Hallo,

Via RTV Noord ben ik op deze website gekomen en weet dus niet of ik ook besmet ben met dit virus.
Wij hebben namelijk sinds deze week een nieuwe computer die goed genoeg beschermd zou moeten zijn maar ik ga liever voor het zekere dan het onzeker en wil daarom graag jullie om hulp vragen om de uitslagen van de gebruikte programma's na te kijken.

Malwarebytes' Anti-Malware 1.51.2.1300
http://www.malwarebytes.org" onclick="window.open(this.href);return false;

Databaseversie: 7999

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

10/22/2011 6:08:27 PM
mbam-log-2011-10-22 (18-08-27).txt

Scantype: Snelle scan
Objecten gescand: 173695
Verstreken tijd: 2 minuut/minuten, 27 seconde(n)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 0
Registerwaarden geïnfecteerd: 0
Registerdata geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 0

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registersleutels geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registerdata geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Bestanden geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421
Run by San at 18:13:41 on 2011-10-22
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3070.2120 [GMT 2:00]
.
AV: Emsisoft Anti-Malware *Enabled/Updated* {0ADC9F7D-20C1-240F-01E2-43466EBA893A}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Emsisoft Anti-Malware *Enabled/Updated* {B1BD7E99-06FB-2B81-3B52-7834153DC387}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Emsisoft Anti-Malware\a2service.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\Windows\system32\sppsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\Ctxfihlp.exe
C:\Program Files\Emsisoft Anti-Malware\a2guard.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\SYSTEM32\CTXFISPI.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.nl/" onclick="window.open(this.href);return false;
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GR469A~1.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
mRun: [CTxfiHlp] CTXFIHLP.EXE
mRun: [emsisoft anti-malware] "c:\program files\emsisoft anti-malware\a2guard.exe" /d=60
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xporteren naar Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab" onclick="window.open(this.href);return false;
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab" onclick="window.open(this.href);return false;
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab" onclick="window.open(this.href);return false;
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab" onclick="window.open(this.href);return false;
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15118/CTPID.cab" onclick="window.open(this.href);return false;
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GRA32A~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GR469A~1.DLL
.
============= SERVICES / DRIVERS ===============
.
R1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files\emsisoft anti-malware\a2ddax86.sys [2011-10-11 17904]
R1 a2injectiondriver;a2injectiondriver;c:\program files\emsisoft anti-malware\a2dix86.sys [2011-10-11 34768]
R1 a2util;a-squared Malware-IDS utility driver;c:\program files\emsisoft anti-malware\a2util32.sys [2011-10-11 11776]
R2 a2AntiMalware;Emsisoft Anti-Malware 6.0 - Service;c:\program files\emsisoft anti-malware\a2service.exe [2011-10-11 3074040]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2011-10-3 2214504]
R3 a2acc;a2acc;c:\program files\emsisoft anti-malware\a2accx86.sys [2011-10-11 51632]
R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [2010-5-5 171096]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [2010-5-5 1324120]
R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [2010-5-5 72792]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-5-22 167936]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-10-22 136176]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-4-1 183560]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2011-10-3 79360]
S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [2010-5-5 171096]
S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [2010-5-5 1324120]
S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [2010-5-5 72792]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-10-22 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2011-5-13 1492840]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-10-22 136176]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-10-6 15872]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-10-6 52224]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-10-3 1343400]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2011-10-22 15:47:20 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-10-22 15:43:06 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{1ede9060-f1c8-4056-a64a-af4b69db5cfb}\offreg.dll
2011-10-22 15:38:05 -------- d-----w- c:\windows\en
2011-10-22 15:37:32 39272 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2011-10-22 15:35:48 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2011-10-22 15:31:05 -------- d-----w- c:\program files\Microsoft
2011-10-22 15:30:54 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2011-10-22 15:30:54 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2011-10-22 15:30:54 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2011-10-22 15:30:22 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2011-10-22 15:29:49 7450888 ----a-w- c:\program files\common files\windows live\.cache\6dee06e81cc90cf06\bingbarsetup.exe
2011-10-22 15:29:38 15712 ----a-w- c:\program files\common files\windows live\.cache\68125fc61cc90cf05\MeshBetaRemover.exe
2011-10-22 15:29:34 525656 ----a-w- c:\program files\common files\windows live\.cache\64f870b41cc90cf04\DXSETUP.exe
2011-10-22 15:29:34 1691480 ----a-w- c:\program files\common files\windows live\.cache\64f870b41cc90cf04\dsetup32.dll
2011-10-22 15:29:33 94040 ----a-w- c:\program files\common files\windows live\.cache\64f870b41cc90cf04\DSETUP.dll
2011-10-22 15:29:28 525656 ----a-w- c:\program files\common files\windows live\.cache\61a0847e1cc90cf03\DXSETUP.exe
2011-10-22 15:29:27 94040 ----a-w- c:\program files\common files\windows live\.cache\61a0847e1cc90cf03\DSETUP.dll
2011-10-22 15:29:27 1691480 ----a-w- c:\program files\common files\windows live\.cache\61a0847e1cc90cf03\dsetup32.dll
2011-10-22 15:29:21 6260088 ----a-w- c:\program files\common files\windows live\.cache\5cfe62971cc90cf02\Silverlight.4.0.exe
2011-10-22 15:28:54 -------- d-----w- c:\users\San\appdata\local\Windows Live
2011-10-22 15:28:52 -------- d-----w- c:\program files\common files\Windows Live
2011-10-22 15:20:26 -------- d-----w- c:\programdata\WhereIsIt
2011-10-22 15:20:26 -------- d-----w- c:\program files\WhereIsIt
2011-10-22 15:19:14 -------- d-----w- c:\program files\DVD Shrink
2011-10-22 15:18:58 -------- d-----w- c:\program files\DVD Decrypter
2011-10-22 15:12:22 30512 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll
2011-10-22 15:12:22 30512 ----a-w- c:\windows\system32\mdimon.dll
2011-10-22 15:12:00 33104 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\msonpppr.dll
2011-10-22 15:12:00 32592 ----a-w- c:\windows\system32\msonpmon.dll
2011-10-22 15:08:22 -------- d-----w- c:\windows\PCHEALTH
2011-10-22 15:06:18 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2011-10-22 15:05:32 -------- d-----w- c:\users\San\appdata\local\Microsoft Help
2011-10-22 14:56:52 -------- d-----w- c:\program files\DAEMON Tools Lite
2011-10-22 14:56:25 -------- d-----w- c:\users\San\appdata\roaming\DAEMON Tools Lite
2011-10-22 14:56:21 -------- d-----w- c:\programdata\DAEMON Tools Lite
2011-10-22 14:21:53 388096 ----a-r- c:\users\San\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-10-22 14:21:53 -------- d-----w- c:\program files\Trend Micro
2011-10-22 14:20:33 -------- d-----w- c:\windows\system32\SPReview
2011-10-22 14:19:59 -------- d-----w- c:\program files\CCleaner
2011-10-22 14:19:20 -------- d-----w- c:\windows\system32\EventProviders
2011-10-22 14:19:20 -------- d-----w- c:\users\San\appdata\local\Google
2011-10-20 14:01:56 443448 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-10-14 15:44:21 75776 ----a-w- c:\windows\system32\psisrndr.ax
2011-10-14 15:44:21 465408 ----a-w- c:\windows\system32\psisdecd.dll
2011-10-14 15:44:20 72704 ----a-w- c:\windows\system32\Mpeg2Data.ax
2011-10-14 15:44:20 59904 ----a-w- c:\windows\system32\MSDvbNP.ax
2011-10-14 15:44:20 204288 ----a-w- c:\windows\system32\MSNP.ax
2011-10-14 15:44:17 571904 ----a-w- c:\windows\system32\oleaut32.dll
2011-10-14 15:44:17 233472 ----a-w- c:\windows\system32\oleacc.dll
2011-10-14 15:44:12 2334720 ----a-w- c:\windows\system32\win32k.sys
2011-10-08 15:33:15 -------- d-----w- c:\users\San\appdata\roaming\Canneverbe Limited
2011-10-08 15:33:15 -------- d-----w- c:\programdata\Canneverbe Limited
2011-10-08 15:31:25 -------- d-----w- c:\users\San\appdata\local\Deployment
2011-10-08 15:31:25 -------- d-----w- c:\users\San\appdata\local\Apps
2011-10-08 15:19:00 -------- d-----w- c:\program files\coverXP
2011-10-08 15:18:15 71168 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\CNBPP4.DLL
2011-10-08 12:55:11 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2011-10-08 12:55:10 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2011-10-08 12:54:45 -------- d-----w- c:\program files\Winamp Detect
2011-10-08 12:54:18 -------- d-----w- c:\program files\common files\PX Storage Engine
2011-10-08 12:24:14 -------- d-----w- c:\users\San\appdata\local\Spotnet
2011-10-08 12:02:52 -------- d-----w- c:\programdata\Spotnet
2011-10-08 12:02:52 -------- d-----w- c:\program files\Spotnet
2011-10-06 16:31:59 34304 ----a-w- c:\windows\system32\msasn1.dll
2011-10-06 16:30:59 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2011-10-06 16:29:41 189952 ----a-w- c:\windows\system32\sqmapi.dll
2011-10-06 15:52:28 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-05 13:38:16 -------- d-----w- c:\users\San\appdata\roaming\Malwarebytes
2011-10-05 13:38:11 -------- d-----w- c:\programdata\Malwarebytes
2011-10-05 13:38:06 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-10-05 13:38:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-10-05 13:26:06 -------- d-sh--w- c:\windows\Installer
2011-10-03 22:00:55 -------- d-----w- c:\windows\Panther
2011-10-03 22:00:41 -------- d-sh--w- C:\Boot
2011-10-03 16:06:02 7062 ----a-w- c:\windows\system32\audiopid.vxd
2011-10-03 16:05:15 -------- d-----w- c:\program files\common files\Creative Labs Shared
2011-10-03 16:04:53 -------- d-----w- c:\program files\Creative
2011-10-03 16:04:30 102400 ----a-w- c:\windows\system32\cttele32.dll
2011-10-03 16:04:22 73728 ----a-w- c:\windows\system32\CmdRtr.DLL
2011-10-03 16:04:22 445016 ----a-w- c:\windows\system32\wrap_oal.dll
2011-10-03 16:04:22 148480 ----a-w- c:\windows\system32\APOMngr.DLL
2011-10-03 16:04:22 109144 ----a-w- c:\windows\system32\OpenAL32.dll
2011-10-03 16:04:22 -------- d-----w- c:\program files\OpenAL
2011-10-03 16:03:41 -------- d-----w- c:\windows\system32\Data
2011-10-03 16:03:30 22691984 ----a-w- c:\windows\system32\AppSetup.exe
2011-10-03 16:03:26 729088 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iKernel.dll
2011-10-03 16:03:26 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\ctor.dll
2011-10-03 16:03:26 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\DotNetInstaller.exe
2011-10-03 16:03:26 32768 ----a-w- c:\program files\common files\installshield\professional\runtime\Objectps.dll
2011-10-03 16:03:26 266240 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iscript.dll
2011-10-03 16:03:26 192512 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iuser.dll
2011-10-03 16:03:20 311428 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\setup.dll
2011-10-03 16:03:20 188548 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iGdi.dll
2011-10-03 15:39:49 -------- d-----w- c:\program files\Emsisoft Anti-Malware
2011-10-03 15:24:36 73728 ----a-w- c:\windows\system32\RtNicProp32.dll
2011-10-03 13:07:27 -------- d-----w- c:\windows\system32\Wat
2011-10-03 13:01:24 -------- d-----w- c:\windows\nl-NL
2011-10-03 13:01:23 -------- d-----w- c:\windows\system32\nl
2011-10-03 13:01:23 -------- d-----w- c:\windows\system32\0413
2011-10-03 13:01:15 -------- d-----w- c:\windows\system32\XPSViewer
2011-10-03 13:01:14 -------- d-----w- c:\windows\system32\drivers\umdf\nl-NL
2011-10-03 13:01:14 -------- d-----w- c:\windows\system32\drivers\nl-NL
2011-10-03 13:01:12 -------- d-----w- c:\windows\system32\wbem\nl-NL
2011-10-03 12:44:59 3584 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\nl-nl\LXKPTPRC.DLL.mui
2011-10-03 12:43:58 66664 ----a-w- c:\windows\system32\nvshext.dll
2011-10-03 12:43:58 615528 ----a-w- c:\windows\system32\nvvsvc.exe
2011-10-03 12:43:58 3693672 ----a-w- c:\windows\system32\nvcpl.dll
2011-10-03 12:43:58 2560616 ----a-w- c:\windows\system32\nvsvcr.dll
2011-10-03 12:43:58 2557544 ----a-w- c:\windows\system32\nvsvc.dll
2011-10-03 12:43:58 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-10-03 12:43:57 543336 ----a-w- c:\windows\system32\easyupdatusapiu.dll
2011-10-03 12:43:42 -------- d-----w- c:\programdata\NVIDIA Corporation
2011-10-03 12:43:39 -------- d-----w- c:\program files\NVIDIA Corporation
2011-10-03 12:39:19 7269712 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{1ede9060-f1c8-4056-a64a-af4b69db5cfb}\mpengine.dll
2011-10-03 12:39:19 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-10-03 12:35:44 293376 ----a-w- c:\windows\system32\browserchoice.exe
2011-10-03 12:33:22 31232 ----a-w- c:\windows\system32\prevhost.exe
2011-10-03 12:33:20 2048 ----a-w- c:\windows\system32\tzres.dll
2011-10-03 12:33:13 741376 ----a-w- c:\windows\system32\inetcomm.dll
2011-10-03 12:33:01 1549312 ----a-w- c:\windows\system32\tquery.dll
2011-10-03 12:33:00 86528 ----a-w- c:\windows\system32\SearchFilterHost.exe
2011-10-03 12:33:00 666624 ----a-w- c:\windows\system32\mssvp.dll
2011-10-03 12:33:00 59392 ----a-w- c:\windows\system32\msscntrs.dll
2011-10-03 12:33:00 427520 ----a-w- c:\windows\system32\SearchIndexer.exe
2011-10-03 12:33:00 337408 ----a-w- c:\windows\system32\mssph.dll
2011-10-03 12:33:00 197120 ----a-w- c:\windows\system32\mssphtb.dll
2011-10-03 12:33:00 164352 ----a-w- c:\windows\system32\SearchProtocolHost.exe
2011-10-03 12:33:00 1401344 ----a-w- c:\windows\system32\mssrch.dll
2011-10-03 12:26:55 728448 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-10-03 12:26:55 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2011-10-03 12:26:55 107520 ----a-w- c:\windows\system32\cdd.dll
2011-10-03 12:14:15 -------- d-----w- c:\windows\system32\wbem\Performance
2011-10-03 12:08:33 -------- d-sh--w- C:\Recovery
.
==================== Find3M ====================
.
2011-10-22 14:28:34 152576 ----a-w- c:\windows\system32\msclmd.dll
2011-09-01 02:35:59 1798144 ----a-w- c:\windows\system32\jscript9.dll
2011-09-01 02:28:15 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-09-01 02:22:54 2382848 ----a-w- c:\windows\system32\mshtml.tlb
.
============= FINISH: 18:14:35.16 ===============

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:28:32 PM, on 10/22/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\Ctxfihlp.exe
C:\Program Files\Emsisoft Anti-Malware\a2guard.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\SYSTEM32\CTXFISPI.EXE
C:\Windows\system32\wuauclt.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896" onclick="window.open(this.href);return false;
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896" onclick="window.open(this.href);return false;
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157" onclick="window.open(this.href);return false;
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [emsisoft anti-malware] "c:\program files\emsisoft anti-malware\a2guard.exe" /d=60
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1339789043-480002501-3043814926-1003\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1339789043-480002501-3043814926-1003\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C" onclick="window.open(this.href);return false;:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} (Creative Software AutoUpdate 2) - http://ccfiles.creative.com/Web/softwar ... TSUEng.cab" onclick="window.open(this.href);return false;
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwar ... /CTPID.cab" onclick="window.open(this.href);return false;
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Emsisoft Anti-Malware 6.0 - Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\Emsisoft Anti-Malware\a2service.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

--
End of file - 6878 bytes

Hallo Sandy,

Bevalt de nieuwe computer? Even uit nieuwsgierigheid, mag ik vragen waar je deze gekocht hebt?

Als je geïnfecteerd was geweest met de malware dat op de website van RTV Noord stond, had je dat allang gemerkt hoor. Daarom heb ik even globaal het logje doorgekeken en ik kan helemaal geen rare dingen vinden.

Gerust zo?

Groet,

Daniël 8)

Hallo Daniel,

Jazeker bevalt de nieuwe computer en deze is online besteld bij Salland.
Ik las dit pas later maar heb wel gemerkt toen ik de website van RTV Noord opende het net leek of deze elke keer opnieuw moest laden en een klein venstertje oppopte om een taalpakket te installeren wat ik natuurlijk niet heb gedaan en direct weggeklikt heb.
Hierna bleef de website zoals het leek opnieuw laden met elke keer van die linkjes die veranderde.
Vandaar dat ik om hulp vrroeg om de uitslagen van de gebruikte programma's na te kijken maar die zijn helemaal schoon zoals jij kan zien.

Ik wil graag mijn laatste bericht nog even onder de aandacht brengen als dat mag.

Hoi,

De logjes zien er picobello uit en er zijn geen sporen van 'Security Sphere 2012' te zien, dus Emsisoft Antimalware heeft goed zijn werk gedaan.
Het continu laden van de pagina heeft daar onder andere mee te maken, Emsisoft Antimalware blokt dan namelijk het uitvoeren en het laden van het malafide bestand om het even beknopt toe te lichten.

Sandy schreef:Ik wil graag mijn laatste bericht nog even onder de aandacht brengen als dat mag.

Sorry, maar ik had niet de indruk dat je nog een vraag had gesteld...

Alles opgelost / duidelijk zo?

Hallo,

Ja het is nu duidelijk Maxstar en Daniel heel erg bedankt voor het kijken naar mijn computer.

Hoi,

Graag gedaan....

Omdat het probleem is verholpen wordt dit topic gesloten en verplaatst naar de sectie opgeloste problemen / logs.

Als u dit topic heropent wilt hebben, dan kunt u mij of één van moderators een (PB) privébericht sturen met een link naar dit betreffende topic.

Indien het topic al langere tijd is gesloten kunt u het beste hier een nieuw topic aanmaken, en eventueel verwijzen naar dit topic.

Voor alle andere vragen kunt u in het juiste forum een nieuw onderwerp starten.