Hallo,
Bij het opstarten van de laptop komt het eerste probleem, een programma(iets van sysguard, wist niet eens dat ik het had)zegt dat het een proces, ofzo, van buitenaf vind en wil gaan scannen. Na een half uur verder te zijn zegt hij dat het eindelijk over is. Jammer genoeg gebeurt dit iedere keer met opstarten.
Het 2e probleem is mijn internet explorer. Die start zichzelf steeds opnieuw op vanwege een of ander probleem.
Nu had ik ergens gevonden dat combofix je weleens zou kunnen helpen, maar dat je je wel moest laten adviseren door iemand die verstand van computers heeft.
Ik heb hem laten lopen en dit is de log:
ComboFix 08-08-18.04 - Kevin Gijsbertsen 2008-08-19 13:16:53.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1043.18.1890 [GMT 2:00]
Gestart vanuit: C:\Users\Kevin Gijsbertsen\Desktop\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt
.
(((((((((((((((((((( Bestanden Gemaakt van 2008-07-19 to 2008-08-19 ))))))))))))))))))))))))))))))
.
2008-08-19 13:15 . 2008-08-19 13:16 <DIR> d-------- C:\327882R2FWJFW
2008-08-18 01:23 . 2008-08-18 01:23 <DIR> d-------- C:\Windows\sysguard
2008-08-18 00:59 . 2008-08-18 16:24 <DIR> d-------- C:\Users\Kevin Gijsbertsen\AppData\Roaming\vghd
2008-08-18 00:59 . 2008-08-18 00:59 152,920 --a------ C:\Windows\System32\vghd.scr
2008-08-14 09:51 . 2008-07-16 01:48 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-13 22:39 . 2008-04-10 07:01 737,792 --a------ C:\Windows\System32\inetcomm.dll
2008-08-13 22:39 . 2008-04-10 04:43 84,480 --a------ C:\Windows\System32\INETRES.dll
2008-08-13 16:38 . 2008-08-13 16:38 <DIR> d-------- C:\Program Files\Maxis
2008-08-12 15:52 . 2008-06-26 02:33 11,722,752 --a------ C:\Windows\System32\NlsLexicons0001.dll
2008-08-05 11:58 . 2008-08-05 11:58 186,880 --a------ C:\Windows\ieguard.dll
2008-07-21 19:43 . 2008-07-21 19:43 <DIR> d-------- C:\Users\Kevin Gijsbertsen\AppData\Roaming\Apple Computer
2008-07-21 19:43 . 2008-07-21 19:43 <DIR> d-------- C:\Program Files\iTunes
2008-07-21 19:43 . 2008-07-21 19:43 <DIR> d-------- C:\Program Files\iPod
2008-07-21 19:43 . 2008-07-21 19:43 <DIR> d-------- C:\Program Files\Bonjour
2008-07-21 19:42 . 2008-07-21 19:43 <DIR> d-------- C:\Users\All Users\Apple Computer
2008-07-21 19:42 . 2008-07-21 19:43 <DIR> d-------- C:\ProgramData\Apple Computer
2008-07-21 19:42 . 2008-07-21 19:43 <DIR> d-------- C:\Program Files\QuickTime
2008-07-21 19:42 . 2008-07-21 19:42 <DIR> d-------- C:\Program Files\Apple Software Update
2008-07-21 19:41 . 2008-07-21 19:41 <DIR> d-------- C:\Users\All Users\Apple
2008-07-21 19:41 . 2008-07-21 19:41 <DIR> d-------- C:\ProgramData\Apple
2008-07-21 19:41 . 2008-07-21 19:41 <DIR> d-------- C:\Program Files\Common Files\Apple
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-18 14:22 --------- d-----w C:\ProgramData\Symantec
2008-08-18 14:18 28,979 ----a-w C:\Users\Kevin Gijsbertsen\AppData\Roaming\nvModes.dat
2008-08-18 14:18 --------- d-----w C:\Users\Kevin Gijsbertsen\AppData\Roaming\temp
2008-08-14 10:04 --------- d-----w C:\Program Files\Windows Mail
2008-08-14 07:53 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-12 16:05 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-07-11 05:36 --------- d---a-w C:\ProgramData\TEMP
2008-07-11 05:03 --------- d-----w C:\ProgramData\JollyBear
2008-07-10 07:35 32,000 ----a-w C:\Windows\system32\drivers\usbaapl.sys
2008-07-09 22:57 174 --sha-w C:\Program Files\desktop.ini
2008-07-08 12:32 108,144 ----a-w C:\Windows\System32\CmdLineExt.dll
2008-07-08 12:22 6,877 ----a-w C:\Program Files\install.log
2008-07-08 12:22 --------- d-----w C:\ProgramData\Gamespot
2008-07-08 12:22 --------- d-----w C:\Program Files\GameSpot
2008-07-08 09:58 41,984 ----a-w C:\Windows\system32\drivers\monitor.sys
2008-07-08 09:58 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-07-08 09:58 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-07-08 09:58 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2008-07-08 09:57 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-07-08 09:57 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-08 09:57 428,032 ----a-w C:\Windows\System32\EncDec.dll
2008-07-08 09:57 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-07-08 09:57 292,352 ----a-w C:\Windows\System32\psisdecd.dll
2008-07-08 09:57 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-07-08 09:57 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-08 09:57 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-07-08 09:57 1,686,528 ----a-w C:\Windows\System32\gameux.dll
2008-07-08 09:57 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2008-07-08 09:54 --------- d-----w C:\Users\Kevin Gijsbertsen\AppData\Roaming\Acer
2008-07-07 19:46 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-07 19:46 --------- d-----w C:\Program Files\Windows Live
2008-07-07 19:39 --------- d-----w C:\ProgramData\WLInstaller
2008-07-07 19:21 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-07 19:16 944,184 ----a-w C:\Windows\System32\winload.exe
2008-07-07 19:15 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-07-07 19:15 296,448 ----a-w C:\Windows\System32\gdi32.dll
2008-07-07 19:15 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-07-07 19:15 2,048 ----a-w C:\Windows\System32\asferror.dll
2008-07-07 19:15 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-07-07 19:15 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys
2008-07-07 19:15 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-07-07 19:14 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-07-07 19:14 83,968 ----a-w C:\Windows\System32\dnsrslvr.dll
2008-07-07 19:14 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-07-07 19:14 24,576 ----a-w C:\Windows\System32\dnscacheugc.exe
2008-07-07 19:14 148,992 ----a-w C:\Windows\system32\drivers\ks.sys
2008-07-07 19:14 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-07-07 19:14 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-07-07 19:14 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-07-07 18:49 80,896 ----a-w C:\Windows\System32\wudriver.dll
2008-07-07 18:49 549,720 ----a-w C:\Windows\System32\wuapi.dll
2008-07-07 18:49 53,080 ----a-w C:\Windows\System32\wuauclt.exe
2008-07-07 18:49 43,352 ----a-w C:\Windows\System32\wups2.dll
2008-07-07 18:49 33,624 ----a-w C:\Windows\System32\wups.dll
2008-07-07 18:49 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-07-07 18:49 163,000 ----a-w C:\Windows\System32\wuwebv.dll
2008-07-07 18:49 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
2008-07-07 18:49 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
2008-07-07 12:42 --------- d-----w C:\Program Files\GamesBar
2008-07-07 12:42 --------- d-----w C:\Program Files\Common Files\Oberon Media
2008-07-07 12:42 --------- d-----w C:\Program Files\Acer GameZone
2008-07-07 11:10 --------- d--h--r C:\Users\Kevin Gijsbertsen\AppData\Roaming\SecuROM
2008-07-07 11:02 --------- d-----w C:\Program Files\EA SPORTS
2008-07-07 10:50 --------- d-----w C:\Program Files\Convesoft
2008-07-07 10:27 --------- d-----w C:\Program Files\Norton Internet Security
2008-07-07 10:22 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
2008-07-07 10:22 123,952 ----a-w C:\Windows\system32\drivers\SYMEVENT.SYS
2008-07-07 10:22 10,671 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
2008-07-07 10:22 --------- d-----w C:\Program Files\Symantec
2008-07-06 23:38 --------- d-----w C:\Program Files\EA GAMES
2008-07-06 15:21 --------- d-----w C:\Program Files\Acer Inc
2008-07-06 15:19 --------- d-----w C:\Users\Kevin Gijsbertsen\AppData\Roaming\InstallShield
2008-07-06 15:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-06 15:14 --------- d-----w C:\Program Files\SUYIN
2008-07-06 15:14 --------- d-----w C:\Program Files\ACER CrystalEye webcam
2008-07-06 15:13 --------- d-----w C:\Program Files\Common Files\snp2uvc
2008-07-06 15:12 --------- d-----w C:\Program Files\Acer
2008-07-06 15:06 --------- d-----w C:\Program Files\Acer Arcade Deluxe
2008-07-06 15:05 --------- d-----w C:\Program Files\Launch Manager
2008-07-06 15:01 --------- d-----w C:\Program Files\Yahoo!
2008-07-06 15:01 --------- d-----w C:\Program Files\Intel
2008-07-06 15:00 --------- d-sh--w C:\ProgramData\Sjablonen
2008-07-06 15:00 --------- d-sh--w C:\ProgramData\Menu Start
2008-07-06 15:00 --------- d-sh--w C:\ProgramData\Favorieten
2008-07-06 15:00 --------- d-sh--w C:\ProgramData\Documenten
2008-07-06 15:00 --------- d-sh--w C:\ProgramData\Bureaublad
2008-07-06 14:54 --------- d-----w C:\Users\Kevin Gijsbertsen\AppData\Roaming\CyberLink
2008-07-06 14:54 --------- d-----w C:\ProgramData\CyberLink
2008-07-05 22:01 319,456 ----a-w C:\Windows\DIFxAPI.dll
2008-07-05 22:01 315,392 ----a-w C:\Windows\HideWin.exe
2008-07-05 22:01 --------- d-----w C:\Program Files\Realtek
2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-06-19 03:25 61,440 ----a-w C:\Windows\System32\winipsec.dll
2008-06-19 03:25 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
2008-06-19 03:25 28,672 ----a-w C:\Windows\System32\FwRemoteSvr.dll
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-07-07 21:15 1232896]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-14 10:55 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-14 10:54 8501792]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-14 10:55 81920]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-12-14 10:55 102400]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 05:38 40048]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 17:33 457216]
"eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-08-31 18:38 1286144]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-10-25 00:08 107112]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-10-27 01:18 22696]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-12-14 10:55 174616]
"LManager"="C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE" [2008-01-02 15:17 707080]
"PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-12-05 10:32 200704]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 21:48 57344]
"PLFSet"="C:\Windows\PLFSet.dll" [2007-04-25 13:47 45056]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-08-01 18:30 151552]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
"RtHDVCpl"="RtHDVCpl.exe" [2007-12-14 10:56 4702208 C:\Windows\RtHDVCpl.exe]
"Skytel"="Skytel.exe" [2007-12-14 10:56 1826816 C:\Windows\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-08-01 18:30 151552]
C:\Users\Kevin Gijsbertsen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
GameSpot Download Manager.lnk - C:\Program Files\GameSpot\GameSpotDownloadManager_Win32.exe [2008-04-17 01:08:36 876544]
Orion.lnk - C:\Program Files\Convesoft\Orion\Messenger.exe [2008-04-16 11:31:04 4685824]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - C:\Program Files\Acer\Acer VCM\AcerVCM.exe [2008-07-06 17:12:12 1216512]
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-12-20 22:56:57 535336]
[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="C:\\Windows\\sysguard\\sysguard.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{F89564C3-4125-44C7-8633-8314A7702636}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{B22C245A-814C-4E01-AA29-B4B794215DE3}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
"{ED44BF6B-764D-47A6-A4E9-FC3754F2A725}"= C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
"{7DFBE4A6-BEC2-4932-93CF-A6A4D4BE62C7}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe
V Wizard
"{E7C8F135-6208-46B9-A747-0694B8572006}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F3CC0AC5-6A1D-437D-848F-F26ABF27A158}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{3E7D8AA9-6B80-47FF-A242-A8619FFBFD88}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exeVDivine
"{4BCE8E80-01FD-4FC6-B3EF-990B5C5D765A}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe
lay Movie
"{C223ADEE-760C-4E05-8563-DA3443C052B7}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exelay Movie Resident Program
"{F2B968E8-CD69-49CE-891D-AA32073E498B}"= C:\Program Files\Acer\Acer VCM\VC.exe:Acer VCM
"{F201CDE7-E474-4906-834C-9C69C427EBFC}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{E753FBFD-FB13-4FF9-8100-3146F67E0916}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{B9A2596E-F694-41C4-9207-B053E86D98BA}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{01E66160-77ED-418E-AD21-A1D31B3BB764}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{C687C1C8-C441-472F-8E1F-D27917B3A5AB}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080813.001\IDSvix86.sys [2008-06-03 17:55]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2007-12-05 10:48]
R2 RS_Service;Raw Socket Service;C:\Program Files\Acer\Acer VCM\RS_Service.exe [2007-09-28 19:18]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2006-10-24 14:40]
R3 winbondcir;Winbond IR Transceiver;C:\Windows\system32\DRIVERS\winbondcir.sys [2007-12-14 10:56]
S3 A310;AVerMedia A310 DVB-T;C:\Windows\system32\DRIVERS\AVerA310USB.sys [2007-07-10 04:16]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-12-14 10:56]
S3 BDASwCap;AVerMedia A310 BDA DVBT Capture Device;C:\Windows\system32\drivers\AVerA310Cap.sys [2007-07-10 04:16]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{98db1083-4add-11dd-bad0-806e6f6e6963}]
\shell\AutoRun\command - F:\Autorun.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
*Newly Created Service* - PROCEXP90
.
Inhoud van de 'Gedeelde Taken' map
2008-07-07 C:\Windows\Tasks\Norton Internet Security - Volledige systeemscan - Kevin Gijsbertsen.job
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe [2006-11-07 19:48]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Acer Tour Reminder - (no file)
HKLM-Run-SetPanel - C:\Acer\APanel\APanel.cmd
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
R0 -: HKLM-Main,Start Page = hxxp://nl.intl.acer.yahoo.com
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
R1 -: HKCU-SearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
.
.
------- File Associations (Beta) -------
.
VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
vbefile\shell\open\command="%SystemRoot%\System32\WScript.exe" "%1" %*
vbsfile\shell\open\command="%SystemRoot%\System32\WScript.exe" "%1" %*
jsefile\shell\open\command=%SystemRoot%\System32\WScript.exe "%1" %*
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-19 13:19:48
Windows 6.0.6000 NTFS
scannen van verborgen processen ...
scannen van verborgen autostart items ...
scannen van verborgen bestanden ...
Scan succesvol afgerond
verborgen bestanden: 0
**************************************************************************
.
Voltooingstijd: 2008-08-19 13:20:48
ComboFix-quarantined-files.txt 2008-08-19 11:20:37
Pre-Run: 74,824,982,528 bytes beschikbaar
Post-Run: 74,927,181,824 bytes beschikbaar
263 --- E O F --- 2008-08-14 07:53:47
Na het opstarten van de laptop lijkt hij het weer normaal te doen, maar ik wil toch even graag weten alles goed is gegaan en of er nog iets moet gebeuren.
Bij het opstarten van de laptop komt het eerste probleem, een programma(iets van sysguard, wist niet eens dat ik het had)zegt dat het een proces, ofzo, van buitenaf vind en wil gaan scannen. Na een half uur verder te zijn zegt hij dat het eindelijk over is. Jammer genoeg gebeurt dit iedere keer met opstarten.
Het 2e probleem is mijn internet explorer. Die start zichzelf steeds opnieuw op vanwege een of ander probleem.
Nu had ik ergens gevonden dat combofix je weleens zou kunnen helpen, maar dat je je wel moest laten adviseren door iemand die verstand van computers heeft.
Ik heb hem laten lopen en dit is de log:
ComboFix 08-08-18.04 - Kevin Gijsbertsen 2008-08-19 13:16:53.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1043.18.1890 [GMT 2:00]
Gestart vanuit: C:\Users\Kevin Gijsbertsen\Desktop\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt
.
(((((((((((((((((((( Bestanden Gemaakt van 2008-07-19 to 2008-08-19 ))))))))))))))))))))))))))))))
.
2008-08-19 13:15 . 2008-08-19 13:16 <DIR> d-------- C:\327882R2FWJFW
2008-08-18 01:23 . 2008-08-18 01:23 <DIR> d-------- C:\Windows\sysguard
2008-08-18 00:59 . 2008-08-18 16:24 <DIR> d-------- C:\Users\Kevin Gijsbertsen\AppData\Roaming\vghd
2008-08-18 00:59 . 2008-08-18 00:59 152,920 --a------ C:\Windows\System32\vghd.scr
2008-08-14 09:51 . 2008-07-16 01:48 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-13 22:39 . 2008-04-10 07:01 737,792 --a------ C:\Windows\System32\inetcomm.dll
2008-08-13 22:39 . 2008-04-10 04:43 84,480 --a------ C:\Windows\System32\INETRES.dll
2008-08-13 16:38 . 2008-08-13 16:38 <DIR> d-------- C:\Program Files\Maxis
2008-08-12 15:52 . 2008-06-26 02:33 11,722,752 --a------ C:\Windows\System32\NlsLexicons0001.dll
2008-08-05 11:58 . 2008-08-05 11:58 186,880 --a------ C:\Windows\ieguard.dll
2008-07-21 19:43 . 2008-07-21 19:43 <DIR> d-------- C:\Users\Kevin Gijsbertsen\AppData\Roaming\Apple Computer
2008-07-21 19:43 . 2008-07-21 19:43 <DIR> d-------- C:\Program Files\iTunes
2008-07-21 19:43 . 2008-07-21 19:43 <DIR> d-------- C:\Program Files\iPod
2008-07-21 19:43 . 2008-07-21 19:43 <DIR> d-------- C:\Program Files\Bonjour
2008-07-21 19:42 . 2008-07-21 19:43 <DIR> d-------- C:\Users\All Users\Apple Computer
2008-07-21 19:42 . 2008-07-21 19:43 <DIR> d-------- C:\ProgramData\Apple Computer
2008-07-21 19:42 . 2008-07-21 19:43 <DIR> d-------- C:\Program Files\QuickTime
2008-07-21 19:42 . 2008-07-21 19:42 <DIR> d-------- C:\Program Files\Apple Software Update
2008-07-21 19:41 . 2008-07-21 19:41 <DIR> d-------- C:\Users\All Users\Apple
2008-07-21 19:41 . 2008-07-21 19:41 <DIR> d-------- C:\ProgramData\Apple
2008-07-21 19:41 . 2008-07-21 19:41 <DIR> d-------- C:\Program Files\Common Files\Apple
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-18 14:22 --------- d-----w C:\ProgramData\Symantec
2008-08-18 14:18 28,979 ----a-w C:\Users\Kevin Gijsbertsen\AppData\Roaming\nvModes.dat
2008-08-18 14:18 --------- d-----w C:\Users\Kevin Gijsbertsen\AppData\Roaming\temp
2008-08-14 10:04 --------- d-----w C:\Program Files\Windows Mail
2008-08-14 07:53 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-12 16:05 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-07-11 05:36 --------- d---a-w C:\ProgramData\TEMP
2008-07-11 05:03 --------- d-----w C:\ProgramData\JollyBear
2008-07-10 07:35 32,000 ----a-w C:\Windows\system32\drivers\usbaapl.sys
2008-07-09 22:57 174 --sha-w C:\Program Files\desktop.ini
2008-07-08 12:32 108,144 ----a-w C:\Windows\System32\CmdLineExt.dll
2008-07-08 12:22 6,877 ----a-w C:\Program Files\install.log
2008-07-08 12:22 --------- d-----w C:\ProgramData\Gamespot
2008-07-08 12:22 --------- d-----w C:\Program Files\GameSpot
2008-07-08 09:58 41,984 ----a-w C:\Windows\system32\drivers\monitor.sys
2008-07-08 09:58 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-07-08 09:58 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-07-08 09:58 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2008-07-08 09:57 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-07-08 09:57 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-08 09:57 428,032 ----a-w C:\Windows\System32\EncDec.dll
2008-07-08 09:57 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-07-08 09:57 292,352 ----a-w C:\Windows\System32\psisdecd.dll
2008-07-08 09:57 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-07-08 09:57 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-08 09:57 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-07-08 09:57 1,686,528 ----a-w C:\Windows\System32\gameux.dll
2008-07-08 09:57 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2008-07-08 09:54 --------- d-----w C:\Users\Kevin Gijsbertsen\AppData\Roaming\Acer
2008-07-07 19:46 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-07 19:46 --------- d-----w C:\Program Files\Windows Live
2008-07-07 19:39 --------- d-----w C:\ProgramData\WLInstaller
2008-07-07 19:21 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-07 19:16 944,184 ----a-w C:\Windows\System32\winload.exe
2008-07-07 19:15 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-07-07 19:15 296,448 ----a-w C:\Windows\System32\gdi32.dll
2008-07-07 19:15 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-07-07 19:15 2,048 ----a-w C:\Windows\System32\asferror.dll
2008-07-07 19:15 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-07-07 19:15 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys
2008-07-07 19:15 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-07-07 19:14 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-07-07 19:14 83,968 ----a-w C:\Windows\System32\dnsrslvr.dll
2008-07-07 19:14 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-07-07 19:14 24,576 ----a-w C:\Windows\System32\dnscacheugc.exe
2008-07-07 19:14 148,992 ----a-w C:\Windows\system32\drivers\ks.sys
2008-07-07 19:14 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-07-07 19:14 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-07-07 19:14 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-07-07 18:49 80,896 ----a-w C:\Windows\System32\wudriver.dll
2008-07-07 18:49 549,720 ----a-w C:\Windows\System32\wuapi.dll
2008-07-07 18:49 53,080 ----a-w C:\Windows\System32\wuauclt.exe
2008-07-07 18:49 43,352 ----a-w C:\Windows\System32\wups2.dll
2008-07-07 18:49 33,624 ----a-w C:\Windows\System32\wups.dll
2008-07-07 18:49 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-07-07 18:49 163,000 ----a-w C:\Windows\System32\wuwebv.dll
2008-07-07 18:49 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
2008-07-07 18:49 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
2008-07-07 12:42 --------- d-----w C:\Program Files\GamesBar
2008-07-07 12:42 --------- d-----w C:\Program Files\Common Files\Oberon Media
2008-07-07 12:42 --------- d-----w C:\Program Files\Acer GameZone
2008-07-07 11:10 --------- d--h--r C:\Users\Kevin Gijsbertsen\AppData\Roaming\SecuROM
2008-07-07 11:02 --------- d-----w C:\Program Files\EA SPORTS
2008-07-07 10:50 --------- d-----w C:\Program Files\Convesoft
2008-07-07 10:27 --------- d-----w C:\Program Files\Norton Internet Security
2008-07-07 10:22 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
2008-07-07 10:22 123,952 ----a-w C:\Windows\system32\drivers\SYMEVENT.SYS
2008-07-07 10:22 10,671 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
2008-07-07 10:22 --------- d-----w C:\Program Files\Symantec
2008-07-06 23:38 --------- d-----w C:\Program Files\EA GAMES
2008-07-06 15:21 --------- d-----w C:\Program Files\Acer Inc
2008-07-06 15:19 --------- d-----w C:\Users\Kevin Gijsbertsen\AppData\Roaming\InstallShield
2008-07-06 15:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-06 15:14 --------- d-----w C:\Program Files\SUYIN
2008-07-06 15:14 --------- d-----w C:\Program Files\ACER CrystalEye webcam
2008-07-06 15:13 --------- d-----w C:\Program Files\Common Files\snp2uvc
2008-07-06 15:12 --------- d-----w C:\Program Files\Acer
2008-07-06 15:06 --------- d-----w C:\Program Files\Acer Arcade Deluxe
2008-07-06 15:05 --------- d-----w C:\Program Files\Launch Manager
2008-07-06 15:01 --------- d-----w C:\Program Files\Yahoo!
2008-07-06 15:01 --------- d-----w C:\Program Files\Intel
2008-07-06 15:00 --------- d-sh--w C:\ProgramData\Sjablonen
2008-07-06 15:00 --------- d-sh--w C:\ProgramData\Menu Start
2008-07-06 15:00 --------- d-sh--w C:\ProgramData\Favorieten
2008-07-06 15:00 --------- d-sh--w C:\ProgramData\Documenten
2008-07-06 15:00 --------- d-sh--w C:\ProgramData\Bureaublad
2008-07-06 14:54 --------- d-----w C:\Users\Kevin Gijsbertsen\AppData\Roaming\CyberLink
2008-07-06 14:54 --------- d-----w C:\ProgramData\CyberLink
2008-07-05 22:01 319,456 ----a-w C:\Windows\DIFxAPI.dll
2008-07-05 22:01 315,392 ----a-w C:\Windows\HideWin.exe
2008-07-05 22:01 --------- d-----w C:\Program Files\Realtek
2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-06-19 03:25 61,440 ----a-w C:\Windows\System32\winipsec.dll
2008-06-19 03:25 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
2008-06-19 03:25 28,672 ----a-w C:\Windows\System32\FwRemoteSvr.dll
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-07-07 21:15 1232896]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-14 10:55 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-14 10:54 8501792]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-14 10:55 81920]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-12-14 10:55 102400]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 05:38 40048]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 17:33 457216]
"eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-08-31 18:38 1286144]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-10-25 00:08 107112]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-10-27 01:18 22696]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-12-14 10:55 174616]
"LManager"="C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE" [2008-01-02 15:17 707080]
"PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-12-05 10:32 200704]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 21:48 57344]
"PLFSet"="C:\Windows\PLFSet.dll" [2007-04-25 13:47 45056]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-08-01 18:30 151552]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
"RtHDVCpl"="RtHDVCpl.exe" [2007-12-14 10:56 4702208 C:\Windows\RtHDVCpl.exe]
"Skytel"="Skytel.exe" [2007-12-14 10:56 1826816 C:\Windows\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-08-01 18:30 151552]
C:\Users\Kevin Gijsbertsen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
GameSpot Download Manager.lnk - C:\Program Files\GameSpot\GameSpotDownloadManager_Win32.exe [2008-04-17 01:08:36 876544]
Orion.lnk - C:\Program Files\Convesoft\Orion\Messenger.exe [2008-04-16 11:31:04 4685824]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - C:\Program Files\Acer\Acer VCM\AcerVCM.exe [2008-07-06 17:12:12 1216512]
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-12-20 22:56:57 535336]
[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="C:\\Windows\\sysguard\\sysguard.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{F89564C3-4125-44C7-8633-8314A7702636}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{B22C245A-814C-4E01-AA29-B4B794215DE3}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
"{ED44BF6B-764D-47A6-A4E9-FC3754F2A725}"= C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
"{7DFBE4A6-BEC2-4932-93CF-A6A4D4BE62C7}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe
V Wizard"{E7C8F135-6208-46B9-A747-0694B8572006}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F3CC0AC5-6A1D-437D-848F-F26ABF27A158}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{3E7D8AA9-6B80-47FF-A242-A8619FFBFD88}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exe
VDivine"{4BCE8E80-01FD-4FC6-B3EF-990B5C5D765A}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe
lay Movie"{C223ADEE-760C-4E05-8563-DA3443C052B7}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
lay Movie Resident Program"{F2B968E8-CD69-49CE-891D-AA32073E498B}"= C:\Program Files\Acer\Acer VCM\VC.exe:Acer VCM
"{F201CDE7-E474-4906-834C-9C69C427EBFC}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{E753FBFD-FB13-4FF9-8100-3146F67E0916}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{B9A2596E-F694-41C4-9207-B053E86D98BA}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{01E66160-77ED-418E-AD21-A1D31B3BB764}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{C687C1C8-C441-472F-8E1F-D27917B3A5AB}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080813.001\IDSvix86.sys [2008-06-03 17:55]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2007-12-05 10:48]
R2 RS_Service;Raw Socket Service;C:\Program Files\Acer\Acer VCM\RS_Service.exe [2007-09-28 19:18]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2006-10-24 14:40]
R3 winbondcir;Winbond IR Transceiver;C:\Windows\system32\DRIVERS\winbondcir.sys [2007-12-14 10:56]
S3 A310;AVerMedia A310 DVB-T;C:\Windows\system32\DRIVERS\AVerA310USB.sys [2007-07-10 04:16]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-12-14 10:56]
S3 BDASwCap;AVerMedia A310 BDA DVBT Capture Device;C:\Windows\system32\drivers\AVerA310Cap.sys [2007-07-10 04:16]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{98db1083-4add-11dd-bad0-806e6f6e6963}]
\shell\AutoRun\command - F:\Autorun.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
*Newly Created Service* - PROCEXP90
.
Inhoud van de 'Gedeelde Taken' map
2008-07-07 C:\Windows\Tasks\Norton Internet Security - Volledige systeemscan - Kevin Gijsbertsen.job
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe [2006-11-07 19:48]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Acer Tour Reminder - (no file)
HKLM-Run-SetPanel - C:\Acer\APanel\APanel.cmd
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
R0 -: HKLM-Main,Start Page = hxxp://nl.intl.acer.yahoo.com
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
R1 -: HKCU-SearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
.
.
------- File Associations (Beta) -------
.
VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
vbefile\shell\open\command="%SystemRoot%\System32\WScript.exe" "%1" %*
vbsfile\shell\open\command="%SystemRoot%\System32\WScript.exe" "%1" %*
jsefile\shell\open\command=%SystemRoot%\System32\WScript.exe "%1" %*
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-19 13:19:48
Windows 6.0.6000 NTFS
scannen van verborgen processen ...
scannen van verborgen autostart items ...
scannen van verborgen bestanden ...
Scan succesvol afgerond
verborgen bestanden: 0
**************************************************************************
.
Voltooingstijd: 2008-08-19 13:20:48
ComboFix-quarantined-files.txt 2008-08-19 11:20:37
Pre-Run: 74,824,982,528 bytes beschikbaar
Post-Run: 74,927,181,824 bytes beschikbaar
263 --- E O F --- 2008-08-14 07:53:47
Na het opstarten van de laptop lijkt hij het weer normaal te doen, maar ik wil toch even graag weten alles goed is gegaan en of er nog iets moet gebeuren.
