Vraag & Antwoord

Beveiliging & privacy

CPU constant 50% door procedure System. Help!

Anoniem
Abraham54
55 antwoorden
  • Beste mensen van dit forum,

    Mijn naam is Marc en ik heb een (best wel groot) probleem met mijn PC (desktop).

    Zie eerst hier waaruit mijn desktop bestaat:
    - Intel (R) Pentium (R) D CPU 2.66GHz
    - 1.2 GB RAM
    - Microsoft Windows XP Professional Service Pack 3 (build 2600)
    - GeForce 8600 GT Videocard
    - Realtek High Definition Audio Soundcard 5.1

    Het probleem is dat wanneer ALLES uit staat, mijn CPU 50% is door de procedure genaamd System. Wanneer ik dus op internet ga, stijgt dit CPU naar de 90-100%, wat mijn PC dus extreem langzaam maakt en waardoor ik games die ik voorheen wél kon spelen nu niet meer kan spelen zonder extreme lagg te hebben.

    Ik heb Process Explorer gedownload om te achterhalen wáár nou precies System zich mee bezighoudt maar er staat niets.

    Heeft iemand last gehad van een soortgelijk probleem?
    Hoe los ik dit op?

    Hartelijk dank voor iedereen die mij helpen wilt.

    Met vriendelijke groet,

    Marc
  • Hoi Marc, daar gaan we dan maar tegenaan!

    [b:e368d3a6e1]Ik wil graag dat jij je tijdens de fix aan onderstaande regels houdt:[/b:e368d3a6e1]
  • Ten eerste ONWIJS bedankt voor uw hulp!
    Zie hieronder de HiJack Logfile, ik ga nu verder met stap 2.

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 12:31:37, on 13-9-2011
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Sitecom Shared\PnP Universal Installer\DevNotifySvc.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
    C:\Program Files\Eset\nod32krn.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\CyberLink\Shared files\RichVideo.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Eset\nod32kui.exe
    C:\Program Files\Eset\UpdateReminder.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Microsoft IntelliType Pro\itype.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Sitecom Shared\PnP Universal Installer\PnPUIReg.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Pando Networks\Media Booster\PMB.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/?ref=hp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    R3 - URLSearchHook: uTorrentBar_NL Toolbar - {87775fdb-6972-41f9-ae51-8326e38cb206} - C:\Program Files\uTorrentBar_NL\prxtbuTo0.dll
    O1 - Hosts: 66.98.148.65 auto.search.msn.com
    O1 - Hosts: 66.98.148.65 auto.search.msn.es
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: uTorrentBar_NL - {87775fdb-6972-41f9-ae51-8326e38cb206} - C:\Program Files\uTorrentBar_NL\prxtbuTo0.dll
    O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: uTorrentBar_NL Toolbar - {87775fdb-6972-41f9-ae51-8326e38cb206} - C:\Program Files\uTorrentBar_NL\prxtbuTo0.dll
    O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [UpdateReminder] C:\Program Files\Eset\UpdateReminder.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
    O4 - HKLM\..\Run: [UpdatePDRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\9.0"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
    O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [PnPUI Registrator] C:\Program Files\Common Files\Sitecom Shared\PnP Universal Installer\PnPUIReg.exe -s
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
    O4 - HKCU\..\Run: [Sony Ericsson PC Companion] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" /Background
    O4 - HKCU\..\Run: [Comrade.exe] C:\Program Files\GameSpy\Comrade\Comrade.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
    O4 - HKUS\S-1-5-21-823518204-616249376-725345543-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'UpdatusUser')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1301758368484
    O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - https://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.67.0.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.26.0.cab
    O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: DevNotifySvc - ASD - C:\Program Files\Common Files\Sitecom Shared\PnP Universal Installer\DevNotifySvc.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
    O23 - Service: Sony Ericsson PCCompanion - Avanquest Software - C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe


    End of file - 8750 bytes
  • Stap 2 leverde geen resultaten op. Er waren 0 geïnfecteerde bestanden.
    Op naar Stap 3!
  • Stap 3 leverde (volgens mij) ook niets op, zie hieronder het log-bestand:

    Malwarebytes' Anti-Malware 1.51.2.1300
    www.malwarebytes.org

    Databaseversie: 7707

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    13-9-2011 13:04:18
    mbam-log-2011-09-13 (13-04-18).txt

    Scantype: Snelle scan
    Objecten gescand: 182865
    Verstreken tijd: 10 minuut/minuten, 3 seconde(n)

    Geheugenprocessen geïnfecteerd: 0
    Geheugenmodulen geïnfecteerd: 0
    Registersleutels geïnfecteerd: 0
    Registerwaarden geïnfecteerd: 0
    Registerdata geïnfecteerd: 0
    Mappen geïnfecteerd: 0
    Bestanden geïnfecteerd: 0

    Geheugenprocessen geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)

    Geheugenmodulen geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)

    Registersleutels geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)

    Registerwaarden geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)

    Registerdata geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)

    Mappen geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)

    Bestanden geïnfecteerd:
    (Geen kwaadaardige objecten gedetecteerd)

    Ik wacht uw antwoord met smacht af haha, wil gráág dit probleem opgelost zien. Nogmaals bedankt voor de hulp!
  • Hoi ik verwachtte deze uitkomsten al min of meer!

    Je krijgt nu eerst een volgende opdracht, waarbij hoogstwaarschijnlijk ook de hostfile gerepareerd gaat worden!


    [b:c371155161]Download LopSD of LOPSD naar je Bureaublad.[/b:c371155161]
    [list:c371155161][*:c371155161] [b:c371155161]De-activeer bij dit tooltje je antispyware en virusscanner.[/b:c371155161]
    [list:c371155161][*:c371155161][b:c371155161]Vista- en Windows 7 gebruikers: rechtsklik op LopSD en kies voor "Als Administrator uitvoeren"![/list:u:c371155161]
    [*:c371155161] Kies Optie N en Enter
    [*:c371155161] Klik OK bij het informatie venter
    [*:c371155161] Kies Optie 2 en Enter
    [*:c371155161] Aan het eind verschijnt een log ( LopR.txt ) plaats de inhoud ervan in je volgende antwoord[/b:c371155161][/list:u:c371155161]


    En dan nog dit Mark - je hoeft me geen PB te sturen, dat je alle opdrachten hebt uitgevoerd.
    Ik zie vanzelf wel dat je een nieuw bericht gepost hebt.
    En nog wat, je mag me met u aanspreken, maar ook gewoon zoals ik jou aanspreek, dus met je, jij enz.
  • Oké top!
    Ja sorry, ik doe dat automatisch haha.
    En nu ik weet dat, dat niet hoeft zal ik 't ook niet meer doen ;) Ook handig om te weten trouwens, thanks.
    Ga ik nu LopSD proberen, je hoort zo van me!
  • Zie hieronder het Log-Bestand, vraag me niet waar de vage cookies vandaan komen, want ik heb geen flauw idee haha.


    ——————–\\ Lop S&D 4.2.5-0 XP/Vista

    Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
    X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) D CPU 2.66GHz )
    BIOS : Phoenix - AwardBIOS v6.00PG
    USER : Marc ( Not Administrator ! )
    BOOT : Normal boot
    Antivirus : NOD32 antivirus systeem 2.50 2.50 (Activated)
    C:\ (Local Disk) - NTFS - Total:153 Go (Free:78 Go)
    D:\ (CD or DVD)

    "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
    Option : [2] ( di 13-09-2011|13:31 )


    \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ HERSTEL

    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@d2.advertserve[1].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@adultfriendfinder[10].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@adultfriendfinder[11].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@adultfriendfinder[1].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@adultfriendfinder[2].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@adultfriendfinder[3].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@adultfriendfinder[4].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@adultfriendfinder[5].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@adultfriendfinder[6].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@adultfriendfinder[7].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@adultfriendfinder[8].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@adultfriendfinder[9].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@advertising[2].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@advertising[3].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@advertising[4].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@ero-advertising[10].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@ero-advertising[11].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@ero-advertising[1].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@ero-advertising[2].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@ero-advertising[3].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@ero-advertising[4].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@ero-advertising[5].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@ero-advertising[6].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@ero-advertising[7].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@ero-advertising[8].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@ero-advertising[9].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@bpid.bigpoint[1].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@nl.farmerama.bigpoint[1].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@partypoker[10].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@partypoker[11].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@partypoker[1].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@partypoker[2].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@partypoker[3].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@partypoker[4].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@partypoker[5].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@partypoker[6].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@partypoker[7].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@partypoker[8].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@partypoker[9].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@www.partypoker[10].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@www.partypoker[11].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@www.partypoker[1].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@www.partypoker[2].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@www.partypoker[3].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@www.partypoker[4].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@www.partypoker[5].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@www.partypoker[6].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@www.partypoker[7].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@www.partypoker[8].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@www.partypoker[9].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@888[1].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@888[2].txt
    Verwijderd ! - C:\DOCUME~1\Marc\Cookies\marc@888[4].txt

    \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


    ——————–\\ Beschrijving van mappen in APPLIC~1

    [06-08-2011|17:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
    [01-07-2011|16:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
    [11-05-2011|19:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
    [02-04-2011|17:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Easy Driver Pro
    [02-04-2011|17:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
    [13-09-2011|12:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
    [01-04-2011|16:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
    [12-09-2011|16:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
    [10-08-2011|16:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
    [11-05-2011|20:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
    [11-09-2011|18:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA
    [11-09-2011|18:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA Corporation
    [01-04-2011|13:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
    [02-04-2011|17:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Drivers HeadQuarters
    [08-08-2011|18:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PMB Files
    [01-07-2011|18:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SmartSound Software Inc
    [05-09-2011|20:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
    [30-05-2011|17:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sun
    [13-05-2011|09:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Tages
    [01-07-2011|17:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Temp
    [10-07-2011|22:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
    [01-09-2011|00:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\vsosdk
    [02-04-2011|18:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
    [0|bestand(en)] C:\DOCUME~1\ALLUSE~1\APPLIC~1\bytes
    [25|map(pen)] C:\DOCUME~1\ALLUSE~1\APPLIC~1\bytes beschikbaar

    [31-03-2011|21:14] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
    [0|bestand(en)] C:\DOCUME~1\DEFAUL~1\APPLIC~1\bytes
    [3|map(pen)] C:\DOCUME~1\DEFAUL~1\APPLIC~1\bytes beschikbaar

    [31-03-2011|21:14] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
    [0|bestand(en)] C:\DOCUME~1\LOCALS~1\APPLIC~1\bytes
    [3|map(pen)] C:\DOCUME~1\LOCALS~1\APPLIC~1\bytes beschikbaar

    [01-04-2011|16:39] C:\DOCUME~1\Marc\APPLIC~1\Adobe
    [01-07-2011|17:02] C:\DOCUME~1\Marc\APPLIC~1\CyberLink
    [31-03-2011|21:25] C:\DOCUME~1\Marc\APPLIC~1\Identities
    [05-08-2011|09:49] C:\DOCUME~1\Marc\APPLIC~1\LolClient
    [01-04-2011|16:30] C:\DOCUME~1\Marc\APPLIC~1\Macromedia
    [13-09-2011|12:50] C:\DOCUME~1\Marc\APPLIC~1\Malwarebytes
    [13-09-2011|12:30] C:\DOCUME~1\Marc\APPLIC~1\Microsoft
    [11-05-2011|23:24] C:\DOCUME~1\Marc\APPLIC~1\Nero
    [12-09-2011|16:35] C:\DOCUME~1\Marc\APPLIC~1\NVIDIA
    [13-09-2011|13:30] C:\DOCUME~1\Marc\APPLIC~1\PriceGong
    [08-09-2011|11:19] C:\DOCUME~1\Marc\APPLIC~1\SecuROM
    [30-07-2011|21:15] C:\DOCUME~1\Marc\APPLIC~1\Sony
    [30-05-2011|17:15] C:\DOCUME~1\Marc\APPLIC~1\Sun
    [29-08-2011|23:23] C:\DOCUME~1\Marc\APPLIC~1\U3
    [13-09-2011|12:26] C:\DOCUME~1\Marc\APPLIC~1\uTorrent
    [02-09-2011|14:34] C:\DOCUME~1\Marc\APPLIC~1\vlc
    [31-08-2011|21:29] C:\DOCUME~1\Marc\APPLIC~1\Vso
    [13-05-2011|09:35] C:\DOCUME~1\Marc\APPLIC~1\WinRAR
    [0|bestand(en)] C:\DOCUME~1\Marc\APPLIC~1\bytes
    [20|map(pen)] C:\DOCUME~1\Marc\APPLIC~1\bytes beschikbaar

    [31-03-2011|21:18] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
    [0|bestand(en)] C:\DOCUME~1\NETWOR~1\APPLIC~1\bytes
    [3|map(pen)] C:\DOCUME~1\NETWOR~1\APPLIC~1\bytes beschikbaar

    [31-03-2011|21:14] C:\DOCUME~1\UPDATU~1\APPLIC~1\Microsoft
    [0|bestand(en)] C:\DOCUME~1\UPDATU~1\APPLIC~1\bytes
    [3|map(pen)] C:\DOCUME~1\UPDATU~1\APPLIC~1\bytes beschikbaar

    ——————–\\ Geplande Taken gelocaliseerd in C:\WINDOWS\Tasks

    [13-09-2011 09:39][–ah—–] C:\WINDOWS\tasks\SA.DAT
    [02-09-2004 14:00][-r-h—–] C:\WINDOWS\tasks\desktop.ini

    ——————–\\ Beschrijving van mappen in C:\Program Files

    [06-08-2011|17:36] C:\Program Files\Adobe
    [10-07-2011|22:11] C:\Program Files\Bejeweled 3
    [11-09-2011|17:56] C:\Program Files\Common Files
    [31-03-2011|21:06] C:\Program Files\ComPlus Applications
    [05-04-2011|22:48] C:\Program Files\Conduit
    [03-06-2011|08:57] C:\Program Files\ConduitEngine
    [01-07-2011|17:01] C:\Program Files\CyberLink
    [26-05-2011|23:44] C:\Program Files\EA Games
    [08-09-2011|10:57] C:\Program Files\Electronic Arts
    [28-07-2011|19:44] C:\Program Files\ESET
    [08-09-2011|11:14] C:\Program Files\GameSpy
    [02-04-2011|18:41] C:\Program Files\Google
    [13-04-2011|17:05] C:\Program Files\Guild Wars
    [05-09-2011|19:59] C:\Program Files\InstallShield Installation Information
    [10-08-2011|16:52] C:\Program Files\Internet Explorer
    [11-09-2011|17:56] C:\Program Files\Java
    [13-09-2011|12:51] C:\Program Files\Malwarebytes' Anti-Malware
    [01-04-2011|16:20] C:\Program Files\Messenger
    [12-04-2011|18:30] C:\Program Files\Microsoft
    [31-03-2011|21:14] C:\Program Files\microsoft frontpage
    [04-04-2011|18:11] C:\Program Files\Microsoft IntelliType Pro
    [24-07-2011|22:15] C:\Program Files\Microsoft Office
    [12-04-2011|18:30] C:\Program Files\Microsoft Office Outlook Connector
    [22-06-2011|10:55] C:\Program Files\Microsoft Silverlight
    [01-04-2011|14:48] C:\Program Files\Microsoft Visual Studio
    [24-07-2011|22:59] C:\Program Files\Microsoft Visual Studio 8
    [04-08-2011|17:55] C:\Program Files\Microsoft Works
    [01-04-2011|14:49] C:\Program Files\Microsoft.NET
    [06-08-2011|18:41] C:\Program Files\Movie Maker
    [24-07-2011|23:04] C:\Program Files\MSBuild
    [31-03-2011|21:00] C:\Program Files\MSN Gaming Zone
    [31-03-2011|21:39] C:\Program Files\MSXML 4.0
    [11-05-2011|20:44] C:\Program Files\Nero
    [01-04-2011|16:16] C:\Program Files\NetMeeting
    [11-09-2011|18:35] C:\Program Files\NVIDIA Corporation
    [31-03-2011|21:12] C:\Program Files\Online Services
    [02-04-2011|15:58] C:\Program Files\Outlook Express
    [05-08-2011|09:04] C:\Program Files\Pando Networks
    [01-07-2011|16:59] C:\Program Files\QuickTime
    [31-03-2011|21:44] C:\Program Files\Realtek
    [02-04-2011|18:28] C:\Program Files\Reference Assemblies
    [04-04-2011|12:57] C:\Program Files\Sitecom
    [01-07-2011|17:00] C:\Program Files\SmartSound Software
    [06-09-2011|17:11] C:\Program Files\Sony Ericsson
    [10-08-2011|14:40] C:\Program Files\SystemRequirementsLab
    [13-09-2011|12:30] C:\Program Files\Trend Micro
    [13-05-2011|09:41] C:\Program Files\Ubisoft
    [31-03-2011|21:25] C:\Program Files\Uninstall Information
    [05-04-2011|22:47] C:\Program Files\uTorrent
    [03-06-2011|08:57] C:\Program Files\uTorrentBar_NL
    [08-04-2011|10:58] C:\Program Files\VideoLAN
    [31-08-2011|21:29] C:\Program Files\VSO
    [06-09-2011|18:15] C:\Program Files\Windows Live
    [12-04-2011|18:25] C:\Program Files\Windows Live SkyDrive
    [06-08-2011|18:02] C:\Program Files\Windows Media Player
    [01-04-2011|16:16] C:\Program Files\Windows NT
    [31-03-2011|21:05] C:\Program Files\Windows Plus
    [11-05-2011|20:42] C:\Program Files\Windows Sidebar
    [31-03-2011|21:12] C:\Program Files\WindowsUpdate
    [13-05-2011|09:35] C:\Program Files\WinRAR
    [31-03-2011|21:14] C:\Program Files\xerox
    [0|bestand(en)] C:\Program Files\bytes
    [63|map(pen)] C:\Program Files\bytes beschikbaar

    ——————–\\ Beschrijving van mappen in C:\Program Files\Common Files

    [06-08-2011|17:37] C:\Program Files\Common Files\Adobe
    [01-04-2011|14:48] C:\Program Files\Common Files\DESIGNER
    [31-03-2011|21:40] C:\Program Files\Common Files\InstallShield
    [11-09-2011|17:56] C:\Program Files\Common Files\Java
    [04-08-2011|17:55] C:\Program Files\Common Files\Microsoft Shared
    [31-03-2011|21:11] C:\Program Files\Common Files\MSSoap
    [11-05-2011|21:13] C:\Program Files\Common Files\Nero
    [31-03-2011|21:58] C:\Program Files\Common Files\ODBC
    [31-03-2011|21:11] C:\Program Files\Common Files\Services
    [04-04-2011|12:56] C:\Program Files\Common Files\Sitecom Shared
    [31-03-2011|21:57] C:\Program Files\Common Files\SpeechEngines
    [12-04-2011|18:30] C:\Program Files\Common Files\System
    [12-04-2011|18:20] C:\Program Files\Common Files\Windows Live
    [0|bestand(en)] C:\Program Files\Common Files\bytes
    [15|map(pen)] C:\Program Files\Common Files\bytes beschikbaar

    ——————–\\ Process

    ( 43 Processes )

    … OK !

    ——————–\\ Zoeken met S_Lop

    Geen Lop mappen gevonden !

    ——————–\\ Zoeken naar Lop Bestanden - Mappen

    Geen Lop mappen gevonden !

    ——————–\\ Zoeken doorheen het Register

    ….. OK !

    ——————–\\ Nazicht van het Hosts bestand

    Hosts bestand IN ORDE


    ——————–\\ Zoeken naar verborgen bestanden met Catchme

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-09-13 13:33:53
    Windows 5.1.2600 Service Pack 3 NTFS
    scanning hidden processes …
    scanning hidden files …
    scan completed successfully
    hidden processes: 0
    hidden files: 0

    ——————–\\ Zoeken naar andere infecties

    ——————–\\ Cracks & Keygens ..

    C:\DOCUME~1\Marc\Application Data\uTorrent\Keygen.exe.torrent
    C:\DOCUME~1\Marc\Application Data\uTorrent\Sony Vegas 8 Pro + Crack-mjn.torrent
    C:\DOCUME~1\Marc\Application Data\uTorrent\Sony Vegas Movie Studio HD Platinum 10.0.179 + Keygen [RH].torrent
    C:\DOCUME~1\Marc\Application Data\uTorrent\Sony Vegas Pro 10 + Keygen.torrent
    C:\DOCUME~1\Marc\Application Data\uTorrent\Sony Vegas PRO 10.0c+Keygen(works with windows7) [ kk ].1.torrent
    C:\DOCUME~1\Marc\Application Data\uTorrent\Sony Vegas PRO 10.0c+Keygen(works with windows7) [ kk ].torrent
    C:\DOCUME~1\Marc\Application Data\uTorrent\Windows Media Player 11 Final + Windows Vaildation Crack.torrent
    C:\DOCUME~1\Marc\Application Data\uTorrent\Windows Media Player 11 Final + WINDOWS VALIDATION CRACK.rar.torrent
    C:\DOCUME~1\Marc\Application Data\uTorrent\[PC GAME MULTI] - Gran Theft Auto San Andreas + Crack NoCD - (Perfect DVD Version) - (Eng-Ita-Deu-Fra-Esp) - (By G-ADLVR_R7.rar.1.torrent
    C:\DOCUME~1\Marc\Application Data\uTorrent\[PC GAME MULTI] - Gran Theft Auto San Andreas + Crack NoCD - (Perfect DVD Version) - (Eng-Ita-Deu-Fra-Esp) - (By G-ADLVR_R7.rar.torrent
    C:\DOCUME~1\Marc\Onlangs geopend\Sony Vegas Movie Studio HD Platinum 10.0.179 + Keygen [RH].lnk
    C:\DOCUME~1\Marc\Onlangs geopend\Sony Vegas PRO 10.0c+Keygen(works with windows7) [ kk ].lnk
    C:\DOCUME~1\Marc\Onlangs geopend\Windows Media Player 11 Final + WINDOWS VALIDATION CRACK.lnk
    C:\DOCUME~1\Marc\Onlangs geopend\[PC GAME MULTI] - Gran Theft Auto San Andreas + Crack NoCD - (Perfect DVD Version) - (Eng-Ita-Deu-Fra-Esp) - (By G-ADLVR_R7.lnk


    [F:461][D:56]-> C:\DOCUME~1\Marc\LOCALS~1\Temp
    [F:7925][D:0]-> C:\DOCUME~1\Marc\Cookies
    [F:7127][D:102]-> C:\DOCUME~1\Marc\LOCALS~1\TEMPOR~1\content.IE5

    1 - "C:\Lop SD\LopR_1.txt" - di 13-09-2011|13:34 - Option : [2]

    ——————–\\ Scan voltooid om 13:34:57
  • Hoi Marc, jij hebt willens en wetens zelf in jouw Windows de doos van Pandorra geopend.

    En dan dit: is jouw XP soms ook niet legitiem?
    [b:9b64d7e63b]Windows Media Player 11 Final + WINDOWS VALIDATION CRACK.lnk[/b:9b64d7e63b]
  • Mijn Windows is netjes aangeschaft en 100% Legitiem.
    Ik heb alleen gedurende een lange tijd geen Windows Updates binnen kunnen krijgen waardoor ik de nieuwe Windows Media Player niet kon downloaden. Iets wat ik nodig had om Sony Vegas te kunnen runnen op mijn PC. Daarom heb ik toendertijd op illegale manier WMP geprobeert te downloaden wat me overigens niet gelukt is ;)
    Ben er toen ook vanaf gestapt en heb het update-probleem verholpen.
    Maar laat het dus even duidelijk zijn: mijn Windows-software is 100% legitiem ;) Ik ga verder met de volgende stappen. Thanks
  • Crack's zitten in het zelfde rijtje als keygens!

    [b:d1421368b2]Sony Vegas 8 Pro +
  • Hieronder het LOG-bestand:

    2011/09/13 14:15:11.0329 3620 TDSS rootkit removing tool 2.5.21.0 Sep 10 2011 21:07:05
    2011/09/13 14:15:11.0766 3620 ================================================================================
    2011/09/13 14:15:11.0766 3620 SystemInfo:
    2011/09/13 14:15:11.0766 3620
    2011/09/13 14:15:11.0766 3620 OS Version: 5.1.2600 ServicePack: 3.0
    2011/09/13 14:15:11.0766 3620 Product type: Workstation
    2011/09/13 14:15:11.0766 3620 ComputerName: 499E59234E7D41F
    2011/09/13 14:15:11.0766 3620 UserName: Marc
    2011/09/13 14:15:11.0766 3620 Windows directory: C:\WINDOWS
    2011/09/13 14:15:11.0766 3620 System windows directory: C:\WINDOWS
    2011/09/13 14:15:11.0766 3620 Processor architecture: Intel x86
    2011/09/13 14:15:11.0766 3620 Number of processors: 2
    2011/09/13 14:15:11.0766 3620 Page size: 0x1000
    2011/09/13 14:15:11.0766 3620 Boot type: Normal boot
    2011/09/13 14:15:11.0766 3620 ================================================================================
    2011/09/13 14:15:12.0985 3620 Initialize success
    2011/09/13 14:15:31.0578 2120 ================================================================================
    2011/09/13 14:15:31.0578 2120 Scan started
    2011/09/13 14:15:31.0578 2120 Mode: Manual;
    2011/09/13 14:15:31.0578 2120 ================================================================================
    2011/09/13 14:15:32.0719 2120 ACPI (02273a448ba21a7d447daeb47810d40c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    2011/09/13 14:15:32.0766 2120 ACPIEC (63f517b1a87dabf3f5acb8a7952fc1d1) C:\WINDOWS\system32\drivers\ACPIEC.sys
    2011/09/13 14:15:32.0828 2120 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
    2011/09/13 14:15:32.0891 2120 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
    2011/09/13 14:15:33.0156 2120 AMON (ad65f551d2edd1cfdea0be8f1084e493) C:\WINDOWS\system32\drivers\amon.sys
    2011/09/13 14:15:33.0281 2120 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
    2011/09/13 14:15:33.0484 2120 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    2011/09/13 14:15:33.0516 2120 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
    2011/09/13 14:15:33.0641 2120 atksgt (f0d933b42cd0594048e4d5200ae9e417) C:\WINDOWS\system32\DRIVERS\atksgt.sys
    2011/09/13 14:15:33.0703 2120 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    2011/09/13 14:15:33.0844 2120 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    2011/09/13 14:15:33.0891 2120 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    2011/09/13 14:15:33.0969 2120 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    2011/09/13 14:15:34.0031 2120 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    2011/09/13 14:15:34.0094 2120 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
    2011/09/13 14:15:34.0203 2120 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    2011/09/13 14:15:34.0453 2120 dc3d (91c1736e77cff029302728b431d0eedb) C:\WINDOWS\system32\DRIVERS\dc3d.sys
    2011/09/13 14:15:34.0516 2120 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
    2011/09/13 14:15:34.0594 2120 dmboot (dec123e0c75971d0cc7a6c6a75e28429) C:\WINDOWS\system32\drivers\dmboot.sys
    2011/09/13 14:15:34.0641 2120 dmio (7268e66259722f6228c730685b201092) C:\WINDOWS\system32\drivers\dmio.sys
    2011/09/13 14:15:34.0688 2120 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    2011/09/13 14:15:34.0750 2120 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
    2011/09/13 14:15:34.0859 2120 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
    2011/09/13 14:15:34.0938 2120 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
    2011/09/13 14:15:34.0984 2120 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
    2011/09/13 14:15:35.0016 2120 Fips (8bfffb5ac954e19dfdb96d56512aa518) C:\WINDOWS\system32\drivers\Fips.sys
    2011/09/13 14:15:35.0047 2120 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
    2011/09/13 14:15:35.0109 2120 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
    2011/09/13 14:15:35.0156 2120 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    2011/09/13 14:15:35.0281 2120 Ftdisk (fa8ca22e70245c81ff29c36af56292fc) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    2011/09/13 14:15:35.0344 2120 ggflt (007aea2e06e7cef7372e40c277163959) C:\WINDOWS\system32\DRIVERS\ggflt.sys
    2011/09/13 14:15:35.0391 2120 ggsemc (c73de35960ca75c5ab4ae636b127c64e) C:\WINDOWS\system32\DRIVERS\ggsemc.sys
    2011/09/13 14:15:35.0453 2120 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    2011/09/13 14:15:35.0547 2120 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
    2011/09/13 14:15:35.0625 2120 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
    2011/09/13 14:15:35.0734 2120 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
    2011/09/13 14:15:35.0906 2120 i8042prt (c43372d0682f8e32e4ec21117e089ec0) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    2011/09/13 14:15:35.0969 2120 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
    2011/09/13 14:15:36.0203 2120 IntcAzAudAddService (27b220620a480e54bf57e4750ca9b65f) C:\WINDOWS\system32\drivers\RtkHDAud.sys
    2011/09/13 14:15:36.0422 2120 intelppm (2d2254fac267e6b1c7865e8ebef60c6d) C:\WINDOWS\system32\DRIVERS\intelppm.sys
    2011/09/13 14:15:36.0453 2120 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
    2011/09/13 14:15:36.0500 2120 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    2011/09/13 14:15:36.0547 2120 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    2011/09/13 14:15:36.0578 2120 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    2011/09/13 14:15:36.0609 2120 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    2011/09/13 14:15:36.0719 2120 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
    2011/09/13 14:15:36.0781 2120 isapnp (0b78e1a31340e1fb1e389d5633f7c3a0) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    2011/09/13 14:15:36.0844 2120 Kbdclass (380397621e94b32c744e7b2cc1330390) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    2011/09/13 14:15:36.0891 2120 kbdhid (b833b70fe639f01fb36cedabe57ef031) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
    2011/09/13 14:15:36.0953 2120 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
    2011/09/13 14:15:37.0078 2120 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
    2011/09/13 14:15:37.0188 2120 lirsgt (f8a7212d0864ef5e9185fb95e6623f4d) C:\WINDOWS\system32\DRIVERS\lirsgt.sys
    2011/09/13 14:15:37.0281 2120 MHNDRV (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys
    2011/09/13 14:15:37.0328 2120 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    2011/09/13 14:15:37.0469 2120 Modem (8114eeac353f549331ab73e9af4219ed) C:\WINDOWS\system32\drivers\Modem.sys
    2011/09/13 14:15:37.0500 2120 Mouclass (1a4e2214dd63e4a876463d3427ee8261) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    2011/09/13 14:15:37.0578 2120 mouhid (18017899254e01371e1a39754d6bf98c) C:\WINDOWS\system32\DRIVERS\mouhid.sys
    2011/09/13 14:15:37.0641 2120 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
    2011/09/13 14:15:37.0703 2120 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    2011/09/13 14:15:37.0781 2120 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    2011/09/13 14:15:37.0875 2120 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
    2011/09/13 14:15:37.0938 2120 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    2011/09/13 14:15:37.0984 2120 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    2011/09/13 14:15:38.0016 2120 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
    2011/09/13 14:15:38.0078 2120 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    2011/09/13 14:15:38.0156 2120 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
    2011/09/13 14:15:38.0219 2120 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
    2011/09/13 14:15:38.0328 2120 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    2011/09/13 14:15:38.0375 2120 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    2011/09/13 14:15:38.0469 2120 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    2011/09/13 14:15:38.0516 2120 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
    2011/09/13 14:15:38.0594 2120 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
    2011/09/13 14:15:38.0641 2120 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
    2011/09/13 14:15:38.0703 2120 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
    2011/09/13 14:15:38.0734 2120 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
    2011/09/13 14:15:38.0781 2120 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
    2011/09/13 14:15:38.0875 2120 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    2011/09/13 14:15:39.0438 2120 nv (6733e80a193fc36f41c24142b0c45c0e) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
    2011/09/13 14:15:39.0953 2120 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    2011/09/13 14:15:39.0984 2120 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    2011/09/13 14:15:40.0047 2120 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
    2011/09/13 14:15:40.0109 2120 Parport (e3934ccc20a4d24f1924e13d36d2a5bd) C:\WINDOWS\system32\DRIVERS\parport.sys
    2011/09/13 14:15:40.0141 2120 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
    2011/09/13 14:15:40.0188 2120 ParVdm (1eade28746a64c21e0a808bb12a63326) C:\WINDOWS\system32\drivers\ParVdm.sys
    2011/09/13 14:15:40.0328 2120 PCI (3b166f9f753c21aedaa9a6bd76b49655) C:\WINDOWS\system32\DRIVERS\pci.sys
    2011/09/13 14:15:40.0422 2120 PCIIde (b31edeba4da28283f6b8dc4756fb9585) C:\WINDOWS\system32\DRIVERS\pciide.sys
    2011/09/13 14:15:40.0453 2120 Pcmcia (2137ffd65f8e609a3a5acd487c56cce0) C:\WINDOWS\system32\drivers\Pcmcia.sys
    2011/09/13 14:15:40.0719 2120 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    2011/09/13 14:15:40.0781 2120 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
    2011/09/13 14:15:40.0828 2120 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    2011/09/13 14:15:40.0875 2120 PxHelp20 (40f2031bd9148d3194353ea7dec97a07) C:\WINDOWS\system32\Drivers\PxHelp20.sys
    2011/09/13 14:15:41.0109 2120 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    2011/09/13 14:15:41.0156 2120 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    2011/09/13 14:15:41.0187 2120 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    2011/09/13 14:15:41.0219 2120 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    2011/09/13 14:15:41.0281 2120 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    2011/09/13 14:15:41.0375 2120 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2011/09/13 14:15:41.0422 2120 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    2011/09/13 14:15:41.0500 2120 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
    2011/09/13 14:15:41.0672 2120 redbook (4173bc66e485fd77a03c4819f60bd0da) C:\WINDOWS\system32\DRIVERS\redbook.sys
    2011/09/13 14:15:41.0766 2120 RTL8023xp (760647db46457673f21b0c0b1ec78d02) C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys
    2011/09/13 14:15:41.0812 2120 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
    2011/09/13 14:15:41.0906 2120 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    2011/09/13 14:15:42.0016 2120 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
    2011/09/13 14:15:42.0078 2120 Serial (92c21762653bb2ce51147eb8a9aa654f) C:\WINDOWS\system32\DRIVERS\serial.sys
    2011/09/13 14:15:42.0156 2120 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
    2011/09/13 14:15:42.0281 2120 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
    2011/09/13 14:15:42.0328 2120 sr (64d2a7640e0767ecd3bcb38d3200e7ce) C:\WINDOWS\system32\DRIVERS\sr.sys
    2011/09/13 14:15:42.0375 2120 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
    2011/09/13 14:15:42.0469 2120 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
    2011/09/13 14:15:42.0516 2120 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
    2011/09/13 14:15:42.0687 2120 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
    2011/09/13 14:15:42.0766 2120 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    2011/09/13 14:15:42.0812 2120 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
    2011/09/13 14:15:42.0891 2120 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
    2011/09/13 14:15:42.0969 2120 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
    2011/09/13 14:15:43.0078 2120 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
    2011/09/13 14:15:43.0172 2120 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
    2011/09/13 14:15:43.0266 2120 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    2011/09/13 14:15:43.0344 2120 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    2011/09/13 14:15:43.0406 2120 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    2011/09/13 14:15:43.0469 2120 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
    2011/09/13 14:15:43.0531 2120 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    2011/09/13 14:15:43.0578 2120 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    2011/09/13 14:15:43.0656 2120 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
    2011/09/13 14:15:43.0766 2120 VolSnap (8ab662b3c4691e6ddf61c96bb5b7d103) C:\WINDOWS\system32\drivers\VolSnap.sys
    2011/09/13 14:15:43.0859 2120 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    2011/09/13 14:15:43.0922 2120 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
    2011/09/13 14:15:44.0047 2120 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
    2011/09/13 14:15:44.0172 2120 WinUSB (fd600b032e741eb6aab509fc630f7c42) C:\WINDOWS\system32\DRIVERS\WinUSB.sys
    2011/09/13 14:15:44.0250 2120 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
    2011/09/13 14:15:44.0328 2120 MBR (0x1B8) (3051207086651214e435112e51817dc5) \Device\Harddisk0\DR0
    2011/09/13 14:15:44.0469 2120 Boot (0x1200) (6dff289cb5eab816a84eb705cf95c600) \Device\Harddisk0\DR0\Partition0
    2011/09/13 14:15:44.0484 2120 ================================================================================
    2011/09/13 14:15:44.0484 2120 Scan finished
    2011/09/13 14:15:44.0484 2120 ================================================================================
    2011/09/13 14:15:44.0500 2220 Detected object count: 0
    2011/09/13 14:15:44.0500 2220 Actual detected object count: 0
  • [quote:acf144043c="Abraham54"]Crack's zitten in het zelfde rijtje als keygens!

    [b:acf144043c]Sony Vegas 8 Pro +
  • aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
    Run date: 2011-09-13 14:19:21
    —————————–
    14:19:21.513 OS Version: Windows 5.1.2600 Service Pack 3
    14:19:21.513 Number of processors: 2 586 0x407
    14:19:21.513 ComputerName: 499E59234E7D41F UserName: Marc
    14:19:22.669 Initialize success
    14:19:50.325 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-7
    14:19:50.341 Disk 0 Vendor: HDT722516DLA380 V43OA96A Size: 157066MB BusType: 3
    14:19:52.341 Disk 0 MBR read successfully
    14:19:52.341 Disk 0 MBR scan
    14:19:52.341 Disk 0 Windows XP default MBR code
    14:19:52.341 Disk 0 scanning sectors +321653430
    14:19:52.403 Disk 0 scanning C:\WINDOWS\system32\drivers
    14:19:58.606 Service scanning
    14:20:00.169 Service PciCon D:\PciCon.sys **LOCKED** 21
    14:20:00.731 Modules scanning
    14:20:06.418 Disk 0 trace - called modules:
    14:20:06.434 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
    14:20:06.434 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x898bbab8]
    14:20:06.434 3 CLASSPNP.SYS[b8108fd7] -> nt!IofCallDriver -> \Device\00000062[0x898b09e8]
    14:20:06.778 5 ACPI.sys[b7f7e620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-7[0x898b0d98]
    14:20:06.778 Scan finished successfully
    14:20:28.137 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Marc\Bureaublad\MBR.dat"
    14:20:28.168 The log file has been saved successfully to "C:\Documents and Settings\Marc\Bureaublad\aswMBR.txt"
  • Maar ff voor de zekerheid: Mijn Windows is legitiem :) Dat soort belangrijke stuurprogramma's zou ik nooit illegaal runnen.
  • Hoi Marc, ik stel mij op het standpunt dat indien de school van jou eist dat je die en die software moet gebruiken voor een eenmalige opdracht, dat jij dan op je achterste benen gaat staan en eist dat je die software dan via je school krijgt omdat je anders het vertikt op legale dan wel illegale wijze de opdracht uit te voeren!

    En nog wat: dit is een forum,
    heb je weer zo'n soort opdracht uit te voeren, maak daar dan een topic over aan in het juiste forumdeel.
    Gegarandeerd dat je op de juiste weg wordt geholpen.
    Want ongetwijfeld is er gratis software die hetzelfde kan.

    TDSSKiller en aswMBR, de bijbehorende logs en back-ups - benevens C:\TDSSKiller mag je handmatig verwijderen naar de prullenbak.
    De MBR van jouw HD is gezond!


    Volgende opdracht:

    [b:e6d12d2777]Welk programma[/b:e6d12d2777]: ComboFix
    [b:e6d12d2777]Waarvoor/waarom[/b:e6d12d2777]: Zeer specialistische scanner om Windows diepgaand te onderzoeken
    en zo mogelijk op te schonen.
    [b:e6d12d2777]Moeilijkheidsgraad[/b:e6d12d2777]: Min of meer lastige voorbereidingsfase, dus lees alles eerst goed.
    [b:e6d12d2777]Downloadlokatie[/b:e6d12d2777]: Dit programma absoluut naar het bureaublad downloaden!
    [b:e6d12d2777]Download ComboFix via één van deze locaties[/b:e6d12d2777]:
    [list:e6d12d2777][*:e6d12d2777][b:e6d12d2777]Bleepingcomputer[/b:e6d12d2777]
    [*:e6d12d2777][b:e6d12d2777]ForoSpyware[/b:e6d12d2777]
    [*:e6d12d2777][b:e6d12d2777]Geekstogo[/b:e6d12d2777][/list:u:e6d12d2777]
    [b:e6d12d2777]Hier[/b:e6d12d2777] zie je hoe je ComboFix moet gebruiken.

    Antivirusprogramma en actieve malwarescanners dienen al voor de ComboFix start gedeaktiveert zijn!
    [b:e6d12d2777]Hier[/b:e6d12d2777] en [b:e6d12d2777]hier[/b:e6d12d2777] vindt je gegevens hoe antivirusprogramma's en spywarescanners te deaktiveren.

    [b:e6d12d2777]Voor alle duidelijkheid nogmaals[/b:e6d12d2777]: ComboFix dient vanaf het bureaublad gestart te worden.

    [b:e6d12d2777]Opmerkingen[/b:e6d12d2777]:
    [list:e6d12d2777][*:e6d12d2777] Bij gebruik van Windows XP zal er mogelijk gevraagd worden, om de "Recovery Console" te installeren! Sta dit dan toe (hiervoor is een actieve internet verbinding vereist).
    [*:e6d12d2777]Vista- en Windows 7 gebruikers starten Combofix op via rechtsklik met Administratorrechten.
    [*:e6d12d2777]Alle openstaande programma's en webpagina's dienen afgesloten te zijn.[/list:u:e6d12d2777]
    [b:e6d12d2777]ComboFix is opgestart[/b:e6d12d2777]:
    [list:e6d12d2777][*:e6d12d2777]Niet in het zwarte venster klikken, hierdoor kan ComboFix of zelfs Windows geheel "bevriezen"!
    [*:e6d12d2777]Combofix sluit tijdens de scan de internet verbinding – probeer deze tussentijds niet te herstellen!
    [*:e6d12d2777]Het kan voorkomen dat de computer meerdere malen opnieuw opgestart moet worden, dit is normaal.
    [*:e6d12d2777]Wanneer ComboFix gereed is, zal het het een logbestand voor je maken.
    [*:e6d12d2777]Post de inhoud van dit logbestand in je volgende bericht.
    [*:e6d12d2777]Indien het log niet opstart, is dit terug tevinden in C:\ComboFix.txt[/list:u:e6d12d2777]
    [b:e6d12d2777]Belangrijke opmerking[/b:e6d12d2777]:
    [list:e6d12d2777][*:e6d12d2777][b:e6d12d2777]
  • Heb helaas NOD32 van Eset moeten verwijderen omdat mijn NOD32 ondanks alle stappen uit te voeren nog steeds actief scheen te zijn. Geen probleem ik installeer 'm opnieuw ;)
    Nog bedankt voor de aardige reactie over de software voor school.
    Zal zéker vaker gebruik maken van dit onwijs goede forum.

    Zie hieronder het log:

    ComboFix 11-09-13.01 - Marc 13-09-2011 15:37:40.1.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.1278.818 [GMT 2:00]
    Gestart vanuit: c:\documents and settings\Marc\Bureaublad\ComboFix.exe
    .
    .
    (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\Marc\Application Data\PriceGong
    c:\documents and settings\Marc\Application Data\PriceGong\Data\1.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\a.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\b.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\c.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\d.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\e.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\f.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\g.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\h.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\i.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\J.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\k.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\l.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\m.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\mru.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\n.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\o.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\p.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\q.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\r.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\s.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\t.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\u.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\v.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\w.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\x.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\y.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\z.xml
    c:\documents and settings\Marc\Local Settings\Application Data\ApplicationHistory
    c:\documents and settings\Marc\Local Settings\Application Data\ApplicationHistory\Comrade.exe.bacfe152.ini
    c:\documents and settings\Marc\Local Settings\Application Data\ApplicationHistory\csc.exe.3e4ac0af.ini
    c:\documents and settings\Marc\Local Settings\Application Data\ApplicationHistory\ehshell.exe.a87fcbb.ini
    c:\documents and settings\Marc\Local Settings\Application Data\ApplicationHistory\MCInstaller.exe.58374a5f.ini
    c:\documents and settings\Marc\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
    c:\documents and settings\Marc\Local Settings\Application Data\ApplicationHistory\SL252.tmp.fb7aca10.ini
    c:\windows\system32\d3d9caps.dat
    .
    .
    (((((((((((((((((((( Bestanden Gemaakt van 2011-08-13 to 2011-09-13 ))))))))))))))))))))))))))))))
    .
    .
    2011-09-13 11:30 . 2011-09-13 11:34 ——– d—–w- C:\Lop SD
    2011-09-13 10:50 . 2011-09-13 10:50 ——– d—–w- c:\documents and settings\Marc\Application Data\Malwarebytes
    2011-09-13 10:50 . 2011-09-13 10:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-09-13 10:50 . 2011-09-13 10:51 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
    2011-09-13 10:50 . 2011-08-31 15:00 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
    2011-09-13 10:30 . 2011-09-13 10:30 388096 —-a-r- c:\documents and settings\Marc\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-09-13 10:30 . 2011-09-13 10:30 ——– d—–w- c:\program files\Trend Micro
    2011-09-12 14:35 . 2011-09-12 14:35 ——– d—–w- c:\documents and settings\Marc\Application Data\NVIDIA
    2011-09-11 16:35 . 2011-09-11 16:35 ——– d—–w- c:\documents and settings\UpdatusUser
    2011-09-11 16:33 . 2011-09-11 16:33 ——– d—–w- C:\NVIDIA
    2011-09-11 15:56 . 2011-09-11 15:56 ——– d—–w- c:\program files\Common Files\Java
    2011-09-08 15:10 . 2011-09-08 15:10 ——– d—–w- c:\documents and settings\Marc\Local Settings\Application Data\GameSpy
    2011-09-08 09:19 . 2011-09-08 09:19 ——– d–h–r- c:\documents and settings\Marc\Application Data\SecuROM
    2011-09-08 09:19 . 2011-09-08 09:19 107888 —-a-w- c:\windows\system32\CmdLineExt.dll
    2011-09-08 09:14 . 2011-09-08 09:14 ——– d—–w- c:\program files\GameSpy
    2011-09-08 09:13 . 2011-09-08 09:13 ——– d—–w- c:\windows\system32\URTTEMP
    2011-09-08 09:11 . 2011-09-08 09:11 669184 —-a-w- c:\windows\system32\pbsvc.exe
    2011-09-08 08:57 . 2011-09-08 08:57 ——– d—–w- c:\program files\Electronic Arts
    2011-09-06 15:12 . 2011-09-06 15:12 25512 —-a-w- c:\windows\system32\drivers\ggsemc.sys
    2011-09-06 15:12 . 2011-09-06 15:12 13224 —-a-w- c:\windows\system32\drivers\ggflt.sys
    2011-09-05 18:01 . 2009-09-03 02:34 581192 —-a-w- c:\windows\system32\WinUSBCoInstaller.dll
    2011-09-05 18:01 . 2009-09-03 02:34 1112288 —-a-w- c:\windows\system32\WdfCoInstaller01007.dll
    2011-09-05 17:59 . 2011-09-06 15:11 ——– d—–w- c:\program files\Sony Ericsson
    2011-09-05 17:59 . 2011-09-05 18:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Sony Ericsson
    2011-08-31 22:38 . 2011-08-31 22:38 ——– d—–w- c:\documents and settings\All Users\Application Data\vsosdk
    2011-08-31 19:29 . 2011-08-31 19:29 ——– d—–w- c:\documents and settings\Marc\Application Data\Vso
    2011-08-31 19:29 . 2009-09-02 10:44 65602 —-a-w- c:\windows\system32\cook3260.dll
    2011-08-31 19:29 . 2009-09-02 10:44 626688 —-a-w- c:\windows\system32\vp7vfw.dll
    2011-08-31 19:29 . 2009-09-02 10:44 217127 —-a-w- c:\windows\system32\drv43260.dll
    2011-08-31 19:29 . 2009-09-02 10:44 208935 —-a-w- c:\windows\system32\drv33260.dll
    2011-08-31 19:29 . 2009-09-02 10:44 176165 —-a-w- c:\windows\system32\drv23260.dll
    2011-08-31 19:29 . 2009-09-02 10:44 1184984 —-a-w- c:\windows\system32\wvc1dmod.dll
    2011-08-31 19:29 . 2009-09-02 10:44 102439 —-a-w- c:\windows\system32\sipr3260.dll
    2011-08-31 19:28 . 2011-08-31 19:29 ——– d—–w- c:\program files\VSO
    .
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-09-08 09:11 . 2011-05-26 21:54 22328 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
    2011-09-08 09:11 . 2011-05-26 21:53 22328 -c–a-w- c:\documents and settings\Marc\Application Data\PnkBstrK.sys
    2011-09-08 09:11 . 2011-05-26 21:53 103736 —-a-w- c:\windows\system32\PnkBstrB.exe
    2011-09-08 09:11 . 2011-05-26 21:53 103736 —-a-w- c:\windows\system32\PnkBstrB.ex0
    2011-08-03 11:49 . 2007-12-19 11:40 16191488 —-a-w- c:\windows\system32\nvoglnt.dll
    2011-08-03 11:49 . 2007-12-07 05:51 5427200 —-a-w- c:\windows\system32\nvcuda.dll
    2011-08-03 11:49 . 2007-12-07 05:51 54272 —-a-w- c:\windows\system32\nvwddi.dll
    2011-08-03 11:49 . 2007-12-07 05:51 4210816 —-a-w- c:\windows\system32\nv4_disp.dll
    2011-08-03 11:49 . 2007-12-07 05:51 2404864 —-a-w- c:\windows\system32\nvapi.dll
    2011-08-03 11:49 . 2007-12-07 05:51 146024 —-a-w- c:\windows\system32\nvsvc32.exe
    2011-08-03 11:49 . 2007-12-07 05:51 145000 -c–a-w- c:\windows\system32\nvcolor.exe
    2011-08-03 11:49 . 2007-12-07 05:51 13892200 —-a-w- c:\windows\system32\nvcpl.dll
    2011-08-03 11:49 . 2007-12-07 05:51 12542592 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
    2011-08-03 11:49 . 2007-12-07 05:51 111208 —-a-w- c:\windows\system32\nvmctray.dll
    2011-07-19 03:05 . 2011-05-30 15:16 472808 —-a-w- c:\windows\system32\deployJava1.dll
    2011-07-19 00:40 . 2011-05-30 15:16 73728 —-a-w- c:\windows\system32\javacpl.cpl
    2011-07-15 13:29 . 2004-09-02 12:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-07-08 14:02 . 2004-09-02 12:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
    2011-06-24 14:10 . 2011-03-31 19:00 139656 —-a-w- c:\windows\system32\drivers\rdpwd.sys
    2011-06-23 18:31 . 2004-09-02 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
    2011-06-23 18:31 . 2004-09-02 12:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
    2011-06-23 18:31 . 2004-09-02 12:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
    2011-06-23 12:05 . 2004-09-02 12:00 385024 —-a-w- c:\windows\system32\html.iec
    2011-06-20 17:44 . 2004-09-02 12:00 293888 —-a-w- c:\windows\system32\winsrv.dll
    .
    .
    ——- Sigcheck ——-
    Note: Unsigned files aren't necessarily malware.
    .
    [-] 2004-09-02 12:00 . 61A79E8D4A440095EA2EB9FD694CD1AE . 25600 . . [10.0.3790.3646] . . c:\windows\system32\mspmsnsv.dll
    [-] 2004-09-02 12:00 . 61A79E8D4A440095EA2EB9FD694CD1AE . 25600 . . [10.0.3790.3646] . . c:\windows\system32\dllcache\mspmsnsv.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{87775fdb-6972-41f9-ae51-8326e38cb206}"= "c:\program files\uTorrentBar_NL\prxtbuTo0.dll" [2011-03-28 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{87775fdb-6972-41f9-ae51-8326e38cb206}]
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
    2011-03-28 16:22 176936 —-a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{87775fdb-6972-41f9-ae51-8326e38cb206}]
    2011-03-28 16:22 176936 —-a-w- c:\program files\uTorrentBar_NL\prxtbuTo0.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{87775fdb-6972-41f9-ae51-8326e38cb206}"= "c:\program files\uTorrentBar_NL\prxtbuTo0.dll" [2011-03-28 176936]
    "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-03-28 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{87775fdb-6972-41f9-ae51-8326e38cb206}]
    .
    [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{87775FDB-6972-41F9-AE51-8326E38CB206}"= "c:\program files\uTorrentBar_NL\prxtbuTo0.dll" [2011-03-28 176936]
    "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-03-28 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{87775fdb-6972-41f9-ae51-8326e38cb206}]
    .
    [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PnPUI Registrator"="c:\program files\Common Files\Sitecom Shared\PnP Universal Installer\PnPUIReg.exe" [2004-11-22 163840]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
    "Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-08-05 3077528]
    "Sony Ericsson PC Companion"="c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" [2011-07-25 433360]
    "Comrade.exe"="c:\program files\GameSpy\Comrade\Comrade.exe" [2007-06-29 36864]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
    "RTHDCPL"="RTHDCPL.EXE" [2005-10-15 14864384]
    "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2010-07-21 1778064]
    "UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-06 222504]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-08-03 13892200]
    "NvMediaCenter"="NvMCTray.dll" [2011-08-03 111208]
    "nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-07-05 1632360]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    2008-04-14 17:03 1695232 ——w- c:\program files\Messenger\msmsgs.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\system32\\mmc.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
    "c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "56074:TCP"= 56074:TCP:Pando Media Booster
    "56074:UDP"= 56074:UDP:Pando Media Booster
    .
    R2 DevNotifySvc;DevNotifySvc;c:\program files\Common Files\Sitecom Shared\PnP Universal Installer\DevNotifySvc.exe [4-4-2011 12:57 32768]
    R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [11-9-2011 18:35 2255464]
    R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\drivers\dc3d.sys [4-4-2011 18:11 44432]
    S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [6-9-2011 17:12 13224]
    S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?]
    S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [5-9-2011 19:59 155344]
    .
    .
    ——- Bijkomende Scan ——-
    .
    uStart Page = hxxp://www.facebook.com/?ref=hp
    IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
    TCP: DhcpNameServer = 212.54.40.25 212.54.35.25
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-09-13 15:44
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scannen van verborgen processen …
    .
    scannen van verborgen autostart items …
    .
    scannen van verborgen bestanden …
    .
    Scan succesvol afgerond
    verborgen bestanden: 0
    .
    **************************************************************************
    .
    ——————— VERGRENDELDE REGISTER SLEUTELS ———————
    .
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•¤|ÿÿÿÿ"•¤|þ»Ñw*]
    "31403E1900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
    .
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\¤–}|ÿÿÿÿÀ•}|ù•9~*]
    "31403E1900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
    .
    Voltooingstijd: 2011-09-13 15:46:31
    ComboFix-quarantined-files.txt 2011-09-13 13:46
    .
    Pre-Run: 84.478.476.288 bytes beschikbaar
    Post-Run: 85.238.284.288 bytes beschikbaar
    .
    WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
    .
    - - End Of File - - F02D72BD054DB2BF2F88E8151EE3E30F
  • Hoi Marc, je mag nu het volgende doen:

    open een nieuw kladblok bestand, via "Start\Alle programma’s\Bureau-accessoires\[b:999f8665c7]Kladblok[/b:999f8665c7]".


    Kopieer en plak de volgende (vetgedrukte, blauwe tekst) in het lege kladblokvenstervenster


    [b:999f8665c7]
  • Bovenstaande opmerking van Abraham inzake illegale software geldt ook voor spellen!
    Begrijp goed dat je hiermee de problemen zelf binnen haalt.
    Laten deze problemen een wijze les zijn en blijf weg van illegale software (en dus ook illegaal gedownloadde games).
  • ComboFix 11-09-13.02 - Marc 13-09-2011 16:45:37.2.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.1278.758 [GMT 2:00]
    Gestart vanuit: c:\documents and settings\Marc\Bureaublad\ComboFix.exe
    gebruikte Opdracht switches :: c:\documents and settings\Marc\Bureaublad\CFScript.txt
    .
    .
    (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\Marc\Application Data\PriceGong
    c:\documents and settings\Marc\Application Data\PriceGong\Data\1.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\a.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\b.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\c.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\d.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\e.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\f.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\g.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\h.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\i.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\j.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\k.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\l.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\m.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\mru.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\n.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\o.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\p.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\q.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\r.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\s.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\t.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\u.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\v.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\w.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\x.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\y.xml
    c:\documents and settings\Marc\Application Data\PriceGong\Data\z.xml
    c:\program files\ConduitEngine
    c:\program files\ConduitEngine\appContextMenu.xml
    c:\program files\ConduitEngine\ConduitEngine.dll
    c:\program files\ConduitEngine\ConduitEngineHelper.exe
    c:\program files\ConduitEngine\ConduitEngineUninstall.exe
    c:\program files\ConduitEngine\engineContextMenu.xml
    c:\program files\ConduitEngine\EngineSettings.json
    c:\program files\ConduitEngine\INSTALL.LOG
    c:\program files\ConduitEngine\ldrConduitEngine.dll
    c:\program files\ConduitEngine\prxConduitEngine.dll
    c:\program files\ConduitEngine\toolbar.cfg
    c:\program files\uTorrentBar_NL
    c:\program files\uTorrentBar_NL\GottenAppsContextMenu.xml
    c:\program files\uTorrentBar_NL\INSTALL.LOG
    c:\program files\uTorrentBar_NL\ldrtbuTo0.dll
    c:\program files\uTorrentBar_NL\OtherAppsContextMenu.xml
    c:\program files\uTorrentBar_NL\prxtbuTo0.dll
    c:\program files\uTorrentBar_NL\SharedAppsContextMenu.xml
    c:\program files\uTorrentBar_NL\tbuTo0.dll
    c:\program files\uTorrentBar_NL\tbuTo1.dll
    c:\program files\uTorrentBar_NL\tbuTor.dll
    c:\program files\uTorrentBar_NL\toolbar.cfg
    c:\program files\uTorrentBar_NL\ToolbarContextMenu.xml
    c:\program files\uTorrentBar_NL\uninstall.exe
    c:\program files\uTorrentBar_NL\UNWISE.EXE
    c:\program files\uTorrentBar_NL\uTorrentBar_NLToolbarHelper.exe
    c:\program files\uTorrentBar_NL\uTorrentBar_NLToolbarHelper1.exe
    .
    .
    (((((((((((((((((((( Bestanden Gemaakt van 2011-08-13 to 2011-09-13 ))))))))))))))))))))))))))))))
    .
    .
    2011-09-13 11:30 . 2011-09-13 11:34 ——– d—–w- C:\Lop SD
    2011-09-13 10:50 . 2011-09-13 10:50 ——– d—–w- c:\documents and settings\Marc\Application Data\Malwarebytes
    2011-09-13 10:50 . 2011-09-13 10:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-09-13 10:50 . 2011-09-13 10:51 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
    2011-09-13 10:50 . 2011-08-31 15:00 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
    2011-09-13 10:30 . 2011-09-13 10:30 388096 —-a-r- c:\documents and settings\Marc\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-09-13 10:30 . 2011-09-13 10:30 ——– d—–w- c:\program files\Trend Micro
    2011-09-12 14:35 . 2011-09-12 14:35 ——– d—–w- c:\documents and settings\Marc\Application Data\NVIDIA
    2011-09-11 16:35 . 2011-09-11 16:35 ——– d—–w- c:\documents and settings\UpdatusUser
    2011-09-11 16:33 . 2011-09-11 16:33 ——– d—–w- C:\NVIDIA
    2011-09-11 15:56 . 2011-09-11 15:56 ——– d—–w- c:\program files\Common Files\Java
    2011-09-08 15:10 . 2011-09-08 15:10 ——– d—–w- c:\documents and settings\Marc\Local Settings\Application Data\GameSpy
    2011-09-08 09:19 . 2011-09-08 09:19 ——– d–h–r- c:\documents and settings\Marc\Application Data\SecuROM
    2011-09-08 09:19 . 2011-09-08 09:19 107888 —-a-w- c:\windows\system32\CmdLineExt.dll
    2011-09-08 09:14 . 2011-09-08 09:14 ——– d—–w- c:\program files\GameSpy
    2011-09-08 09:13 . 2011-09-08 09:13 ——– d—–w- c:\windows\system32\URTTEMP
    2011-09-08 09:11 . 2011-09-08 09:11 669184 —-a-w- c:\windows\system32\pbsvc.exe
    2011-09-08 08:57 . 2011-09-08 08:57 ——– d—–w- c:\program files\Electronic Arts
    2011-09-06 15:12 . 2011-09-06 15:12 25512 —-a-w- c:\windows\system32\drivers\ggsemc.sys
    2011-09-06 15:12 . 2011-09-06 15:12 13224 —-a-w- c:\windows\system32\drivers\ggflt.sys
    2011-09-05 18:01 . 2009-09-03 02:34 581192 —-a-w- c:\windows\system32\WinUSBCoInstaller.dll
    2011-09-05 18:01 . 2009-09-03 02:34 1112288 —-a-w- c:\windows\system32\WdfCoInstaller01007.dll
    2011-09-05 17:59 . 2011-09-06 15:11 ——– d—–w- c:\program files\Sony Ericsson
    2011-09-05 17:59 . 2011-09-05 18:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Sony Ericsson
    2011-08-31 22:38 . 2011-08-31 22:38 ——– d—–w- c:\documents and settings\All Users\Application Data\vsosdk
    2011-08-31 19:29 . 2011-08-31 19:29 ——– d—–w- c:\documents and settings\Marc\Application Data\Vso
    2011-08-31 19:29 . 2009-09-02 10:44 65602 —-a-w- c:\windows\system32\cook3260.dll
    2011-08-31 19:29 . 2009-09-02 10:44 626688 —-a-w- c:\windows\system32\vp7vfw.dll
    2011-08-31 19:29 . 2009-09-02 10:44 217127 —-a-w- c:\windows\system32\drv43260.dll
    2011-08-31 19:29 . 2009-09-02 10:44 208935 —-a-w- c:\windows\system32\drv33260.dll
    2011-08-31 19:29 . 2009-09-02 10:44 176165 —-a-w- c:\windows\system32\drv23260.dll
    2011-08-31 19:29 . 2009-09-02 10:44 1184984 —-a-w- c:\windows\system32\wvc1dmod.dll
    2011-08-31 19:29 . 2009-09-02 10:44 102439 —-a-w- c:\windows\system32\sipr3260.dll
    2011-08-31 19:28 . 2011-08-31 19:29 ——– d—–w- c:\program files\VSO
    .
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-09-08 09:11 . 2011-05-26 21:54 22328 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
    2011-09-08 09:11 . 2011-05-26 21:53 22328 -c–a-w- c:\documents and settings\Marc\Application Data\PnkBstrK.sys
    2011-09-08 09:11 . 2011-05-26 21:53 103736 —-a-w- c:\windows\system32\PnkBstrB.exe
    2011-09-08 09:11 . 2011-05-26 21:53 103736 —-a-w- c:\windows\system32\PnkBstrB.ex0
    2011-08-03 11:49 . 2007-12-19 11:40 16191488 —-a-w- c:\windows\system32\nvoglnt.dll
    2011-08-03 11:49 . 2007-12-07 05:51 5427200 —-a-w- c:\windows\system32\nvcuda.dll
    2011-08-03 11:49 . 2007-12-07 05:51 54272 —-a-w- c:\windows\system32\nvwddi.dll
    2011-08-03 11:49 . 2007-12-07 05:51 4210816 —-a-w- c:\windows\system32\nv4_disp.dll
    2011-08-03 11:49 . 2007-12-07 05:51 2404864 —-a-w- c:\windows\system32\nvapi.dll
    2011-08-03 11:49 . 2007-12-07 05:51 146024 —-a-w- c:\windows\system32\nvsvc32.exe
    2011-08-03 11:49 . 2007-12-07 05:51 145000 -c–a-w- c:\windows\system32\nvcolor.exe
    2011-08-03 11:49 . 2007-12-07 05:51 13892200 —-a-w- c:\windows\system32\nvcpl.dll
    2011-08-03 11:49 . 2007-12-07 05:51 12542592 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
    2011-08-03 11:49 . 2007-12-07 05:51 111208 —-a-w- c:\windows\system32\nvmctray.dll
    2011-07-19 03:05 . 2011-05-30 15:16 472808 —-a-w- c:\windows\system32\deployJava1.dll
    2011-07-19 00:40 . 2011-05-30 15:16 73728 —-a-w- c:\windows\system32\javacpl.cpl
    2011-07-15 13:29 . 2004-09-02 12:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-07-08 14:02 . 2004-09-02 12:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
    2011-06-24 14:10 . 2011-03-31 19:00 139656 —-a-w- c:\windows\system32\drivers\rdpwd.sys
    2011-06-23 18:31 . 2004-09-02 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
    2011-06-23 18:31 . 2004-09-02 12:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
    2011-06-23 18:31 . 2004-09-02 12:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
    2011-06-23 12:05 . 2004-09-02 12:00 385024 —-a-w- c:\windows\system32\html.iec
    2011-06-20 17:44 . 2004-09-02 12:00 293888 —-a-w- c:\windows\system32\winsrv.dll
    .
    .
    ——- Sigcheck ——-
    Note: Unsigned files aren't necessarily malware.
    .
    [-] 2004-09-02 12:00 . 61A79E8D4A440095EA2EB9FD694CD1AE . 25600 . . [10.0.3790.3646] . . c:\windows\system32\mspmsnsv.dll
    [-] 2004-09-02 12:00 . 61A79E8D4A440095EA2EB9FD694CD1AE . 25600 . . [10.0.3790.3646] . . c:\windows\system32\dllcache\mspmsnsv.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PnPUI Registrator"="c:\program files\Common Files\Sitecom Shared\PnP Universal Installer\PnPUIReg.exe" [2004-11-22 163840]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
    "Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-08-05 3077528]
    "Sony Ericsson PC Companion"="c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" [2011-07-25 433360]
    "Comrade.exe"="c:\program files\GameSpy\Comrade\Comrade.exe" [2007-06-29 36864]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
    "RTHDCPL"="RTHDCPL.EXE" [2005-10-15 14864384]
    "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2010-07-21 1778064]
    "UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-06 222504]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-08-03 13892200]
    "NvMediaCenter"="NvMCTray.dll" [2011-08-03 111208]
    "nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2011-07-05 1632360]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    2008-04-14 17:03 1695232 ——w- c:\program files\Messenger\msmsgs.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\system32\\mmc.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
    "c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "56074:TCP"= 56074:TCP:Pando Media Booster
    "56074:UDP"= 56074:UDP:Pando Media Booster
    .
    R2 DevNotifySvc;DevNotifySvc;c:\program files\Common Files\Sitecom Shared\PnP Universal Installer\DevNotifySvc.exe [4-4-2011 12:57 32768]
    R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [11-9-2011 18:35 2255464]
    R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\drivers\dc3d.sys [4-4-2011 18:11 44432]
    S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [6-9-2011 17:12 13224]
    S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?]
    S3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [5-9-2011 19:59 155344]
    .
    .
    ——- Bijkomende Scan ——-
    .
    uStart Page = hxxp://www.facebook.com/?ref=hp
    IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
    TCP: DhcpNameServer = 212.54.40.25 212.54.35.25
    .
    - - - - ORPHANS VERWIJDERD - - - -
    .
    URLSearchHooks-{87775fdb-6972-41f9-ae51-8326e38cb206} - c:\program files\uTorrentBar_NL\prxtbuTo0.dll
    BHO-{30F9B915-B755-4826-820B-08FBA6BD249D} - c:\program files\ConduitEngine\prxConduitEngine.dll
    BHO-{87775fdb-6972-41f9-ae51-8326e38cb206} - c:\program files\uTorrentBar_NL\prxtbuTo0.dll
    Toolbar-{87775fdb-6972-41f9-ae51-8326e38cb206} - c:\program files\uTorrentBar_NL\prxtbuTo0.dll
    Toolbar-{30F9B915-B755-4826-820B-08FBA6BD249D} - c:\program files\ConduitEngine\prxConduitEngine.dll
    WebBrowser-{87775FDB-6972-41F9-AE51-8326E38CB206} - c:\program files\uTorrentBar_NL\prxtbuTo0.dll
    WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - c:\program files\ConduitEngine\prxConduitEngine.dll
    AddRemove-conduitEngine - c:\program files\ConduitEngine\ConduitEngineUninstall.exe
    AddRemove-uTorrentBar_NL Toolbar - c:\parogram files\uTorrentBar_NL\uninstall.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-09-13 16:50
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scannen van verborgen processen …
    .
    scannen van verborgen autostart items …
    .
    scannen van verborgen bestanden …
    .
    Scan succesvol afgerond
    verborgen bestanden: 0
    .
    **************************************************************************
    .
    ——————— VERGRENDELDE REGISTER SLEUTELS ———————
    .
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•¤|ÿÿÿÿ"•¤|þ»Ñw*]
    "31403E1900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
    .
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\¤–}|ÿÿÿÿÀ•}|ù•9~*]
    "31403E1900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
    .
    Voltooingstijd: 2011-09-13 16:52:57
    ComboFix-quarantined-files.txt 2011-09-13 14:52
    ComboFix2.txt 2011-09-13 13:46
    .
    Pre-Run: 85.212.119.040 bytes beschikbaar
    Post-Run: 85.208.584.192 bytes beschikbaar
    .
    WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
    .
    - - End Of File - - 1EACD1AD7E01420879556F02E199045C

Beantwoord deze vraag

Dit is een gearchiveerde pagina. Antwoorden is niet meer mogelijk.