te klikken
    [*:58ac34394e]Klik vervolgens rechtsonder op de knop Bekijk resultaten.
    [*:58ac34394e]Zorg er nu voor dat alle gevonden infecties aangevinkt zijn, en klik linksonder op Verwijder geselecteerde.
    [*:58ac34394e]Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten.
    [*:58ac34394e]Indien 'MBAM' moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven – dan telkens op 'OK' klikken!
    [*:58ac34394e]Daarna zal 'MBAM' vragen om de Computer opnieuw op te starten - dus sta toe dat de computer opnieuw opgestart wordt.[/list:u:58ac34394e]
    [b:58ac34394e]MBAM-Log[/b:58ac34394e]:
    [list:58ac34394e][*:58ac34394e] Het log wordt automatisch bewaard door 'MBAM en dat kan je terugvinden door in het hoofdmenu van MBAM op de tab 'Logbestanden' te klikken'.[/list:u:58ac34394e]
    [b:58ac34394e]Post aansluitend in je volgende bericht de inhoud van het MBAM-log.[/b:58ac34394e]


    [b:58ac34394e]Stap •4•[/b:58ac34394e][/color:58ac34394e]
    [b:58ac34394e]Samenvattend: hierna post je in jouw volgende bericht de inhoud van de volgende logs:[/b:58ac34394e]
    [list:58ac34394e][*:58ac34394e] LopSD-log
    [*:58ac34394e] MBAM scanlog[/list:u:58ac34394e]
  • Helaas werkt LopSD niet, na het invullen van "2" bij de laatste stap, wordt het venster 1 seconde rood en verdwijnt daarna weer… Zal ik nu doorgaan met de volgende stappen?
  • Zowel Safety Scanner als MBAM hebben niks kunnen vinden.
    Hier het MBAM log:

    Malwarebytes' Anti-Malware 1.51.2.1300
    www.malwarebytes.org

    Databaseversie: 7924

    Windows 6.1.7601 Service Pack 1
    Internet Explorer 9.0.8112.16421

    12-10-2011 16:45:25
    mbam-log-2011-10-12 (16-45-25).txt

    Scantype: Snelle scan
    Objecten gescand: 183562
    Verstreken tijd: 1 minuut/minuten, 25 seconde(n)

    Geheugenprocessen geïnfecteerd: 0
    Geheugenmodulen geïnfecteerd: 0
    Registersleutels geïnfecteerd: 0
    Registerwaarden geïnfecteerd: 0
    Registerdata geïnfecteerd: 0
    Mappen geïnfecteerd: 0
    Bestanden geïnfecteerd: 0

    Geheugenprocessen geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)

    Geheugenmodulen geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)

    Registersleutels geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)

    Registerwaarden geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)

    Registerdata geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)

    Mappen geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)

    Bestanden geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)
  • Heb je LopSD met administratorrechten opgestart en had je Eset gedeaktiveerd?
  • Jep, beide gedaan (had overigens ESET al geuninstalled en MSE geinstalleerd), maar de virusscanner was uitgeschakeld. Toen ik LopSD voor de eerste keer opstartte, viel hij dus weg en kreeg ik daarna een melding dat LopSD misschien niet goed geinstalleerd was.
  • Goede kans dat er nog delen van Eset aktief zijn!

    Als je dingen blijft doen buiten mij om, dan heeft het weinig zin met je door te gaan!

    Dus laat weten wat je nu wil doen.
  • Hallo Abraham54,

    Natuurlijk wil ik ervoor zorgen dat mijn pc weer malware - en spyware vrij is. Ik heb enkel en alleen ESET geuninstalled omdat er negatieve berichten over kwamen op dit forum. Graag zou ik met u weer verder willen gaan in het proces om mijn pc weer volledig te "cleanen". Ik weet alleen niet hoe ik deze delen van ESET dan zou moeten verwijderen (als die nog aanwezig zijn)

    Alvast bedankt!
  • Doe nu eerst het volgende:

    [b:59c3199961]Welk programma[/b:59c3199961]: sUbs [b:59c3199961]dds.scr[/b:59c3199961]
    [b:59c3199961]Waarvoor/waarom[/b:59c3199961]: DDS is een diagnosetool en maakt gebruik van scripts.
    [b:59c3199961]Moeilijkheidsgraad[/b:59c3199961]: Min of meer lastige voorbereidingsfase, dus lees alles eerst goed.
    [b:59c3199961]Downloadlokatie[/b:59c3199961]: Dit programma absoluut naar het bureaublad downloaden of anders eerst daar naar toe verplaatsen!
    [b:59c3199961]Download[/b:59c3199961] sUBs dds.scr [b:59c3199961]hier[/b:59c3199961]

    [img:59c3199961]http://img.photobucket.com/albums/v666/sUBs/dds_scr.gif[/img:59c3199961]

    [b:59c3199961]sUBs dds.scr gebruiken[/b:59c3199961]:
    [list:59c3199961][*:59c3199961][b:59c3199961]Belangrijk[/color:59c3199961][/b:59c3199961]: deaktiveer eerst de antivirussoftware en de aktieve spywarescanners!
    [*:59c3199961] [b:59c3199961]Sluit vervolgens eerst alle nog openstaande programmavensters![/color:59c3199961][/b:59c3199961]
    [list:59c3199961][*:59c3199961]Windows 2000 en Windows XP: start sUBs dds.scr middels dubbelklik op de snelkoppeling.
    [*:59c3199961]Windows Vista en Windows 7: start sUBs dds.scr rechtsklik op de snelkoppeling en dan kiezen voor Als Administrator uitvoeren.[/list:u:59c3199961]
    [*:59c3199961] Na de scan worden twee tekstdocumnenten geopend - DDS.txt en Attach.txt - [b:59c3199961]post de inhoud van beide logs[/b:59c3199961].[/list:u:59c3199961]
  • Het is gelukt!

    Hierbij het DDS log:

    .
    DDS (Ver_2011-08-26.01) - NTFSAMD64
    Internet Explorer: 9.0.8112.16421
    Run by Kylian at 19:23:18 on 2011-10-12
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.4087.2786 [GMT 2:00]
    .
    AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
    SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\atieclxx.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\system32\WUDFHost.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe
    C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
    C:\Advanced Wheel Mouse\wh_exec.exe
    E:\Muziek\iTunes\iTunesHelper.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\Macromed\Flash\FlashUtil64_11_0_1_ActiveX.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.com/ig
    mStart Page = hxxp://startsear.ch/?aff=1
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
    BHO: Aanmeldhulp voor Windows Live ID: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
    BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    TB: {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - No File
    uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    uRun: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
    mRun: [Adobe Reader Speed Launcher] "E:\Programma's\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    mRun: [WheelMouse] C:\ADVANC~1\wh_exec.exe
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "E:\Muziek\iTunes\iTunesHelper.exe"
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    StartupFolder: C:\Users\Kylian\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
    IE: &Verzenden naar OneNote - C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
    IE: E&xporteren naar Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
    TCP: DhcpNameServer = 192.168.178.1
    TCP: Interfaces\{00660BC0-A435-4EA8-B01E-3FC72837B039} : DhcpNameServer = 192.168.178.1
    TCP: Interfaces\{56D203A8-3349-44EF-B051-4D4E231018EF} : DhcpNameServer = 192.168.178.1
    TCP: Interfaces\{56D203A8-3349-44EF-B051-4D4E231018EF}\4427161646C6F6F637 : DhcpNameServer = 192.168.178.1
    TCP: Interfaces\{67ECEE6F-9E9D-4679-8676-237F4D737D47} : DhcpNameServer = 192.168.178.1
    TCP: Interfaces\{73303659-67E1-4A67-B587-7377D280D4AF} : DhcpNameServer = 192.168.178.1
    TCP: Interfaces\{9E24876C-02F3-4731-99E8-60B0D08CF4A5} : DhcpNameServer = 192.168.178.1
    TCP: Interfaces\{A51D694F-B234-4AB2-AF12-56405FA85698} : DhcpNameServer = 192.168.178.1
    TCP: Interfaces\{B5395A06-18B9-4A5D-ABBA-0DC1192B1FD3} : DhcpNameServer = 192.168.178.1
    TCP: Interfaces\{C2275E96-ADD4-434D-909B-3168A95A5403} : DhcpNameServer = 192.168.178.1
    TCP: Interfaces\{C2275E96-ADD4-434D-909B-3168A95A5403}\64259445A51224F6870264F6E60275C414E40273137303 : DhcpNameServer = 192.168.178.1
    TCP: Interfaces\{E3F9F169-EF99-4388-81E9-4BF3D419A1A6} : DhcpNameServer = 192.168.178.1
    TCP: Interfaces\{E3F9F169-EF99-4388-81E9-4BF3D419A1A6}\4427161646C6F6F637 : DhcpNameServer = 192.168.178.1
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
    {18DF081C-E8AD-4283-A596-FA578C2EBDC3}
    {72853161-30C5-4D22-B7F9-0BBC1D38A37E}
    {9030D464-4C02-4ABF-8ECC-5164760863C6}
    {B4F3A835-0E21-4959-BA22-42B3008E02FF}
    {DBC80044-A445-435b-BC74-9C25C1C588A9}
    TB-X64: {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - No File
    mRun-x64: [Adobe Reader Speed Launcher] "E:\Programma's\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    mRun-x64: [WheelMouse] C:\ADVANC~1\wh_exec.exe
    mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun-x64: [iTunesHelper] "E:\Muziek\iTunes\iTunesHelper.exe"
    mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    SEH-X64: {B5A7F190-DDA6-4420-B3BA-52453494E6CD}: Groove GFS Stub Execution Hook
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys –> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]
    R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys –> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe –> C:\Windows\system32\atiesrxx.exe [?]
    R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atipmdag.sys –> C:\Windows\system32\DRIVERS\atipmdag.sys [?]
    R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys –> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
    R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys –> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]
    R3 netr7364;Sitecom RT73-stuurprogramma voor draadloze netwerken voor Vista;C:\Windows\system32\DRIVERS
    etr7364.sys –> C:\Windows\system32\DRIVERS
    etr7364.sys [?]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
    R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys –> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
    R3 whfltr2k;WheelMouse USB Lower Filter Driver;C:\Windows\system32\DRIVERS\whfltr2k.sys –> C:\Windows\system32\DRIVERS\whfltr2k.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-6-23 136176]
    S2 LVPrcS64;Process Monitor;c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe –> c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe [?]
    S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys –> C:\Windows\system32\drivers\AtihdW76.sys [?]
    S3 CamDrL64;Logitech QuickCam Pro 3000(PID_08B0);C:\Windows\system32\DRIVERS\CamDrL64.sys –> C:\Windows\system32\DRIVERS\CamDrL64.sys [?]
    S3 dc21x4vm;dc21x4vm;C:\Windows\system32\DRIVERS\dc21x4vm.sys –> C:\Windows\system32\DRIVERS\dc21x4vm.sys [?]
    S3 ENTECH64;ENTECH64;\??\C:\Windows\system32\DRIVERS\ENTECH64.sys –> C:\Windows\system32\DRIVERS\ENTECH64.sys [?]
    S3 gupdatem;Google Update-service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-6-23 136176]
    S3 hitmanpro35;Hitman Pro 3.5 Support Driver;\??\C:\Windows\system32\drivers\hitmanpro35.sys –> C:\Windows\system32\drivers\hitmanpro35.sys [?]
    S3 LVUSBS64;Logitech USB Monitor Filter;C:\Windows\system32\drivers\LVUSBS64.sys –> C:\Windows\system32\drivers\LVUSBS64.sys [?]
    S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2011-6-12 51740536]
    S3 netr28ux;Compact Wireless-G USB Network Adapter;C:\Windows\system32\DRIVERS
    etr28ux.sys –> C:\Windows\system32\DRIVERS
    etr28ux.sys [?]
    S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys –> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
    S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]
    S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]
    S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?]
    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?]
    S3 WatAdminSvc;Windows Activation Technologies-service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
    .
    =============== File Associations ===============
    .
    .txt=
    .
    =============== Created Last 30 ================
    .
    2011-10-12 15:45:21 69000 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1F4134BB-8AA9-4647-BBE0-9D2AB481C998}\offreg.dll
    2011-10-12 15:45:19 9049936 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1F4134BB-8AA9-4647-BBE0-9D2AB481C998}\mpengine.dll
    2011-10-12 15:04:54 ——– d—–w- C:\Users\Kylian\AppData\Local\{462A190D-4E63-473A-A4D8-D14084D08505}
    2011-10-12 15:04:42 ——– d—–w- C:\Users\Kylian\AppData\Local\{1DA3531F-8ACA-4813-AB31-1B9977EEC16E}
    2011-10-12 14:31:05 9049936 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2011-10-12 14:30:39 917840 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7C25EB5D-FDC5-40A4-8C74-6925B096A2B6}\gapaengine.dll
    2011-10-12 14:29:54 ——– d—–w- C:\Lop SD
    2011-10-12 14:28:23 ——– d—–w- C:\Program Files (x86)\Microsoft Security Client
    2011-10-12 14:28:11 ——– d—–w- C:\Program Files\Microsoft Security Client
    2011-10-12 14:25:30 ——– d—–w- C:\Users\Kylian\AppData\Local\{2BCE14F0-A90A-4C42-9DE2-A9D15126AE27}
    2011-10-12 14:25:18 ——– d—–w- C:\Users\Kylian\AppData\Local\{FE1C2565-7469-485F-984F-28B980709604}
    2011-10-12 13:55:25 ——– d—–w- C:\Users\Kylian\AppData\Local\{1AA53AB9-595B-4BBB-9A04-9219BEF0EED5}
    2011-10-12 13:55:14 ——– d—–w- C:\Users\Kylian\AppData\Local\{85736153-56E2-4040-94FA-8468D5F85EAA}
    2011-10-12 13:55:11 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2011-10-12 13:41:31 388096 —-a-r- C:\Users\Kylian\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-10-12 13:41:31 ——– d—–w- C:\Program Files (x86)\Trend Micro
    2011-10-12 11:33:44 ——– d—–w- C:\Users\Kylian\AppData\Local\{934F71F8-8721-48E9-9F2F-6CDF8CE64684}
    2011-10-12 11:33:34 ——– d—–w- C:\Users\Kylian\AppData\Local\{AD7FB132-3164-429A-9667-21ED79A9F43A}
    2011-10-12 08:45:24 ——– d—–w- C:\Windows\SysWow64\wbem\en-US
    2011-10-12 08:45:23 ——– d—–w- C:\Windows\System32\wbem\en-US
    2011-10-12 08:31:38 ——– d—–w- C:\Users\Kylian\AppData\Local\{E15BDA55-E27C-46AB-BF4A-55A098266E5C}
    2011-10-12 08:31:28 ——– d—–w- C:\Users\Kylian\AppData\Local\{17EEA76B-7070-42AE-8A2A-44B268801E19}
    2011-10-12 06:33:23 9049936 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{14EE54EE-4A3F-4115-8FB9-407FFC2CF8F4}\mpengine.dll
    2011-10-12 06:32:43 3138048 —-a-w- C:\Windows\System32\win32k.sys
    2011-10-12 06:32:41 613888 —-a-w- C:\Windows\System32\psisdecd.dll
    2011-10-12 06:32:40 75776 —-a-w- C:\Windows\SysWow64\psisrndr.ax
    2011-10-12 06:32:40 465408 —-a-w- C:\Windows\SysWow64\psisdecd.dll
    2011-10-12 06:32:40 108032 —-a-w- C:\Windows\System32\psisrndr.ax
    2011-10-12 06:32:39 861696 —-a-w- C:\Windows\System32\oleaut32.dll
    2011-10-12 06:32:39 571904 —-a-w- C:\Windows\SysWow64\oleaut32.dll
    2011-10-12 06:32:39 331776 —-a-w- C:\Windows\System32\oleacc.dll
    2011-10-12 06:32:39 233472 —-a-w- C:\Windows\SysWow64\oleacc.dll
    2011-10-11 18:33:10 ——– d—–w- C:\Program Files (x86)\vShare.tv plugin
    2011-10-11 13:03:40 ——– d—–w- C:\Users\Kylian\AppData\Local\{90130A68-898A-490D-ABCD-61B6ABB68A88}
    2011-10-11 13:03:30 ——– d—–w- C:\Users\Kylian\AppData\Local\{B2B96835-8720-4148-BE36-0F35E864A91A}
    2011-10-11 06:56:27 ——– d—–w- C:\Users\Kylian\AppData\Local\{E153A9D3-4AE2-43B1-AD3E-96918EF78070}
    2011-10-11 06:56:16 ——– d—–w- C:\Users\Kylian\AppData\Local\{AEB72C7A-DC5D-4CE0-9450-9656CF68BEC4}
    2011-10-10 12:42:15 ——– d—–w- C:\Users\Kylian\AppData\Local\{162C4457-7D4B-4674-B21A-13CB71578485}
    2011-10-10 12:42:04 ——– d—–w- C:\Users\Kylian\AppData\Local\{F392EE6B-8B02-42AF-955B-77E5D0F6C904}
    2011-10-09 08:20:14 ——– d—–w- C:\Users\Kylian\AppData\Local\{7B0DC68A-353B-4AD0-910B-DAF1D3E70769}
    2011-10-09 08:20:04 ——– d—–w- C:\Users\Kylian\AppData\Local\{61B97AA1-40A2-4F77-AA77-E664F13F8BDA}
    2011-10-09 07:48:30 ——– d—–w- C:\Users\Kylian\AppData\Local\{C7B5A525-47FC-495B-B78A-0902EE3BFA7E}
    2011-10-09 07:48:20 ——– d—–w- C:\Users\Kylian\AppData\Local\{CF567B43-F077-4201-A235-5C706CE33426}
    2011-10-08 20:01:58 ——– d—–w- C:\Users\Kylian\AppData\Local\{E70175CE-8EC4-4140-B0A5-ED440BC1C48F}
    2011-10-08 20:01:48 ——– d—–w- C:\Users\Kylian\AppData\Local\{218F9159-D11C-451E-90F0-F6597216B1D7}
    2011-10-08 19:17:26 ——– d—–w- C:\Users\Kylian\AppData\Local\{C95FA776-3F5F-4A76-93D5-D64879B07E1E}
    2011-10-08 19:17:16 ——– d—–w- C:\Users\Kylian\AppData\Local\{5578178C-1E49-4A8A-A6B9-F3A97C2DAB82}
    2011-10-08 17:40:36 ——– d—–w- C:\Users\Kylian\AppData\Local\{DEAFCA60-2FE9-4A1C-A271-049DEC09B4F1}
    2011-10-08 17:40:24 ——– d—–w- C:\Users\Kylian\AppData\Local\{14E29B9D-4F22-4795-98FF-25F00EF46223}
    2011-10-08 16:26:50 ——– d—–w- C:\Users\Kylian\AppData\Local\{B16F9218-6E57-4724-8292-501C4B4FC45D}
    2011-10-08 16:26:40 ——– d—–w- C:\Users\Kylian\AppData\Local\{06671280-525F-412E-AB71-494BFF19BE9E}
    2011-10-08 14:43:38 ——– d—–w- C:\Users\Kylian\AppData\Local\{E6B24AB0-129C-4188-B083-A91E48C2B729}
    2011-10-08 14:43:28 ——– d—–w- C:\Users\Kylian\AppData\Local\{C6B40CE0-DFDC-4ACD-A0BD-15CF305E9074}
    2011-10-08 08:17:33 ——– d—–w- C:\Users\Kylian\AppData\Local\{D33056EB-1C63-49EA-BFFF-45B79110651E}
    2011-10-08 08:17:22 ——– d—–w- C:\Users\Kylian\AppData\Local\{C477CD54-781F-4130-96EA-340DA20F00A1}
    2011-10-07 22:11:21 ——– d—–w- C:\Users\Kylian\AppData\Local\{3AAFC060-883C-4985-A97A-3D6C5673CA97}
    2011-10-07 22:11:11 ——– d—–w- C:\Users\Kylian\AppData\Local\{B5EFB818-F5DB-4FDF-8E01-02D9BC7CF676}
    2011-10-07 18:39:25 ——– d—–w- C:\Users\Kylian\AppData\Local\{095A3490-4678-4BB3-A6C0-56007F150181}
    2011-10-07 18:39:14 ——– d—–w- C:\Users\Kylian\AppData\Local\{15CCCBE1-1F60-428B-8EC0-8E5D301A0B17}
    2011-10-07 17:45:18 ——– d—–w- C:\Users\Kylian\AppData\Local\{550402E4-6CC0-42FE-8A00-B5037FDEE1B9}
    2011-10-07 17:45:08 ——– d—–w- C:\Users\Kylian\AppData\Local\{9108A6EA-128B-498F-94D2-892083AE88F4}
    2011-10-07 16:00:54 ——– d—–w- C:\Users\Kylian\AppData\Local\{989FBFF0-A9F3-409A-9EE6-DC5517C3A1C7}
    2011-10-07 16:00:43 ——– d—–w- C:\Users\Kylian\AppData\Local\{68597AFF-5564-41F0-A113-0BFD739BBAA3}
    2011-10-07 12:44:49 ——– d—–w- C:\Users\Kylian\AppData\Local\{FD8250D8-1864-4CD1-8BC2-508A4E70F5E9}
    2011-10-07 12:44:38 ——– d—–w- C:\Users\Kylian\AppData\Local\{9DC51EA3-053B-4565-9426-15CEE39784B8}
    2011-10-06 17:32:10 ——– d—–w- C:\Users\Kylian\AppData\Local\{8291459E-5256-463A-8E88-496378D75025}
    2011-10-06 17:32:00 ——– d—–w- C:\Users\Kylian\AppData\Local\{BBC1D1EE-6DA4-46A9-BB72-4F3839E721FD}
    2011-10-06 15:12:44 ——– d—–w- C:\Users\Kylian\AppData\Local\{D7A127A2-47AF-47D3-BA21-589829728CE9}
    2011-10-06 15:12:22 ——– d—–w- C:\Users\Kylian\AppData\Local\{00527503-F71C-46FF-B820-C19F9CEC661D}
    2011-10-05 19:39:06 ——– d—–w- C:\Users\Kylian\AppData\Local\{0A37A416-C323-4339-9080-AB161B88944A}
    2011-10-05 19:38:54 ——– d—–w- C:\Users\Kylian\AppData\Local\{F23F0570-B77B-483D-B049-A3EC43F436D0}
    2011-10-05 17:22:36 ——– d—–w- C:\Users\Kylian\AppData\Local\{2C7B46AA-8414-40C2-A166-C5A1F33B7C8B}
    2011-10-05 17:22:13 ——– d—–w- C:\Users\Kylian\AppData\Local\{E31FF7B9-FF86-4018-9894-10DA2E1A2867}
    2011-10-05 15:37:51 ——– d—–w- C:\Users\Kylian\AppData\Local\{4E6B9D4A-48AE-4B32-A67B-D5846E6F300B}
    2011-10-05 15:37:32 ——– d—–w- C:\Users\Kylian\AppData\Local\{741499BB-0409-4118-A60B-24E69A9D7E5F}
    2011-10-05 06:07:25 ——– d—–w- C:\Users\Kylian\AppData\Local\{F8DE20AD-94C4-4CBD-9224-780102C688D8}
    2011-10-05 06:07:13 ——– d—–w- C:\Users\Kylian\AppData\Local\{603010DF-8B3F-4CB6-A913-C850A3EEED46}
    2011-10-04 19:35:20 ——– d—–w- C:\Users\Kylian\AppData\Local\{C1A62101-5D3B-4107-ADB8-2786E377CC13}
    2011-10-04 19:35:09 ——– d—–w- C:\Users\Kylian\AppData\Local\{4F53DE31-2AC1-4440-8C1C-BAFC43FC6B01}
    2011-10-04 15:14:23 ——– d—–w- C:\Users\Kylian\AppData\Local\{7590FFBA-F574-4D61-83D7-53E48F692B23}
    2011-10-04 15:14:10 ——– d—–w- C:\Users\Kylian\AppData\Local\{D6CB4D0B-8C00-4998-80DD-36742FCD6A1B}
    2011-10-03 19:00:50 ——– d—–w- C:\Users\Kylian\AppData\Local\{701F1B9D-E315-4E47-A444-96016F0F3407}
    2011-10-03 19:00:37 ——– d—–w- C:\Users\Kylian\AppData\Local\{E0ACC82C-4739-4AEC-BD42-00F4EF4AFF06}
    2011-10-03 15:32:17 ——– d—–w- C:\Users\Kylian\AppData\Local\{7E583F6D-61BD-4D03-9C54-6D4231733DFB}
    2011-10-03 15:32:05 ——– d—–w- C:\Users\Kylian\AppData\Local\{9CEE4A4D-BBDC-470F-8BAE-F5DB798B2707}
    2011-10-03 14:36:31 ——– d—–w- C:\Users\Kylian\AppData\Local\{B24F2C7C-BCEB-435B-AC4C-156CAD80B646}
    2011-10-03 14:36:19 ——– d—–w- C:\Users\Kylian\AppData\Local\{B6291043-F7D0-4D1A-B613-7ACF502779B4}
    2011-10-02 15:05:46 ——– d—–w- C:\Users\Kylian\AppData\Local\{D8DD571E-6E10-486D-9C9E-E8777CE91A21}
    2011-10-02 15:05:23 ——– d—–w- C:\Users\Kylian\AppData\Local\{12CB123F-9CD0-4A82-BD5F-240E07A4E7D7}
    2011-10-02 08:28:57 ——– d—–w- C:\Users\Kylian\AppData\Local\{B15AE65C-F455-4B8F-99EE-4A0D2B1C8074}
    2011-10-02 08:28:45 ——– d—–w- C:\Users\Kylian\AppData\Local\{69BD06C0-B2A2-4B10-A83D-D4F89954E474}
    2011-10-01 15:52:26 ——– d—–w- C:\Users\Kylian\AppData\Local\{7704CC02-F5E7-49F7-9A2F-93C0B7E6FA06}
    2011-10-01 15:52:15 ——– d—–w- C:\Users\Kylian\AppData\Local\{EADD3425-C165-44B0-A0C8-D04D184768EF}
    2011-10-01 08:25:14 ——– d—–w- C:\Users\Kylian\AppData\Local\{45FCD092-8555-470A-BCD2-C97ED434757E}
    2011-10-01 08:25:03 ——– d—–w- C:\Users\Kylian\AppData\Local\{1E5F13A5-8421-4C36-9BCD-0CA7F8C879E5}
    2011-10-01 06:46:27 ——– d—–w- C:\Users\Kylian\AppData\Local\{764FE024-ADD6-4ACD-B21E-4D70A3D5D4A4}
    2011-10-01 06:46:17 ——– d—–w- C:\Users\Kylian\AppData\Local\{32D2D97A-32BB-4EED-9ECB-06674892AAD8}
    2011-09-30 16:08:25 ——– d—–w- C:\Users\Kylian\AppData\Local\{E89EDB36-7B6E-41AF-B423-393FED3CBEAF}
    2011-09-30 16:08:13 ——– d—–w- C:\Users\Kylian\AppData\Local\{4CFFE0FC-97FB-4C06-8F0E-4D935D63855F}
    2011-09-30 05:08:40 ——– d—–w- C:\Users\Kylian\AppData\Local\{3ED5032B-4B1E-4D14-903F-513FDA5ADE8F}
    2011-09-30 05:08:28 ——– d—–w- C:\Users\Kylian\AppData\Local\{690D3C5A-8650-4626-92D7-42C9C861AEB7}
    2011-09-29 15:54:39 ——– d—–w- C:\Users\Kylian\AppData\Local\{36794A37-5E1F-4CC5-AC7F-56806B833DCB}
    2011-09-29 15:54:26 ——– d—–w- C:\Users\Kylian\AppData\Local\{31A6EFCB-7182-4299-9B7B-DDB9A3D8B0A3}
    2011-09-28 21:10:36 ——– d—–w- C:\Users\Kylian\AppData\Local\{D1B5F532-3A42-43C0-A2A2-7734875129D4}
    2011-09-28 21:10:25 ——– d—–w- C:\Users\Kylian\AppData\Local\{DFF61D1F-6A37-4825-A946-A37030B51BB7}
    2011-09-28 17:27:05 ——– d—–w- C:\Users\Kylian\AppData\Local\{A691F974-35BC-4DE2-AF4E-826E36093C77}
    2011-09-28 17:26:54 ——– d—–w- C:\Users\Kylian\AppData\Local\{BED607B2-C26F-4BDA-A2C4-0193C5E80FD8}
    2011-09-28 15:40:04 ——– d—–w- C:\Users\Kylian\AppData\Local\{ED3E3CA9-3DC4-4A6D-BCE0-834C9DF0D1D3}
    2011-09-28 15:39:52 ——– d—–w- C:\Users\Kylian\AppData\Local\{FF18E285-3C4F-48CB-9270-13DFD8B1AF11}
    2011-09-27 19:01:42 ——– d—–w- C:\Users\Kylian\AppData\Local\{19E8CA5F-0555-4BBD-9ABF-8542302AB3DF}
    2011-09-27 19:01:31 ——– d—–w- C:\Users\Kylian\AppData\Local\{01FCF4A7-AD97-41CB-BC45-3F855D1D0331}
    2011-09-27 18:15:48 ——– d—–w- C:\Users\Kylian\AppData\Local\{BDE4ED24-8FA5-453C-A3AA-085D99950E1D}
    2011-09-27 18:15:37 ——– d—–w- C:\Users\Kylian\AppData\Local\{2EBFF584-E7BA-4D94-9DE6-344002F1FD22}
    2011-09-27 16:36:23 ——– d—–w- C:\Users\Kylian\AppData\Local\{2D4F0CDE-1E2A-4A7D-A636-E7490CDEA18E}
    2011-09-27 16:36:12 ——– d—–w- C:\Users\Kylian\AppData\Local\{05FBEF63-8256-442B-A34F-0B4E16FE1A2D}
    2011-09-26 15:16:26 ——– d—–w- C:\Users\Kylian\AppData\Local\{91B515DA-7424-4FD0-8B4A-331BA7DEC68D}
    2011-09-26 15:16:04 ——– d—–w- C:\Users\Kylian\AppData\Local\{1069D3A1-B2AF-4984-BB4D-0DB1CF3FAEAD}
    2011-09-25 16:05:16 ——– d—–w- C:\Users\Kylian\AppData\Local\{CD7FC130-BA85-475B-BB93-42FFA5537FAE}
    2011-09-25 16:04:54 ——– d—–w- C:\Users\Kylian\AppData\Local\{C01F8623-1DFA-41B2-BFA1-F291C5A18182}
    2011-09-25 11:57:01 ——– d—–w- C:\Users\Kylian\AppData\Local\{B7263C4C-2BF3-40FC-9DC4-A745C8D831AA}
    2011-09-25 11:56:50 ——– d—–w- C:\Users\Kylian\AppData\Local\{C7280D9B-124A-4E92-BC32-8C1DCC0F2B81}
    2011-09-25 10:05:12 ——– d—–w- C:\Users\Kylian\AppData\Local\{C34C8507-F0DA-4D43-897C-606BAE361D22}
    2011-09-25 10:05:01 ——– d—–w- C:\Users\Kylian\AppData\Local\{59333B24-4B09-4FA0-B7FA-BB940CE5929F}
    2011-09-25 09:05:34 ——– d—–w- C:\Users\Kylian\AppData\Local\{25B921E3-0D10-4D72-824D-FE4CADA86552}
    2011-09-25 09:05:22 ——– d—–w- C:\Users\Kylian\AppData\Local\{0BD020C2-D533-4539-92FD-8B9902523F45}
    2011-09-25 08:46:23 ——– d—–w- C:\Users\Kylian\AppData\Local\{D4650747-1948-4C12-9F07-62AE88D2DF8F}
    2011-09-25 08:46:11 ——– d—–w- C:\Users\Kylian\AppData\Local\{3B5B27E5-08A2-43C9-998F-B1EB190498A3}
    2011-09-25 06:51:55 ——– d—–w- C:\Program Files\iTunes
    2011-09-25 06:51:55 ——– d—–w- C:\Program Files\iPod
    2011-09-25 06:50:06 ——– d—–w- C:\Program Files\Bonjour
    2011-09-25 06:50:06 ——– d—–w- C:\Program Files (x86)\Bonjour
    2011-09-25 06:47:19 159744 —-a-w- C:\Program Files (x86)\Mozilla Firefox\plugins
    pqtplugin7.dll
    2011-09-25 06:47:19 159744 —-a-w- C:\Program Files (x86)\Mozilla Firefox\plugins
    pqtplugin6.dll
    2011-09-25 06:47:19 159744 —-a-w- C:\Program Files (x86)\Mozilla Firefox\plugins
    pqtplugin5.dll
    2011-09-25 06:47:19 159744 —-a-w- C:\Program Files (x86)\Mozilla Firefox\plugins
    pqtplugin4.dll
    2011-09-25 06:47:19 159744 —-a-w- C:\Program Files (x86)\Mozilla Firefox\plugins
    pqtplugin3.dll
    2011-09-25 06:47:19 159744 —-a-w- C:\Program Files (x86)\Mozilla Firefox\plugins
    pqtplugin2.dll
    2011-09-25 06:47:19 159744 —-a-w- C:\Program Files (x86)\Mozilla Firefox\plugins
    pqtplugin.dll
    2011-09-25 06:41:25 ——– d—–w- C:\Users\Kylian\AppData\Local\{13BD2F40-D26F-493A-8D92-94BCD780CFE5}
    2011-09-25 06:41:14 ——– d—–w- C:\Users\Kylian\AppData\Local\{0FB9977C-6469-469E-A963-1F3CA867E7B7}
    2011-09-24 16:04:48 ——– d—–w- C:\Users\Kylian\AppData\Local\{0244617E-1008-4336-9917-CE0EAF94118C}
    2011-09-24 16:04:38 ——– d—–w- C:\Users\Kylian\AppData\Local\{3E3AD3A7-C815-4461-ABA3-1592ACCCF373}
    2011-09-24 12:03:56 ——– d—–w- C:\Users\Kylian\AppData\Local\{D5666AEA-4E61-4A0D-B7A7-96473E942F7C}
    2011-09-24 12:03:41 ——– d—–w- C:\Users\Kylian\AppData\Local\{182AD086-83C3-4093-A115-3D3A89DE606D}
    2011-09-24 11:21:39 ——– d—–w- C:\Users\Kylian\AppData\Local\{A97A4BC8-3ECC-4CCD-9DB9-27A5F09ED747}
    2011-09-24 11:21:28 ——– d—–w- C:\Users\Kylian\AppData\Local\{DD5392D3-BEEE-4528-AF59-649BAE372DA1}
    2011-09-24 08:41:10 ——– d—–w- C:\Users\Kylian\AppData\Local\{FB77D4FC-80BD-4A29-A0F7-EC4E94B3A952}
    2011-09-24 08:40:59 ——– d—–w- C:\Users\Kylian\AppData\Local\{BBCD7FBC-CC4C-44F1-AEB7-859110043971}
    2011-09-23 18:13:54 ——– d—–w- C:\Users\Kylian\AppData\Local\{75DDD89B-CC90-4B48-87AE-67040BA28F5C}
    2011-09-23 18:13:41 ——– d—–w- C:\Users\Kylian\AppData\Local\{6E42FA83-776A-4DBF-808D-628B99C0CB99}
    2011-09-22 15:11:57 ——– d—–w- C:\Users\Kylian\AppData\Local\{6F8A56C6-91B3-4C99-8795-72B5A36A2BD6}
    2011-09-22 15:10:50 ——– d—–w- C:\Users\Kylian\AppData\Local\{6D265801-FD93-47C2-84A4-2C8BD12CBC89}
    2011-09-21 15:15:41 ——– d—–w- C:\Users\Kylian\AppData\Local\{AF027FFB-2FA4-44A4-9B33-0F6DF68C7C2B}
    2011-09-21 15:15:31 ——– d—–w- C:\Users\Kylian\AppData\Local\{E7BE072C-56F8-420D-A749-E84636187581}
    2011-09-20 16:10:24 ——– d—–w- C:\Users\Kylian\AppData\Local\{AF6A173F-0DCD-434C-B329-DC8DA791FEE3}
    2011-09-20 16:10:12 ——– d—–w- C:\Users\Kylian\AppData\Local\{C0A8D5F3-9D3E-48A0-B39C-9944406EC84B}
    2011-09-19 18:48:57 ——– d—–w- C:\Users\Kylian\AppData\Local\{E4F82D3F-2EB5-4033-99B4-06DCC80965CF}
    2011-09-19 18:48:46 ——– d—–w- C:\Users\Kylian\AppData\Local\{EBE9C420-6054-4A94-A45C-53078F39CDA1}
    2011-09-19 16:41:07 ——– d—–w- C:\Users\Kylian\AppData\Local\{6766A90A-A675-4488-A32E-B93158B79491}
    2011-09-19 16:40:56 ——– d—–w- C:\Users\Kylian\AppData\Local\{82FCE0FB-895F-49F7-877A-6C7D36F77674}
    2011-09-19 14:48:29 ——– d—–w- C:\Users\Kylian\AppData\Local\{976A75D7-F0D9-4332-A436-5609AEE676E8}
    2011-09-19 14:48:18 ——– d—–w- C:\Users\Kylian\AppData\Local\{94EC69D8-C674-4FDE-8FEE-7DBB4A0C2B17}
    2011-09-18 18:51:11 ——– d—–w- C:\Users\Kylian\AppData\Local\{E841C675-3D63-471D-A574-AEC1C74CF05F}
    2011-09-18 18:51:00 ——– d—–w- C:\Users\Kylian\AppData\Local\{B43612FF-52D1-491D-B683-D9B2FC85A8AF}
    2011-09-18 16:28:53 ——– d—–w- C:\Users\Kylian\AppData\Local\{D788FF8E-9E13-4393-ACE2-955B263B96D7}
    2011-09-18 16:28:30 ——– d—–w- C:\Users\Kylian\AppData\Local\{798C001D-1170-4781-8D30-F86D3B9D88A1}
    2011-09-18 14:47:10 ——– d—–w- C:\Users\Kylian\AppData\Local\{BAC16FC6-EB61-453C-BB17-42D599233D05}
    2011-09-18 14:46:48 ——– d—–w- C:\Users\Kylian\AppData\Local\{92847015-18D3-46C7-87E0-FB9FBDEDAE1F}
    2011-09-17 14:03:50 ——– d—–w- C:\Users\Kylian\AppData\Local\{6BA7C722-3B40-4C24-8CBF-6FEB5EA067C7}
    2011-09-17 14:03:26 ——– d—–w- C:\Users\Kylian\AppData\Local\{EFA3D048-B13A-493B-B38D-583028155C20}
    2011-09-17 07:35:59 ——– d—–w- C:\Users\Kylian\AppData\Local\{DF6A915D-B93F-4784-A079-03F579F9C139}
    2011-09-17 07:35:47 ——– d—–w- C:\Users\Kylian\AppData\Local\{0216176E-938E-4E6A-A81F-BAB8EEE8D276}
    2011-09-17 07:16:31 ——– d—–w- C:\Users\Kylian\AppData\Roaming\Ezsuo
    2011-09-17 07:16:31 ——– d—–w- C:\Users\Kylian\AppData\Roaming\Aqcer
    2011-09-16 18:22:31 ——– d—–w- C:\Users\Kylian\AppData\Local\{AA2267E1-6FA5-4770-A81D-1E4D6854A9DB}
    2011-09-16 18:22:20 ——– d—–w- C:\Users\Kylian\AppData\Local\{4FFB8722-B70D-4B3B-9412-DA6EE0B0495A}
    2011-09-15 21:57:24 ——– d—–w- C:\Users\Kylian\AppData\Local\{47425A24-E68E-4366-91A8-64A21CC5C6BC}
    2011-09-15 21:57:13 ——– d—–w- C:\Users\Kylian\AppData\Local\{94A43AB8-C40E-40D0-B628-43FCA70CA36D}
    2011-09-15 20:08:11 ——– d—–w- C:\Users\Kylian\AppData\Local\{92D32BA2-0DA1-4F5D-A37E-67A7AAE37EC1}
    2011-09-15 20:08:00 ——– d—–w- C:\Users\Kylian\AppData\Local\{71536E84-03D6-4723-B9DC-2AF52521FF04}
    2011-09-14 18:35:50 ——– d—–w- C:\Users\Kylian\AppData\Local\{CE882D70-A826-403D-B230-A113E22FBC63}
    2011-09-14 18:35:39 ——– d—–w- C:\Users\Kylian\AppData\Local\{AFA47A81-4B90-476E-98AF-2B9E8236F549}
    2011-09-14 17:46:03 ——– d—–w- C:\Users\Kylian\AppData\Local\{7A7F3A73-1DAD-4F4B-91CA-C9DB55FE40DD}
    2011-09-14 17:45:53 ——– d—–w- C:\Users\Kylian\AppData\Local\{DFF95CC1-549A-4A8E-BFFD-1CEEA10883FB}
    2011-09-14 14:54:57 ——– d—–w- C:\Users\Kylian\AppData\Local\{45C26F4D-AF71-442B-B4CF-29C4F2F09845}
    2011-09-14 14:54:04 ——– d—–w- C:\Users\Kylian\AppData\Local\{3062B531-4B2E-485A-B774-CAF720A7536F}
    2011-09-13 16:05:08 ——– d—–w- C:\Users\Kylian\AppData\Local\{0AECA2AE-B96C-4B1C-876C-B6C6B0D3D0EA}
    2011-09-13 16:04:56 ——– d—–w- C:\Users\Kylian\AppData\Local\{C0170D66-9682-4EB0-9A10-8ECAC61FA71A}
    .
    ==================== Find3M ====================
    .
    2011-08-31 15:00:50 25416 —-a-w- C:\Windows\System32\drivers\mbam.sys
    2011-08-02 15:28:12 272448 —-a-w- C:\Windows\System32\drivers\dtsoftbus01.sys
    2011-07-19 03:05:24 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll
    2011-07-16 05:41:50 362496 —-a-w- C:\Windows\System32\wow64win.dll
    2011-07-16 05:41:49 243200 —-a-w- C:\Windows\System32\wow64.dll
    2011-07-16 05:41:49 13312 —-a-w- C:\Windows\System32\wow64cpu.dll
    2011-07-16 05:39:10 16384 —-a-w- C:\Windows\System32
    tvdm64.dll
    2011-07-16 05:37:12 421888 —-a-w- C:\Windows\System32\KernelBase.dll
    2011-07-16 04:29:19 14336 —-a-w- C:\Windows\SysWow64
    tvdm64.dll
    2011-07-16 04:26:00 44032 —-a-w- C:\Windows\apppatch\acwow64.dll
    2011-07-16 04:25:37 25600 —-a-w- C:\Windows\SysWow64\setup16.exe
    2011-07-16 04:24:23 5120 —-a-w- C:\Windows\SysWow64\wow32.dll
    2011-07-16 04:24:22 272384 —-a-w- C:\Windows\SysWow64\KernelBase.dll
    2011-07-16 02:21:44 7680 —-a-w- C:\Windows\SysWow64\instnm.exe
    2011-07-16 02:21:41 2048 —-a-w- C:\Windows\SysWow64\user.exe
    2011-07-16 02:17:19 6144 —ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
    2011-07-16 02:17:19 4608 —ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
    2011-07-16 02:17:19 3584 —ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
    2011-07-16 02:17:19 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
    .
    ============= FINISH: 19:23:37,87 ===============
  • Hierbij het Attach logje:

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 16-12-2009 16:57:36
    System Uptime: 12-10-2011 16:52:00 (3 hours ago)
    .
    Motherboard: MICRO-STAR INTERNATIONAL CO.,LTD | | P55-GD65 (MS-7583)
    Processor: Intel(R) Core(TM) i7 CPU 860 @ 2.80GHz | CPU 1 | 2801/133mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 100 GiB total, 30,221 GiB free.
    D: is FIXED (NTFS) - 20 GiB total, 13,689 GiB free.
    E: is FIXED (NTFS) - 812 GiB total, 597,501 GiB free.
    F: is CDROM (UDF)
    G: is CDROM (CDFS)
    H: is Removable
    I: is CDROM (CDFS)
    K: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {ff646f80-8def-11d2-9449-00105a075f6b}
    Description: pcouffin device for Amd 64 bits systems
    Device ID: ROOT\PCOUFFIN\0000
    Manufacturer: VSO Software
    Name: pcouffin device for Amd 64 bits systems
    PNP Device ID: ROOT\PCOUFFIN\0000
    Service: pcouffin
    .
    ==== System Restore Points ===================
    .
    RP562: 8-10-2011 9:53:34 - Windows Update
    RP563: 12-10-2011 8:33:00 - Windows Update
    RP564: 12-10-2011 15:41:02 - Installed HiJackThis
    .
    ==== Installed Programs ======================
    .
    7-Zip 4.65
    Adobe Flash Player 10 Plugin
    Adobe Media Player
    Adobe Reader 9.3 - Nederlands
    Apple Application Support
    Apple Software Update
    µTorrent
    Catalyst Control Center InstallProxy
    D3DX10
    DAEMON Tools Pro
    FIFA 12 © EA version 1
    Google Earth
    Google Update Helper
    Grand Theft Auto IV
    HiJackThis
    James Bond 007: Nightfire
    Java Auto Updater
    Java(TM) 6 Update 27
    K-Lite Codec Pack 5.6.1 (Full)
    Logitech Video Enumerator
    Logitech® Camera-stuurprogramma
    MAGIX Ringtone Maker 2 silver (US)
    Malwarebytes' Anti-Malware versie 1.51.2.1300
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft WSE 3.0 Runtime
    Microsoft XML Parser
    Mozilla Thunderbird (3.1.15)
    MSVCRT
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP2 Parser and SDK
    NVIDIA PhysX
    OpenAL
    QuickTime
    Rapture3D 2.3.22 Game
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Taalpakket voor Microsoft .NET Framework 4 Client Profile - NLD (KB2478663)
    Security Update for Taalpakket voor Microsoft .NET Framework 4 Client Profile - NLD (KB2518870)
    SopCast 3.2.8
    System Requirements Lab CYRI
    Ubisoft Game Launcher
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Visual C++ 8.0 Runtime Setup Package (x64)
    VLC media player 1.0.5
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Installer
    Windows Live Messenger
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live Sync
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Media Player Firefox Plugin
    Xvid 1.1.3 final uninstall
    .
    ==== End Of File ===========================
  • Eset schijnt deze keer goed gedeïnstalleerd te zijn!

    [b:33c06eab67]Welk programma[/b:33c06eab67]: Defogger
    [b:33c06eab67]Waarvoor/waarom[/b:33c06eab67]: Tool om CD-emulator-software te de-aktiveren dan wel weer te re-aktiveren
    [b:33c06eab67]Moeilijkheidsgraad[/b:33c06eab67]: geen.

    Download [b:33c06eab67]Defogger[/b:33c06eab67] naar of herplaats het tool naar jouw bureaublad.
    [list:33c06eab67][*:33c06eab67]Dubbelklik op Defogger.exe om de tool te starten.
    [*:33c06eab67]In het scherm dat verschijnt klik je op de knop "Disable".
    [*:33c06eab67]In het volgende scherm klik je op Ja (Yes) om verder te gaan.
    [*:33c06eab67]Wacht vervolgens tot je de melding 'Finished' krijgt en klik in dat scherm op "Ok".
    [*:33c06eab67]Indien DeFogger vraagt om de computer te herstarten doe je dit.[/list:u:33c06eab67]
    [quote:33c06eab67][b:33c06eab67]N.B.[/b:33c06eab67] Krijg je een foutmelding wanneer je Defogger gebruikt, dan zoek je op het bureaublad naar het bestand [b:33c06eab67]defogger_disable [/b:33c06eab67]en post je de inhoud van dit bestand.[/quote:33c06eab67]

    De CD-emulator-software kan je weer inschakelen met behulp van Defogger door wederom het tool te starten en op de knop "Re-enable" te klikken.
    Echter, dit doe je pas wanneer we volledig klaar zijn met de computerfix.


    [b:33c06eab67]Welk programma[/b:33c06eab67]: ComboFix
    [b:33c06eab67]Waarvoor/waarom[/b:33c06eab67]: Zeer specialistische scanner om Windows diepgaand te onderzoeken
    en zo mogelijk op te schonen.
    [b:33c06eab67]Moeilijkheidsgraad[/b:33c06eab67]: Min of meer lastige voorbereidingsfase, dus lees alles eerst goed.
    [b:33c06eab67]Downloadlokatie[/b:33c06eab67]: Dit programma absoluut naar het bureaublad downloaden!
    [b:33c06eab67]Download ComboFix via één van deze locaties[/b:33c06eab67]:
    [list:33c06eab67][*:33c06eab67][b:33c06eab67]Bleepingcomputer[/b:33c06eab67]
    [*:33c06eab67][b:33c06eab67]ForoSpyware[/b:33c06eab67]
    [*:33c06eab67][b:33c06eab67]Geekstogo[/b:33c06eab67][/list:u:33c06eab67]
    [b:33c06eab67]Hier[/b:33c06eab67] zie je hoe je ComboFix moet gebruiken.

    Antivirusprogramma en actieve malwarescanners dienen al voor de ComboFix start gedeaktiveert zijn!
    [b:33c06eab67]Hier[/b:33c06eab67] en [b:33c06eab67]hier[/b:33c06eab67] vindt je gegevens hoe antivirusprogramma's en spywarescanners te deaktiveren.

    [b:33c06eab67]Voor alle duidelijkheid nogmaals[/b:33c06eab67]: ComboFix dient vanaf het bureaublad gestart te worden.

    [b:33c06eab67]Opmerkingen[/b:33c06eab67]:
    [list:33c06eab67][*:33c06eab67] Bij gebruik van Windows XP zal er mogelijk gevraagd worden, om de "Recovery Console" te installeren! Sta dit dan toe (hiervoor is een actieve internet verbinding vereist).
    [*:33c06eab67]Vista- en Windows 7 gebruikers starten Combofix op via rechtsklik met Administratorrechten.
    [*:33c06eab67]Alle openstaande programma's en webpagina's dienen afgesloten te zijn.[/list:u:33c06eab67]
    [b:33c06eab67]ComboFix is opgestart[/b:33c06eab67]:
    [list:33c06eab67][*:33c06eab67]Niet in het zwarte venster klikken, hierdoor kan ComboFix of zelfs Windows geheel "bevriezen"!
    [*:33c06eab67]Combofix sluit tijdens de scan de internet verbinding – probeer deze tussentijds niet te herstellen!
    [*:33c06eab67]Het kan voorkomen dat de computer meerdere malen opnieuw opgestart moet worden, dit is normaal.
    [*:33c06eab67]Wanneer ComboFix gereed is, zal het het een logbestand voor je maken.
    [*:33c06eab67]Post de inhoud van dit logbestand in je volgende bericht.
    [*:33c06eab67]Indien het log niet opstart, is dit terug tevinden in C:\ComboFix.txt[/list:u:33c06eab67]
    [b:33c06eab67]Belangrijke opmerking[/b:33c06eab67]:
    [list:33c06eab67][*:33c06eab67][b:33c06eab67]Indien na de scan bij het opstarten van programma's er een error wordt getoond met de melding:[/color:33c06eab67][/b:33c06eab67]
    [*:33c06eab67][b:33c06eab67]Illegal operation attempted on a registery key that has been marked for deletion.[/color:33c06eab67][/b:33c06eab67]
    [*:33c06eab67][b:33c06eab67]Start dan de computer opnieuw op.[/color:33c06eab67][/b:33c06eab67][/list:u:33c06eab67]
  • ComboFix Logje

    ComboFix 11-10-12.01 - Kylian 12-10-2011 20:29:41.1.8 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.4087.2891 [GMT 2:00]
    Gestart vanuit: c:\users\Kylian\Desktop\ComboFix.exe
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    C:\prefs.js
    c:\users\Kylian\AppData\Roaming\inst.exe
    c:\users\Kylian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2 .lnk
    c:\windows\IsUn0413.exe
    c:\windows\ST6UNST.000
    .
    .
    (((((((((((((((((((( Bestanden Gemaakt van 2011-09-12 to 2011-10-12 ))))))))))))))))))))))))))))))
    .
    .
    2011-10-12 14:29 . 2011-10-12 18:09 ——– d—–w- C:\Lop SD
    2011-10-12 14:28 . 2011-10-12 18:09 ——– d—–w- c:\program files\Microsoft Security Client
    2011-10-12 08:45 . 2011-10-12 08:45 ——– d—–w- c:\windows\SysWow64\wbem\en-US
    2011-10-12 08:45 . 2011-10-12 08:45 ——– d—–w- c:\windows\system32\wbem\en-US
    2011-10-12 06:33 . 2011-09-13 00:26 9049936 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{14EE54EE-4A3F-4115-8FB9-407FFC2CF8F4}\mpengine.dll
    2011-10-12 06:32 . 2011-09-06 03:03 3138048 —-a-w- c:\windows\system32\win32k.sys
    2011-10-12 06:32 . 2011-08-17 05:26 613888 —-a-w- c:\windows\system32\psisdecd.dll
    2011-10-12 06:32 . 2011-08-17 05:25 108032 —-a-w- c:\windows\system32\psisrndr.ax
    2011-10-12 06:32 . 2011-08-17 04:24 465408 —-a-w- c:\windows\SysWow64\psisdecd.dll
    2011-10-12 06:32 . 2011-08-17 04:19 75776 —-a-w- c:\windows\SysWow64\psisrndr.ax
    2011-10-12 06:32 . 2011-08-27 05:37 861696 —-a-w- c:\windows\system32\oleaut32.dll
    2011-10-12 06:32 . 2011-08-27 05:37 331776 —-a-w- c:\windows\system32\oleacc.dll
    2011-10-12 06:32 . 2011-08-27 04:26 571904 —-a-w- c:\windows\SysWow64\oleaut32.dll
    2011-10-12 06:32 . 2011-08-27 04:26 233472 —-a-w- c:\windows\SysWow64\oleacc.dll
    2011-10-11 18:33 . 2011-10-12 13:10 ——– d—–w- c:\program files (x86)\vShare.tv plugin
    2011-10-01 07:04 . 2011-10-01 07:04 ——– d—–w- c:\program files (x86)\Common Files\Java
    2011-09-25 06:51 . 2011-09-25 06:52 ——– d—–w- c:\program files\iTunes
    2011-09-25 06:51 . 2011-09-25 06:51 ——– d—–w- c:\program files\iPod
    2011-09-25 06:50 . 2011-09-25 06:50 ——– d—–w- c:\program files\Bonjour
    2011-09-25 06:50 . 2011-09-25 06:50 ——– d—–w- c:\program files (x86)\Bonjour
    2011-09-25 06:47 . 2011-09-25 06:47 159744 —-a-w- c:\program files (x86)\Mozilla Firefox\plugins
    pqtplugin7.dll
    2011-09-25 06:47 . 2011-09-25 06:47 159744 —-a-w- c:\program files (x86)\Mozilla Firefox\plugins
    pqtplugin6.dll
    2011-09-25 06:47 . 2011-09-25 06:47 159744 —-a-w- c:\program files (x86)\Mozilla Firefox\plugins
    pqtplugin5.dll
    2011-09-25 06:47 . 2011-09-25 06:47 159744 —-a-w- c:\program files (x86)\Mozilla Firefox\plugins
    pqtplugin4.dll
    2011-09-25 06:47 . 2011-09-25 06:47 159744 —-a-w- c:\program files (x86)\Mozilla Firefox\plugins
    pqtplugin3.dll
    2011-09-25 06:47 . 2011-09-25 06:47 159744 —-a-w- c:\program files (x86)\Mozilla Firefox\plugins
    pqtplugin2.dll
    2011-09-25 06:47 . 2011-09-25 06:47 159744 —-a-w- c:\program files (x86)\Mozilla Firefox\plugins
    pqtplugin.dll
    2011-09-25 06:47 . 2011-09-25 06:47 ——– d—–w- c:\program files (x86)\QuickTime
    2011-09-25 06:43 . 2011-09-25 06:43 ——– d—–w- c:\program files (x86)\Apple Software Update
    2011-09-17 07:16 . 2011-09-17 13:52 ——– d—–w- c:\users\Kylian\AppData\Roaming\Ezsuo
    2011-09-17 07:16 . 2011-09-17 07:17 ——– d—–w- c:\users\Kylian\AppData\Roaming\Aqcer
    .
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-08-31 15:00 . 2010-05-01 07:53 25416 —-a-w- c:\windows\system32\drivers\mbam.sys
    2011-08-02 15:28 . 2011-08-02 15:28 272448 —-a-w- c:\windows\system32\drivers\dtsoftbus01.sys
    2011-07-19 03:05 . 2010-05-01 21:44 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll
    2011-07-16 05:41 . 2011-08-20 12:34 362496 —-a-w- c:\windows\system32\wow64win.dll
    2011-07-16 05:41 . 2011-08-20 12:34 243200 —-a-w- c:\windows\system32\wow64.dll
    2011-07-16 05:41 . 2011-08-20 12:34 13312 —-a-w- c:\windows\system32\wow64cpu.dll
    2011-07-16 05:39 . 2011-08-20 12:34 16384 —-a-w- c:\windows\system32
    tvdm64.dll
    2011-07-16 05:37 . 2011-08-20 12:34 421888 —-a-w- c:\windows\system32\KernelBase.dll
    2011-07-16 05:21 . 2011-08-20 12:34 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 4608 —ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 4096 —ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 5120 —ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3584 —ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
    2011-07-16 05:21 . 2011-08-20 12:34 3072 —ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
    2011-07-16 04:29 . 2011-08-20 12:34 14336 —-a-w- c:\windows\SysWow64
    tvdm64.dll
    2011-07-16 04:26 . 2011-08-20 12:34 44032 —-a-w- c:\windows\apppatch\acwow64.dll
    2011-07-16 04:25 . 2011-08-20 12:34 25600 —-a-w- c:\windows\SysWow64\setup16.exe
    2011-07-16 04:24 . 2011-08-20 12:34 5120 —-a-w- c:\windows\SysWow64\wow32.dll
    2011-07-16 04:24 . 2011-08-20 12:34 272384 —-a-w- c:\windows\SysWow64\KernelBase.dll
    2011-07-16 04:15 . 2011-08-20 12:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 5120 —ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
    2011-07-16 04:15 . 2011-08-20 12:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
    2011-07-16 02:21 . 2011-08-20 12:34 7680 —-a-w- c:\windows\SysWow64\instnm.exe
    2011-07-16 02:21 . 2011-08-20 12:34 2048 —-a-w- c:\windows\SysWow64\user.exe
    2011-07-16 02:17 . 2011-08-20 12:34 6144 —ha-w- c:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
    2011-07-16 02:17 . 2011-08-20 12:34 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
    2011-07-16 02:17 . 2011-08-20 12:34 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
    2011-07-16 02:17 . 2011-08-20 12:34 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "Adobe Reader Speed Launcher"="e:\programma's\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
    "WheelMouse"="c:\advanc~1\wh_exec.exe" [2007-11-10 98304]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-07-05 421888]
    "iTunesHelper"="e:\muziek\iTunes\iTunesHelper.exe" [2011-08-18 421736]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
    R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-23 136176]
    R2 LVPrcS64;Process Monitor;c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe [x]
    R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
    R3 CamDrL64;Logitech QuickCam Pro 3000(PID_08B0);c:\windows\system32\DRIVERS\CamDrL64.sys [x]
    R3 dc21x4vm;dc21x4vm;c:\windows\system32\DRIVERS\dc21x4vm.sys [x]
    R3 ENTECH64;ENTECH64;c:\windows\system32\DRIVERS\ENTECH64.sys [x]
    R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-23 136176]
    R3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\system32\drivers\hitmanpro35.sys [x]
    R3 LVcKap64;Logitech AEC Driver;c:\windows\system32\DRIVERS\LVcKap64.sys [x]
    R3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys [x]
    R3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [x]
    R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
    R3 MSICDSetup;MSICDSetup;F:\CDriver64.sys [x]
    R3 netr28ux;Compact Wireless-G USB Network Adapter;c:\windows\system32\DRIVERS
    etr28ux.sys [x]
    R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
    S3 netr7364;Sitecom RT73-stuurprogramma voor draadloze netwerken voor Vista;c:\windows\system32\DRIVERS
    etr7364.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
    S3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\DRIVERS\whfltr2k.sys [x]
    .
    .
    Inhoud van de 'Gedeelde Taken' map
    .
    2011-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-23 17:40]
    .
    2011-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-23 17:40]
    .
    2011-10-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3628686573-1125093920-929137739-1000Core.job
    - c:\users\Kylian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-29 22:00]
    .
    2011-10-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3628686573-1125093920-929137739-1000UA.job
    - c:\users\Kylian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-29 22:00]
    .
    .
    ——— x86-64 ———–
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "c:\windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_951c1812f542740a"="del" [X]
    "c:\windows\System32\DriverStore\FileRepository\atiriol6.inf_amd64_neutral_bde34ad5722cca75"="del" [X]
    "c:\windows\System32\DriverStore\FileRepository\c7_88538.inf_amd64_neutral_c86579caa6a5cd40"="del" [X]
    "c:\windows\System32\DriverStore\FileRepository\c7_96979.inf_amd64_neutral_8e69a64022b7b0aa"="del" [X]
    "c:\windows\winsxs\amd64_atiilhag.inf.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_615727cea0a2b1f2"="del" [X]
    "c:\windows\winsxs\amd64_atiilhag.inf_31bf3856ad364e35_6.1.7600.16385_none_019357585ef99a63"="del" [X]
    "c:\windows\winsxs\amd64_atiriol6.inf_31bf3856ad364e35_6.1.7600.16385_none_a909ad21d26d5bd0"="del" [X]
    "c:\windows\System32\DriverStore\FileRepository\c7104558.inf_amd64_neutral_554171688b125583"="del" [X]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x1
    .
    ——- Bijkomende Scan ——-
    .
    uStart Page = hxxp://igoogle.com/
    uLocal Page = c:\windows\system32\blank.htm
    mStart Page = hxxp://startsear.ch/?aff=1
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = *.local
    IE: &Verzenden naar OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
    IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
    TCP: DhcpNameServer = 192.168.178.1
    .
    .
    ——- Bestandsassociaties ——-
    .
    .txt=
    .
    - - - - ORPHANS VERWIJDERD - - - -
    .
    WebBrowser-{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - (no file)
    .
    .
    .
    ——————— VERGRENDELDE REGISTER SLEUTELS ———————
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlDbg10.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlDbg10.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlDbg10.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlDbg10.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker2"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info]
    @Denied: (2) (LocalSystem)
    "AppDataDir"="c:\\ProgramData\\ESET\\ESET NOD32 Antivirus\\"
    "DataDir"="ESET\\ESET NOD32 Antivirus\\"
    "EditionName"=" "
    "InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\"
    "LanguageId"=dword:00000413
    "PackageTag"=dword:6090e758
    "ProductBase"=dword:00000000
    "ProductCode"="{1DA15AAD-E6C0-4917-8E37-7D8CF16EC5F4}"
    "ProductName"="ESET NOD32 Antivirus"
    "ProductType"="eav"
    "ProductVersion"="4.2.40.10"
    "UniqueId"="00E099084BEAA897"
    "ScannerBuild"=dword:00001aeb
    "ScannerVersionId"=dword:00001390
    "ScannerVersion"="Open window for status."
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ———————— Andere Aktieve Processen ————————
    .
    c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files (x86)\Bonjour\mDNSResponder.exe
    .
    **************************************************************************
    .
    Voltooingstijd: 2011-10-12 20:37:57 - machine werd herstart
    ComboFix-quarantined-files.txt 2011-10-12 18:37
    ComboFix2.txt 2011-10-12 18:00
    .
    Pre-Run: 32.143.110.144 bytes beschikbaar
    Post-Run: 31.597.031.424 bytes beschikbaar
    .
    - - End Of File - - 2B85FF168DCB4D2B06DCCE82936CB413
  • Moet wel even vermelden dat ik nu geen last meer heb van de irritante zoekmachine "StartSear.ch", dit komt neem ik aan door de ComboFix?

    EDIT: Toch wel, heb 2 versies van Internet Explorer. Één normale versie en een 64-bit versie. Startsear.ch komt nu alleen voor bij de 64-bit versie…

Beantwoord deze vraag

Dit is een gearchiveerde pagina. Antwoorden is niet meer mogelijk.