Solved spam, spyware, ...

[Resolved] spam, spyware, ...

I would like to have some help from a specialist about removing spam, spy- or malware on my windows xp pc. Thanks you.

 

spam, spy- malware

These are the logs:

1 Malwarebytes:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Databaseversie: 6305

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/04/2011 0:57:30
mbam-log-2011-04-08 (00-57-30).txt

Scantype: Snelle scan
Objecten gescand: 172353

Verstreken tijd: 16 minuut/minuten, 46 seconde(n)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 0
Registerwaarden geïnfecteerd: 0
Registerdata geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 0

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registersleutels geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registerdata geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Bestanden geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

2 MBRcheck :

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000000fd

Kernel Drivers (total 131):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806F0000 \WINDOWS\system32\hal.dll
0xF8A36000 \WINDOWS\system32\KDCOM.DLL
0xF8946000 \WINDOWS\system32\BOOTVID.dll
0xF84E6000 ACPI.sys
0xF8A38000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xF84D5000 pci.sys
0xF8536000 isapnp.sys
0xF8546000 ohci1394.sys
0xF8556000 \WINDOWS\System32\DRIVERS\1394BUS.SYS
0xF8A3A000 intelide.sys
0xF87B6000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xF8566000 MountMgr.sys
0xF84B6000 ftdisk.sys
0xF8A3C000 dmload.sys
0xF8490000 dmio.sys
0xF87BE000 PartMgr.sys
0xF8576000 VolSnap.sys
0xF8478000 atapi.sys
0xF8586000 disk.sys
0xF8596000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xF8458000 fltmgr.sys
0xF8446000 sr.sys
0xF85A6000 PxHelp20.sys
0xF842F000 KSecDD.sys
0xF83A2000 Ntfs.sys
0xF8375000 NDIS.sys
0xF835B000 Mup.sys
0xF85B6000 agp440.sys
0xF81DB000 \SystemRoot\System32\DRIVERS\nv4_mini.sys
0xF81C7000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xF888E000 \SystemRoot\System32\DRIVERS\usbohci.sys
0xF81A3000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF8896000 \SystemRoot\System32\DRIVERS\usbehci.sys
0xF8706000 \SystemRoot\System32\DRIVERS\nic1394.sys
0xF813B000 \SystemRoot\system32\DRIVERS\CTXH51.sys
0xF889E000 \SystemRoot\System32\Drivers\Modem.SYS
0xF88A6000 \SystemRoot\System32\DRIVERS\RTL8139.SYS
0xF8716000 \SystemRoot\System32\DRIVERS\imapi.sys
0xF8726000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF8736000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF8118000 \SystemRoot\System32\DRIVERS\ks.sys
0xF88AE000 \SystemRoot\System32\DRIVERS\usbuhci.sys
0xF88B6000 \SystemRoot\System32\DRIVERS\fdc.sys
0xF8746000 \SystemRoot\System32\DRIVERS\serial.sys
0xF89F2000 \SystemRoot\System32\DRIVERS\serenum.sys
0xF80C7000 \SystemRoot\System32\DRIVERS\parport.sys
0xF8756000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xF88BE000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF89F6000 \SystemRoot\System32\DRIVERS\gameenum.sys
0xF8B89000 \SystemRoot\system32\drivers\msmpu401.sys
0xF80A3000 \SystemRoot\system32\drivers\portcls.sys
0xF8766000 \SystemRoot\system32\drivers\drmk.sys
0xF8B8A000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF8776000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF89FA000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF808C000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF8786000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF87A6000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF88C6000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xF7FDB000 \SystemRoot\System32\DRIVERS\psched.sys
0xF85E6000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF7BD7000 \SystemRoot\System32\drivers\dmboot.sys
0xF88CE000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF88D6000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF85F6000 \SystemRoot\System32\Drivers\pcouffin.sys
0xF7B7F000 \SystemRoot\System32\DRIVERS\rdpdr.sys
0xF8606000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF88DE000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF8A5A000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF7B21000 \SystemRoot\System32\DRIVERS\update.sys
0xF8A1A000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF8616000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF8626000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF8A66000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF88E6000 \SystemRoot\System32\DRIVERS\flpydisk.sys
0xF29D8000 \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys
0xF8A76000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8B7C000 \SystemRoot\System32\Drivers\Null.SYS
0xF8A78000 \SystemRoot\System32\Drivers\Beep.SYS
0xF88F6000 \SystemRoot\System32\drivers\vga.sys
0xF8A7A000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF8A7C000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF88FE000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF8906000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF89CA000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xF29A5000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xF294C000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xF2924000 \SystemRoot\System32\DRIVERS\netbt.sys
0xF2902000 \SystemRoot\System32\drivers\afd.sys
0xF8646000 \SystemRoot\System32\DRIVERS\netbios.sys
0xF28D7000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xF890E000 \??\c:\program files\norman\ngs\bin\ngs.sys
0xF283F000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xF8656000 \SystemRoot\System32\Drivers\Fips.SYS
0xF2819000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xF8666000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xF8686000 \SystemRoot\System32\DRIVERS\arp1394.sys
0xF7BBF000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF86A6000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF8916000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF86B6000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF891E000 \SystemRoot\System32\Drivers\BTHUSB.sys
0xF270E000 \SystemRoot\System32\Drivers\bthport.sys
0xF7BB3000 \SystemRoot\System32\DRIVERS\mouhid.sys
0xF26F6000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF8A86000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF2A01000 \SystemRoot\System32\drivers\Dxapi.sys
0xF8936000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF8C46000 \SystemRoot\System32\drivers\dxgthk.sys
0xF86F6000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0xF87D6000 \SystemRoot\system32\DRIVERS\BthEnum.sys
0xF26DD000 \SystemRoot\system32\DRIVERS\bthpan.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBF3CB000 \SystemRoot\System32\ATMFD.DLL
0xF235C000 \??\C:\Program Files\Norman\Nse\bin\NDISKIO.SYS
0xF2245000 \SystemRoot\system32\DRIVERS\WudfPf.sys
0xF27F9000 \SystemRoot\system32\DRIVERS\fssfltr_tdi.sys
0xF223D000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xF1FB0000 \SystemRoot\system32\drivers\wdmaud.sys
0xF2115000 \SystemRoot\system32\drivers\sysaudio.sys
0xF1DA5000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xF8ACC000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xF1CAD000 \SystemRoot\System32\DRIVERS\srv.sys
0xF2135000 \??\C:\Program Files\Norman\Ngs\Bin\nregsec.sys
0xF16A4000 \SystemRoot\System32\Drivers\HTTP.sys
0xF8B24000 \??\C:\Program Files\Norman\Npm\Bin\NmchInjDrv.sys
0xF118B000 \??\C:\DOCUME~1\JANRIJ~1\LOCALS~1\Temp\fxtdypog.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 50):
0 System Idle Process
4 System
492 C:\WINDOWS\system32\smss.exe
556 C:\WINDOWS\system32\csrss.exe
636 C:\WINDOWS\system32\winlogon.exe
680 C:\WINDOWS\system32\services.exe
692 C:\WINDOWS\system32\lsass.exe
844 C:\Program Files\Norman\Npm\Bin\elogsvc.exe
856 C:\Program Files\Norman\ngs\bin\nnf.exe
876 C:\Program Files\Norman\ngs\bin\nprosec.exe
952 C:\WINDOWS\system32\svchost.exe
1000 C:\WINDOWS\system32\svchost.exe
1092 C:\WINDOWS\system32\svchost.exe
1132 C:\WINDOWS\system32\svchost.exe
1224 C:\Program Files\Norman\Npm\Bin\Zanda.exe
1252 C:\Program Files\Norman\Npm\Bin\nvoy.exe
1320 C:\WINDOWS\system32\svchost.exe
1384 C:\WINDOWS\system32\svchost.exe
1488 C:\WINDOWS\system32\spoolsv.exe
1728 C:\WINDOWS\explorer.exe
1756 C:\WINDOWS\system32\ctfmon.exe
1964 C:\Program Files\Norman\Npm\Bin\Zlh.exe
1972 C:\WINDOWS\system32\rundll32.exe
124 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
136 C:\Program Files\Google\Google Talk\googletalk.exe
192 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
204 C:\WINDOWS\system32\svchost.exe
480 C:\WINDOWS\system32\svchost.exe
608 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
696 C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
1592 C:\WINDOWS\system32\IoctlSvc.exe
1664 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
928 C:\WINDOWS\system32\svchost.exe
1620 C:\WINDOWS\system32\searchindexer.exe
2440 C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
2836 C:\WINDOWS\system32\alg.exe
3088 C:\Program Files\Norman\Npm\Bin\scheduler.exe
3108 C:\Program Files\Norman\Npm\Bin\Njeeves.exe
3196 C:\Program Files\Norman\Nse\Bin\Nsesvc.exe
4052 C:\Program Files\Norman\nvc\bin\Nip.exe
3708 C:\Program Files\Windows Live\Contacts\wlcomm.exe
3688 C:\Program Files\Internet Explorer\iexplore.exe
1716 C:\Program Files\Internet Explorer\iexplore.exe
3964 C:\Documents and Settings\Jan Rijken\Bureaublad\sv4tcb8x.exe
2508 C:\WINDOWS\system32\notepad.exe
1836 C:\WINDOWS\system32\wscntfy.exe
220 C:\Program Files\Internet Explorer\iexplore.exe
2052 C:\WINDOWS\system32\searchprotocolhost.exe
1400 C:\WINDOWS\system32\searchfilterhost.exe
2396 C:\Documents and Settings\Jan Rijken\Bureaublad\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000000b`2ea81e00 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000021`27774000 (NTFS)
\\.\H: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: ST3160815A, Rev: 3.AAD
PhysicalDrive1 Model Number: ST3250820A, Rev: 3.AAE

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows 98 MBR code detected
SHA1: 48F01D7E76A0F3C038D08611E3FDC0EE4EF9FD3E
232 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

3 DDS:

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Jan Rijken at 1:12:21,90 on vr 08/04/2011
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.511.95 [GMT 2:00]
.
AV: Norman Security Suite *Disabled/Updated* {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}
.
============== Running Processes ===============
.
C:\Program Files\Norman\Npm\Bin\Elogsvc.exe
C:\Program Files\Norman\Ngs\Bin\Nnf.exe
C:\Program Files\Norman\Ngs\Bin\Nprosec.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Program Files\Norman\npm\bin\nvoy.exe
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norman\Npm\Bin\ZLH.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k bthsvcs
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Norman\Npm\Bin\scheduler.exe
C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
C:\Program Files\Norman\Nse\bin\NSESVC.EXE
C:\Program Files\Norman\Nvc\Bin\Nip.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Jan Rijken\Bureaublad\sv4tcb8x.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Jan Rijken\Bureaublad\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.be/
uURLSearchHooks: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - c:\program files\softonic-eng7\prxtbSof0.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
BHO: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - c:\program files\softonic-eng7\prxtbSof0.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Aanmelden - Help: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - c:\program files\softonic-eng7\prxtbSof0.dll
TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NVMCTRAY.DLL,NvTaskbarInit
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [googletalk] "c:\program files\google\google talk\googletalk.exe" /autostart
uRun: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Norman ZANDA] "c:\program files\norman\npm\bin\ZLH.EXE" /LOAD /SPLASH
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
IE: E&xporteren naar Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/E/3/9/E39C664F-A8E3-4F69-A109-1AE9849204EE/OGAControl.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
============= SERVICES / DRIVERS ===============
.
R1 NGS;Norman General Security Driver;c:\program files\norman\ngs\bin\ngs.sys [2010-8-5 26744]
R1 NPROSEC;Norman Security driver;c:\program files\norman\ngs\bin\nprosec.sys [2010-8-5 74144]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-6-19 54760]
R2 Ndiskio;Ndiskio;c:\program files\norman\nse\bin\Ndiskio.sys [2009-10-16 22880]
R2 NNFSVC;Norman Network Filtering service;c:\program files\norman\ngs\bin\nnf.exe [2010-8-5 223000]
R2 Norman ZANDA;Norman ZANDA;c:\program files\norman\npm\bin\Zanda.exe [2007-12-14 308408]
R2 NPROSECSVC;Norman Security service;c:\program files\norman\ngs\bin\nprosec.exe [2010-8-5 90656]
R2 nregsec;Norman Registry Security driver;c:\program files\norman\ngs\bin\nregsec.sys [2010-8-5 40384]
R2 NVOY;Norman Resource Provider;c:\program files\norman\npm\bin\nvoy.exe [2009-6-15 98776]
R3 ham50;Creatix V.90 HAM Data Fax Modem;c:\windows\system32\drivers\CTXH51.sys [2001-11-7 454815]
R3 nsesvc;Norman Scanner Engine Service;c:\program files\norman\nse\bin\Nsesvc.exe [2011-1-5 288072]
R3 Scheduler;Norman Scheduler Service;c:\program files\norman\npm\bin\scheduler.exe [2009-6-17 133272]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-17 135664]
S3 fsssvc;De service Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872]
S3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [2009-6-15 24176]
S3 nvcoas;Norman Virus Control on-access component;c:\program files\norman\nvc\bin\Nvcoas.exe [2010-8-30 210248]
S3 NVCScheduler;Norman Virus Control Scheduler; "c:\program files\norman\npm\bin\nvcsched.exe" --> c:\program files\norman\npm\bin\NVCSCHED.EXE [?]
.
=============== Created Last 30 ================
.
2011-04-05 10:36:18 -------- d-----w- C:\ComboFix
2011-04-02 17:47:22 -------- d-----w- c:\docume~1\janrij~1\applic~1\SUPERAntiSpyware.com
2011-04-02 13:13:24 -------- d--h--r- c:\documents and settings\jan rijken\Onlangs geopend
2011-04-01 18:22:19 -------- d-----w- c:\docume~1\janrij~1\locals~1\applic~1\Conduit
2011-04-01 18:22:18 -------- d-----w- c:\program files\Conduit
2011-04-01 18:22:17 -------- d-----w- c:\docume~1\janrij~1\locals~1\applic~1\Softonic-Eng7
2011-04-01 18:22:15 -------- d-----w- c:\docume~1\janrij~1\locals~1\applic~1\ConduitEngine
2011-04-01 18:22:14 -------- d-----w- c:\program files\ConduitEngine
2011-04-01 18:22:10 -------- d-----w- c:\program files\Softonic-Eng7
2011-04-01 18:22:02 -------- d-----w- c:\program files\SequoiaView
.
==================== Find3M ====================
.
2011-02-09 13:54:04 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:54:04 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58:57 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44:07 441344 ----a-w- c:\windows\system32\shimgvw.dll
.
============= FINISH: 1:13:56,35 ===============

4 attach:


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 28/08/2007 21:48:44
System Uptime: 8/04/2011 0:38:37 (1 hours ago)
.
Motherboard: MICRO-STAR INTERNATIONAL CO., LTD | | MS-6399
Processor: Intel(R) Pentium(R) 4 CPU 1.80GHz | Socket 478 | 1800/100mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 45 GiB total, 28,941 GiB free.
D: is FIXED (NTFS) - 88 GiB total, 70,827 GiB free.
E: is FIXED (NTFS) - 16 GiB total, 14,748 GiB free.
F: is CDROM ()
G: is CDROM ()
H: is FIXED (NTFS) - 233 GiB total, 215,533 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description: CMI8738/C3DX PCI Audio Device
Device ID: PCI\VEN_13F6&DEV_0111&SUBSYS_39901462&REV_10\4&172A2BDD&0&38F0
Manufacturer: C-Media
Name: CMI8738/C3DX PCI Audio Device
PNP Device ID: PCI\VEN_13F6&DEV_0111&SUBSYS_39901462&REV_10\4&172A2BDD&0&38F0
Service:
.
Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia E51
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: Nokia E51
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd
.
==== System Restore Points ===================
.
RP312: 1/03/2011 19:58:17 - Software Distribution Service 3.0
RP313: 1/03/2011 19:58:17 - Software Distribution Service 3.0
RP314: 1/03/2011 19:58:17 - Software Distribution Service 3.0
RP315: 1/03/2011 19:58:17 - Software Distribution Service 3.0
RP316: 1/03/2011 19:58:17 - Software Distribution Service 3.0
RP317: 1/03/2011 19:58:17 - Software Distribution Service 3.0
RP318: 1/03/2011 19:58:17 - Software Distribution Service 3.0
RP319: 1/03/2011 19:58:16 - DirectX is geïnstalleerd.
RP320: 1/03/2011 19:58:16 - Software Distribution Service 3.0
RP321: 1/03/2011 19:58:16 - Software Distribution Service 3.0
RP322: 1/03/2011 19:58:16 - Software Distribution Service 3.0
RP323: 1/03/2011 19:58:16 - Software Distribution Service 3.0
RP324: 1/03/2011 19:58:16 - Software Distribution Service 3.0
RP325: 1/03/2011 19:58:16 - Software Distribution Service 3.0
RP326: 1/03/2011 19:58:16 - Software Distribution Service 3.0
RP327: 1/03/2011 19:58:16 - Software Distribution Service 3.0
RP328: 1/03/2011 19:58:15 - Software Distribution Service 3.0
RP329: 1/03/2011 19:58:15 - Software Distribution Service 3.0
RP330: 1/03/2011 19:58:15 - Software Distribution Service 3.0
RP331: 1/03/2011 19:58:15 - Software Distribution Service 3.0
RP332: 1/03/2011 19:58:15 - Software Distribution Service 3.0
RP333: 30/01/2011 22:00:11 - Controlepunt van systeem
RP334: 2/02/2011 0:19:57 - Software Distribution Service 3.0
RP335: 3/02/2011 19:57:52 - Software Distribution Service 3.0
RP336: 7/02/2011 21:35:59 - Software Distribution Service 3.0
RP337: 9/02/2011 21:10:25 - Software Distribution Service 3.0
RP338: 10/02/2011 0:35:36 - Software Distribution Service 3.0
RP339: 10/02/2011 20:02:41 - Software Distribution Service 3.0
RP340: 12/02/2011 13:22:20 - Software Distribution Service 3.0
RP341: 12/02/2011 20:04:58 - Software Distribution Service 3.0
RP342: 13/02/2011 20:15:44 - Software Distribution Service 3.0
RP343: 14/02/2011 20:03:14 - Software Distribution Service 3.0
RP344: 15/02/2011 20:03:04 - Software Distribution Service 3.0
RP345: 16/02/2011 20:05:33 - Software Distribution Service 3.0
RP346: 17/02/2011 22:11:51 - Software Distribution Service 3.0
RP347: 21/02/2011 21:53:32 - Software Distribution Service 3.0
RP348: 22/02/2011 21:57:08 - Software Distribution Service 3.0
RP349: 24/02/2011 10:43:22 - Software Distribution Service 3.0
RP350: 24/02/2011 11:56:55 - Software Distribution Service 3.0
RP351: 25/02/2011 20:03:06 - Software Distribution Service 3.0
RP352: 26/02/2011 20:13:22 - Software Distribution Service 3.0
RP353: 1/03/2011 7:27:32 - Software Distribution Service 3.0
RP354: 1/03/2011 20:02:47 - Software Distribution Service 3.0
RP355: 4/03/2011 23:09:30 - Software Distribution Service 3.0
RP356: 5/03/2011 20:03:16 - Software Distribution Service 3.0
RP357: 6/03/2011 20:03:03 - Software Distribution Service 3.0
RP358: 7/03/2011 20:05:46 - Software Distribution Service 3.0
RP359: 8/03/2011 0:45:32 - Installed HiJackThis
RP360: 8/03/2011 20:08:28 - Software Distribution Service 3.0
RP361: 9/03/2011 22:11:55 - Controlepunt van systeem
RP362: 10/03/2011 23:02:29 - Software Distribution Service 3.0
RP363: 13/03/2011 20:05:41 - Software Distribution Service 3.0
RP364: 15/03/2011 20:03:43 - Software Distribution Service 3.0
RP365: 15/03/2011 21:25:44 - Software Distribution Service 3.0
RP366: 15/03/2011 21:58:42 - Software Distribution Service 3.0
RP367: 16/03/2011 20:06:18 - Software Distribution Service 3.0
RP368: 17/03/2011 20:03:16 - Software Distribution Service 3.0
RP369: 19/03/2011 9:46:58 - Software Distribution Service 3.0
RP370: 19/03/2011 20:07:00 - Software Distribution Service 3.0
RP371: 20/03/2011 20:03:28 - Software Distribution Service 3.0
RP372: 21/03/2011 20:05:27 - Software Distribution Service 3.0
RP373: 22/03/2011 20:10:13 - Software Distribution Service 3.0
RP374: 23/03/2011 20:06:06 - Software Distribution Service 3.0
RP375: 23/03/2011 21:03:54 - Software Distribution Service 3.0
RP376: 25/03/2011 21:44:04 - Controlepunt van systeem
RP377: 26/03/2011 13:32:34 - Software Distribution Service 3.0
RP378: 26/03/2011 20:03:25 - Software Distribution Service 3.0
RP379: 27/03/2011 22:17:23 - Controlepunt van systeem
RP380: 29/03/2011 0:27:27 - Software Distribution Service 3.0
RP381: 1/04/2011 19:42:07 - Software Distribution Service 3.0
RP382: 2/04/2011 23:07:06 - Controlepunt van systeem
RP383: 3/04/2011 23:13:39 - Controlepunt van systeem
RP384: 6/04/2011 2:18:55 - Installed Adobe Reader X - Nederlands.
RP385: 7/04/2011 19:59:32 - Controlepunt van systeem
.
==== Installed Programs ======================
.
AAC Decoder
Adobe Flash Player 10 ActiveX
Adobe Reader 9.4.3 - Nederlands
Adobe Reader X - Nederlands
AutoUpdate
Beveiligingsupdate for Windows XP (KB923689)
Beveiligingsupdate for Windows XP (KB941569)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB938127-v2)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB969897)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB2183461)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB2360131)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB2416400)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB2482017)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB971961)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB974455)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB976325)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB978207)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB981332)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB982381)
Beveiligingsupdate voor Windows Media Player (KB2378111)
Beveiligingsupdate voor Windows Media Player (KB911564)
Beveiligingsupdate voor Windows Media Player (KB952069)
Beveiligingsupdate voor Windows Media Player (KB954155)
Beveiligingsupdate voor Windows Media Player (KB968816)
Beveiligingsupdate voor Windows Media Player (KB973540)
Beveiligingsupdate voor Windows Media Player (KB975558)
Beveiligingsupdate voor Windows Media Player (KB978695)
Beveiligingsupdate voor Windows Media Player 11 (KB936782)
Beveiligingsupdate voor Windows Media Player 11 (KB954154)
Beveiligingsupdate voor Windows Media Player 6.4 (KB925398)
Beveiligingsupdate voor Windows Media Player 9 (KB936782)
Beveiligingsupdate voor Windows XP (KB2079403)
Beveiligingsupdate voor Windows XP (KB2115168)
Beveiligingsupdate voor Windows XP (KB2121546)
Beveiligingsupdate voor Windows XP (KB2160329)
Beveiligingsupdate voor Windows XP (KB2229593)
Beveiligingsupdate voor Windows XP (KB2259922)
Beveiligingsupdate voor Windows XP (KB2279986)
Beveiligingsupdate voor Windows XP (KB2286198)
Beveiligingsupdate voor Windows XP (KB2296011)
Beveiligingsupdate voor Windows XP (KB2296199)
Beveiligingsupdate voor Windows XP (KB2347290)
Beveiligingsupdate voor Windows XP (KB2360937)
Beveiligingsupdate voor Windows XP (KB2387149)
Beveiligingsupdate voor Windows XP (KB2393802)
Beveiligingsupdate voor Windows XP (KB2419632)
Beveiligingsupdate voor Windows XP (KB2423089)
Beveiligingsupdate voor Windows XP (KB2436673)
Beveiligingsupdate voor Windows XP (KB2440591)
Beveiligingsupdate voor Windows XP (KB2443105)
Beveiligingsupdate voor Windows XP (KB2476687)
Beveiligingsupdate voor Windows XP (KB2478960)
Beveiligingsupdate voor Windows XP (KB2478971)
Beveiligingsupdate voor Windows XP (KB2479628)
Beveiligingsupdate voor Windows XP (KB2479943)
Beveiligingsupdate voor Windows XP (KB2481109)
Beveiligingsupdate voor Windows XP (KB2483185)
Beveiligingsupdate voor Windows XP (KB2485376)
Beveiligingsupdate voor Windows XP (KB2524375)
Beveiligingsupdate voor Windows XP (KB923561)
Beveiligingsupdate voor Windows XP (KB923789)
Beveiligingsupdate voor Windows XP (KB938464-v2)
Beveiligingsupdate voor Windows XP (KB946648)
Beveiligingsupdate voor Windows XP (KB950760)
Beveiligingsupdate voor Windows XP (KB950762)
Beveiligingsupdate voor Windows XP (KB950974)
Beveiligingsupdate voor Windows XP (KB951066)
Beveiligingsupdate voor Windows XP (KB951376-v2)
Beveiligingsupdate voor Windows XP (KB951748)
Beveiligingsupdate voor Windows XP (KB952004)
Beveiligingsupdate voor Windows XP (KB952954)
Beveiligingsupdate voor Windows XP (KB954459)
Beveiligingsupdate voor Windows XP (KB954600)
Beveiligingsupdate voor Windows XP (KB955069)
Beveiligingsupdate voor Windows XP (KB956572)
Beveiligingsupdate voor Windows XP (KB956744)
Beveiligingsupdate voor Windows XP (KB956802)
Beveiligingsupdate voor Windows XP (KB956803)
Beveiligingsupdate voor Windows XP (KB956844)
Beveiligingsupdate voor Windows XP (KB957097)
Beveiligingsupdate voor Windows XP (KB958644)
Beveiligingsupdate voor Windows XP (KB958687)
Beveiligingsupdate voor Windows XP (KB958869)
Beveiligingsupdate voor Windows XP (KB959426)
Beveiligingsupdate voor Windows XP (KB960225)
Beveiligingsupdate voor Windows XP (KB960803)
Beveiligingsupdate voor Windows XP (KB960859)
Beveiligingsupdate voor Windows XP (KB961371)
Beveiligingsupdate voor Windows XP (KB961373)
Beveiligingsupdate voor Windows XP (KB961501)
Beveiligingsupdate voor Windows XP (KB968537)
Beveiligingsupdate voor Windows XP (KB969059)
Beveiligingsupdate voor Windows XP (KB969898)
Beveiligingsupdate voor Windows XP (KB969947)
Beveiligingsupdate voor Windows XP (KB970238)
Beveiligingsupdate voor Windows XP (KB970430)
Beveiligingsupdate voor Windows XP (KB971468)
Beveiligingsupdate voor Windows XP (KB971486)
Beveiligingsupdate voor Windows XP (KB971557)
Beveiligingsupdate voor Windows XP (KB971633)
Beveiligingsupdate voor Windows XP (KB971657)
Beveiligingsupdate voor Windows XP (KB972270)
Beveiligingsupdate voor Windows XP (KB973346)
Beveiligingsupdate voor Windows XP (KB973354)
Beveiligingsupdate voor Windows XP (KB973507)
Beveiligingsupdate voor Windows XP (KB973525)
Beveiligingsupdate voor Windows XP (KB973869)
Beveiligingsupdate voor Windows XP (KB973904)
Beveiligingsupdate voor Windows XP (KB974112)
Beveiligingsupdate voor Windows XP (KB974318)
Beveiligingsupdate voor Windows XP (KB974392)
Beveiligingsupdate voor Windows XP (KB974571)
Beveiligingsupdate voor Windows XP (KB975025)
Beveiligingsupdate voor Windows XP (KB975467)
Beveiligingsupdate voor Windows XP (KB975560)
Beveiligingsupdate voor Windows XP (KB975561)
Beveiligingsupdate voor Windows XP (KB975562)
Beveiligingsupdate voor Windows XP (KB975713)
Beveiligingsupdate voor Windows XP (KB977165)
Beveiligingsupdate voor Windows XP (KB977816)
Beveiligingsupdate voor Windows XP (KB977914)
Beveiligingsupdate voor Windows XP (KB978037)
Beveiligingsupdate voor Windows XP (KB978251)
Beveiligingsupdate voor Windows XP (KB978262)
Beveiligingsupdate voor Windows XP (KB978338)
Beveiligingsupdate voor Windows XP (KB978542)
Beveiligingsupdate voor Windows XP (KB978601)
Beveiligingsupdate voor Windows XP (KB978706)
Beveiligingsupdate voor Windows XP (KB979309)
Beveiligingsupdate voor Windows XP (KB979482)
Beveiligingsupdate voor Windows XP (KB979559)
Beveiligingsupdate voor Windows XP (KB979683)
Beveiligingsupdate voor Windows XP (KB979687)
Beveiligingsupdate voor Windows XP (KB980195)
Beveiligingsupdate voor Windows XP (KB980218)
Beveiligingsupdate voor Windows XP (KB980232)
Beveiligingsupdate voor Windows XP (KB980436)
Beveiligingsupdate voor Windows XP (KB981322)
Beveiligingsupdate voor Windows XP (KB981852)
Beveiligingsupdate voor Windows XP (KB981957)
Beveiligingsupdate voor Windows XP (KB981997)
Beveiligingsupdate voor Windows XP (KB982132)
Beveiligingsupdate voor Windows XP (KB982214)
Beveiligingsupdate voor Windows XP (KB982665)
Beveiligingsupdate voor Windows XP (KB982802)
CCleaner
Conduit Engine
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DVD Decrypter (Remove Only)
DVD Shrink 3.2
DVDFab Platinum 3.0.7.0
Essentiële update voor Windows Media Player 11 (KB959772)
Free Picture Resize Starter 4.5
Google Chrome
Google Earth
Google Talk (remove only)
Google Update Helper
H.264 Decoder
HiJackThis
HijackThis 2.0.2
HiYo
HiYo
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB976002-v5)
Hotfix voor Windows Media Player 11 (KB939683)
Hotfix voor Windows XP (KB2158563)
Hotfix voor Windows XP (KB2443685)
Hotfix voor Windows XP (KB952287)
Hotfix voor Windows XP (KB961118)
Hotfix voor Windows XP (KB970653-v3)
Hotfix voor Windows XP (KB976098-v2)
Hotfix voor Windows XP (KB979306)
Hotfix voor Windows XP (KB981793)
ImgBurn
Junk Mail filter update
KB943729: Update voor Windows XP
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Dutch Language Pack
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - NLD
Microsoft .NET Framework 3.0 Dutch Language Pack
Microsoft .NET Framework 3.0 Nederlands taalpakket
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - NLD
Microsoft .NET Framework 3.5 Language Pack SP1 - nld
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft National Language Support Downlevel APIs
Microsoft Office Live Add-in 1.3
Microsoft Office Outlook Connector
Microsoft Office Professional Editie 2003
Microsoft Search Enhancement Pack
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft User-Mode Driver Framework Feature Pack 1.9
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
MKV Splitter
MSVC80_x86_v2
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB933579)
Nero 8
neroxml
Nokia Connectivity Cable Driver
Nokia PC Suite
Norman Security Suite
NVIDIA Drivers
NVIDIA Windows 2000/XP Display Drivers
Off-linediensten van Home'Bank 4.55
OGA Notifier 2.0.0048.0
Pakket voor de provider van Microsoft Base-smartcardcryptografieservice
PC Connectivity Solution
PCI Audio Driver
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Search 4 - KB963093
Segoe UI
SequoiaView
Softonic-Eng7 Toolbar
Taalpakket voor Microsoft .NET Framework 3.5 SP1 - NL
Uninstall Borinato DVR Client
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update voor Windows Internet Explorer 8 (KB973874)
Update voor Windows Internet Explorer 8 (KB976662)
Update voor Windows Internet Explorer 8 (KB976749)
Update voor Windows Internet Explorer 8 (KB980182)
Update voor Windows XP (KB2141007)
Update voor Windows XP (KB2345886)
Update voor Windows XP (KB2467659)
Update voor Windows XP (KB951978)
Update voor Windows XP (KB955759)
Update voor Windows XP (KB955839)
Update voor Windows XP (KB961503)
Update voor Windows XP (KB967715)
Update voor Windows XP (KB968389)
Update voor Windows XP (KB971029)
Update voor Windows XP (KB971737)
Update voor Windows XP (KB973687)
Update voor Windows XP (KB973815)
VCRedistSetup
WebFldrs XP
Windows-stuurprogrammapakket - Nokia Modem (06/09/2010 4.5)
Windows-stuurprogrammapakket - Nokia Modem (06/09/2010 7.01.0.7)
Windows-stuurprogrammapakket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live - Hulpprogramma voor uploaden
Windows Live aanmeldhulp
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sync
Windows Live Toolbar
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Player 11
Windows Presentation Foundation
Windows Presentation Foundation Language Pack (NLD)
Windows Search 4.0
Windows XP Service Pack 3
WinRAR archiver
XML Paper Specification Shared Components Language Pack 1.0
XML Paper Specification Shared Components Pack 1.0
.
==== End Of File ===========================


GMER will follow, is still running.

 

GMERlog

Thanks for your reply and sorry!
Well when i wanna check my e-mail on hotmail, i have to log in. Before i do that i set my status on invisible. I have my reasons. So i log in and when i see that there is mail, i click on my inbox button. From that moment my status will be visible. I have 3 pc's. So on 2pc's my status automaticly turns into visible. On those i am logged in on 2 locations. 1 on the pc and 1 on the web. I've tried different things: combofix, malwarebytes, superantispyware, hijackthis, ccleaner, on 1 pc i uninstalled windows live essentials 2011 and reinstalled it. But nothing seems to be working. My pc was slowing down. I tried all these to accelerate my pc and to get rid of the spam, spyware or whatever it is. After that i 've run sequoiaview. I deleted all of the installer like i was told. That was working. But the prob with live messenger was still there. I downloaded Hiren's bootcd 13.1 from the net and let it run. I have 1 pc with XP, 1 with vista and 1 pc with windows 7. I choosed the mini windows XP for the one with Windows XP, it would start but didn't keep running. I havent tried the bootcd on the other pc's with vista and Windows 7. So i would like to look for the spam, or is it something else, in the first place, to get rid of it on my 3 pc's. After that i will look for the bootcd.
Thank you for your help!!!

This is the GMER log:


GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-08 07:26:46
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST3160815A rev.3.AAD
Running: sv4tcb8x.exe; Driver: C:\DOCUME~1\JANRIJ~1\LOCALS~1\Temp\fxtdypog.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwCreateEvent [0xF29DE99A]
SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwCreateFile [0xF29DE3B8]
SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwCreateProcess [0xF29DD83E]
SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwCreateProcessEx [0xF29DD86E]
SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwCreateThread [0xF29DD89E]
SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwSetSystemInformation [0xF29DE4C2]
SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwTerminateProcess [0xF29DE0C4]
SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwWriteVirtualMemory [0xF29DE1B6]

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + D8 804E2744 4 Bytes JMP 1F0F19E6
.text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xF81DB340, 0xFFF3F, 0xF8000020]
.text C:\WINDOWS\System32\nv4_disp.dll section is writeable [0xBF012300, 0x234A20, 0xF8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] kernel32.dll!CreateFileA 7C7D1A28 6 Bytes JMP 5F2C0F5A
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 01930001
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] kernel32.dll!CloseHandle 7C7D9BE7 6 Bytes JMP 5F3E0F5A
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] kernel32.dll!FindFirstFileW 7C7DEF81 6 Bytes JMP 5F3B0F5A
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] kernel32.dll!CreateFileW 7C7E0800 6 Bytes JMP 5F290F5A
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] kernel32.dll!FindFirstFileA 7C7E3879 6 Bytes JMP 5F2F0F5A
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] WS2_32.dll!htons 71A32E53 6 Bytes JMP 5F040F5A
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] WS2_32.dll!WSAGetLastError + 2 71A33CD0 4 Bytes [1E, 00, 0B, 5F] {PUSH DS; ADD [EBX], CL; POP EDI}
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] WS2_32.dll!closesocket 71A33E2B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] WS2_32.dll!connect 71A34A07 6 Bytes JMP 5F1A0F5A
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] WS2_32.dll!WSAEventSelect 71A364D9 6 Bytes JMP 5F260F5A
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] WS2_32.dll!WSAAsyncSelect 71A40991 6 Bytes JMP 5F230F5A
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] WS2_32.dll!WSAConnect 71A40C81 6 Bytes JMP 5F200F5A
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] WS2_32.dll!WSAAccept 71A40DC1 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[124] WS2_32.dll!accept 71A41040 6 Bytes JMP 5F170F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[136] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 02430001
.text C:\Program Files\Google\Google Talk\googletalk.exe[136] WS2_32.dll!htons 71A32E53 6 Bytes JMP 5F040F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[136] WS2_32.dll!WSAGetLastError + 2 71A33CD0 4 Bytes [1E, 00, 0B, 5F] {PUSH DS; ADD [EBX], CL; POP EDI}
.text C:\Program Files\Google\Google Talk\googletalk.exe[136] WS2_32.dll!closesocket 71A33E2B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[136] WS2_32.dll!connect 71A34A07 6 Bytes JMP 5F130F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[136] WS2_32.dll!WSAEventSelect 71A364D9 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[136] WS2_32.dll!WSAAsyncSelect 71A40991 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[136] WS2_32.dll!WSAConnect 71A40C81 6 Bytes JMP 5F190F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[136] WS2_32.dll!WSAAccept 71A40DC1 6 Bytes JMP 5F160F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[136] WS2_32.dll!accept 71A41040 6 Bytes JMP 5F100F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[192] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 03760001
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[192] WS2_32.dll!htons 71A32E53 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[192] WS2_32.dll!WSAGetLastError + 2 71A33CD0 4 Bytes [1E, 00, 0B, 5F] {PUSH DS; ADD [EBX], CL; POP EDI}
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[192] WS2_32.dll!closesocket 71A33E2B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[192] WS2_32.dll!connect 71A34A07 6 Bytes JMP 5F130F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[192] WS2_32.dll!WSAEventSelect 71A364D9 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[192] WS2_32.dll!WSAAsyncSelect 71A40991 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[192] WS2_32.dll!WSAConnect 71A40C81 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[192] WS2_32.dll!WSAAccept 71A40DC1 6 Bytes JMP 5F160F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[192] WS2_32.dll!accept 71A41040 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\system32\SearchIndexer.exe[1620] kernel32.dll!WriteFile 7C7E0E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!CreateDialogParamW 7E39EA3B 5 Bytes JMP 01F507E0 C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!DialogBoxParamW 7E3A47AB 5 Bytes JMP 01F50B40 C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 41659B15 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!CallNextHookEx 7E3AB3C6 5 Bytes JMP 4164D16D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!CreateWindowExW 7E3AD0A3 5 Bytes JMP 4165DB6C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 415C4666 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!DialogBoxIndirectParamW 7E3B2072 5 Bytes JMP 4175502F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!MessageBoxIndirectA 7E3BA082 5 Bytes JMP 41754F61 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!DialogBoxParamA 7E3BB144 5 Bytes JMP 01F50A50 C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!CreateDialogParamA 7E3BC7DB 5 Bytes JMP 01F50960 C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!MessageBoxA 7E3D07EA 5 Bytes JMP 01F50CC0 C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!MessageBoxExW 7E3D0838 5 Bytes JMP 41754E32 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!MessageBoxExA 7E3D085C 5 Bytes JMP 41754E94 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!DialogBoxIndirectParamA 7E3D6D7D 5 Bytes JMP 41755092 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!TrackPopupMenu 7E3E531E 5 Bytes JMP 01F4FAC0 C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!MessageBoxIndirectW 7E3E64D5 5 Bytes JMP 41754EF6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!MessageBoxW 7E3E6534 5 Bytes JMP 01F50DA0 C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] USER32.dll!TrackPopupMenuEx 7E3ECF62 5 Bytes JMP 01F4FC20 C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] ole32.dll!CoCreateInstance 774BF1AC 5 Bytes JMP 4165DBC8 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] ole32.dll!OleLoadFromStream 774E981B 5 Bytes JMP 417553B0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\WINDOWS\system32\ctfmon.exe[1756] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00C30001
.text C:\WINDOWS\system32\wscntfy.exe[1836] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00900001
.text C:\WINDOWS\system32\wscntfy.exe[1836] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\WINDOWS\system32\rundll32.exe[1972] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00DD0001
.text C:\WINDOWS\system32\NOTEPAD.EXE[2508] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00A00001
.text C:\WINDOWS\system32\NOTEPAD.EXE[2508] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3688] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3688] USER32.dll!DialogBoxParamW 7E3A47AB 5 Bytes JMP 41585501 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3688] USER32.dll!CreateWindowExW 7E3AD0A3 5 Bytes JMP 4165DB6C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3688] USER32.dll!DialogBoxIndirectParamW 7E3B2072 5 Bytes JMP 4175502F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3688] USER32.dll!MessageBoxIndirectA 7E3BA082 5 Bytes JMP 41754F61 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3688] USER32.dll!DialogBoxParamA 7E3BB144 5 Bytes JMP 41754FCC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3688] USER32.dll!MessageBoxExW 7E3D0838 5 Bytes JMP 41754E32 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3688] USER32.dll!MessageBoxExA 7E3D085C 5 Bytes JMP 41754E94 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3688] USER32.dll!DialogBoxIndirectParamA 7E3D6D7D 5 Bytes JMP 41755092 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3688] USER32.dll!MessageBoxIndirectW 7E3E64D5 5 Bytes JMP 41754EF6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[3708] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 003F0001
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[3708] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[3708] WS2_32.dll!htons 71A32E53 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[3708] WS2_32.dll!WSAGetLastError + 2 71A33CD0 4 Bytes [1E, 00, 08, 5F] {PUSH DS; ADD [EAX], CL; POP EDI}
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[3708] WS2_32.dll!closesocket 71A33E2B 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[3708] WS2_32.dll!connect 71A34A07 6 Bytes JMP 5F100F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[3708] WS2_32.dll!WSAEventSelect 71A364D9 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[3708] WS2_32.dll!WSAAsyncSelect 71A40991 6 Bytes JMP 5F190F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[3708] WS2_32.dll!WSAConnect 71A40C81 6 Bytes JMP 5F160F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[3708] WS2_32.dll!WSAAccept 71A40DC1 6 Bytes JMP 5F130F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[3708] WS2_32.dll!accept 71A41040 6 Bytes JMP 5F0D0F5A
.text C:\Documents and Settings\Jan Rijken\Bureaublad\sv4tcb8x.exe[3964] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 003D0001
.text C:\Documents and Settings\Jan Rijken\Bureaublad\sv4tcb8x.exe[3964] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[1716] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)

Device \Driver\BTHUSB \Device\0000006d bthport.sys (Stuurprogramma voor Bluetooth-bus/Microsoft Corporation)
Device \Driver\BTHUSB \Device\0000006f bthport.sys (Stuurprogramma voor Bluetooth-bus/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a3a57aae7
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a3a57aae7@001d6eb6c5f9 0xFE 0x58 0x6F 0xCA ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a3a57aae7 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a3a57aae7@001d6eb6c5f9 0xFE 0x58 0x6F 0xCA ...

---- EOF - GMER 1.0.15 ----

 

log combofix

ComboFix 11-04-07.08 - Jan Rijken 08/04/2011 22:09:33.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.511.292 [GMT 2:00]
Gestart vanuit: c:\documents and settings\Jan Rijken\Bureaublad\ComboFix.exe
AV: Norman Security Suite *Disabled/Updated* {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}
.
.
(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Jan Rijken\Application Data\PriceGong
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\i.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\J.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Jan Rijken\Application Data\PriceGong\Data\z.xml
.
.
(((((((((((((((((((( Bestanden Gemaakt van 2011-03-08 to 2011-04-08 ))))))))))))))))))))))))))))))
.
.
2011-04-02 17:47 . 2011-04-02 17:48 -------- d-----w- c:\documents and settings\Jan Rijken\Application Data\SUPERAntiSpyware.com
2011-04-02 13:13 . 2011-04-08 05:27 -------- d--h--r- c:\documents and settings\Jan Rijken\Onlangs geopend
2011-04-01 18:22 . 2011-04-01 18:57 -------- d-----w- c:\documents and settings\Jan Rijken\Local Settings\Application Data\Conduit
2011-04-01 18:22 . 2011-04-01 18:22 -------- d-----w- c:\program files\Conduit
2011-04-01 18:22 . 2011-04-08 19:05 -------- d-----w- c:\documents and settings\Jan Rijken\Local Settings\Application Data\Softonic-Eng7
2011-04-01 18:22 . 2011-04-01 18:58 -------- d-----w- c:\program files\Softonic-Eng7
2011-04-01 18:22 . 2011-04-01 18:22 -------- d-----w- c:\program files\SequoiaView
2011-04-01 18:06 . 2011-04-01 18:08 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
.
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-07 23:45 . 2011-03-07 23:45 388096 ----a-r- c:\documents and settings\Jan Rijken\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-02-09 13:54 . 2002-09-11 12:00 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:54 . 2002-09-11 12:00 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2007-08-28 19:39 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2007-08-28 19:39 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2002-09-11 12:00 441344 ----a-w- c:\windows\system32\shimgvw.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-04-02_13.51.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-09-11 12:00 . 2011-04-07 22:44 72604 c:\windows\system32\perfc009.dat
- 2002-09-11 12:00 . 2011-04-02 07:27 72604 c:\windows\system32\perfc009.dat
+ 2009-06-17 21:26 . 2010-12-20 16:09 38224 c:\windows\system32\drivers\mbamswissarmy.sys
+ 2009-06-17 21:26 . 2010-12-20 16:08 20952 c:\windows\system32\drivers\mbam.sys
+ 2002-09-11 12:00 . 2011-04-07 22:44 537320 c:\windows\system32\perfh013.dat
- 2002-09-11 12:00 . 2011-04-02 07:27 537320 c:\windows\system32\perfh013.dat
+ 2002-09-11 12:00 . 2011-04-07 22:44 444346 c:\windows\system32\perfh009.dat
- 2002-09-11 12:00 . 2011-04-02 07:27 444346 c:\windows\system32\perfh009.dat
- 2002-09-11 12:00 . 2011-04-02 07:27 101954 c:\windows\system32\perfc013.dat
+ 2002-09-11 12:00 . 2011-04-07 22:44 101954 c:\windows\system32\perfc013.dat
+ 2011-04-06 00:20 . 2011-04-06 00:20 2295808 c:\windows\Installer\3043bd4.msi
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} "= "c:\program files\Softonic-Eng7\prxtbSof0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]
2011-01-17 14:54 175912 ----a-w- c:\program files\Softonic-Eng7\prxtbSof0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} "= "c:\program files\Softonic-Eng7\prxtbSof0.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D} "= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} "= "c:\program files\Softonic-Eng7\prxtbSof0.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D} "= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter "= "c:\windows\system32\NVMCTRAY.DLL" [2003-07-28 49152]
"MsnMsgr "= "c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2010-04-16 3872080]
"googletalk "= "c:\program files\Google\Google Talk\googletalk.exe" [2007-11-21 3293184]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]
"nwiz "= "nwiz.exe" [2003-07-28 323584]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2003-07-28 49152]
"Norman ZANDA "= "c:\program files\Norman\Npm\Bin\ZLH.EXE" [2011-03-22 189824]
"BluetoothAuthenticationAgent "= "bthprops.cpl" [2008-04-14 110592]
"NeroFilterCheck "= "c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan "= "c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-15 35736]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@= "Service "
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
2002-10-15 16:00 1818624 ----a-w- c:\windows\mixer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
2010-06-16 07:17 753664 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2010-05-14 08:32 1479680 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
"c:\\networkdvr\\remote.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe "=
.
R1 NGS;Norman General Security Driver;c:\program files\Norman\ngs\bin\ngs.sys [5/08/2010 12:21 26744]
R1 NPROSEC;Norman Security driver;c:\program files\Norman\ngs\bin\nprosec.sys [5/08/2010 12:21 74144]
R2 Ndiskio;Ndiskio;c:\program files\Norman\Nse\Bin\Ndiskio.sys [16/10/2009 21:04 22880]
R2 NNFSVC;Norman Network Filtering service;c:\program files\Norman\ngs\bin\nnf.exe [5/08/2010 12:21 223000]
R2 NPROSECSVC;Norman Security service;c:\program files\Norman\ngs\bin\nprosec.exe [5/08/2010 12:21 90656]
R2 nregsec;Norman Registry Security driver;c:\program files\Norman\ngs\bin\nregsec.sys [5/08/2010 12:21 40384]
R2 NVOY;Norman Resource Provider;c:\program files\Norman\Npm\Bin\nvoy.exe [15/06/2009 22:48 98776]
R3 ham50;Creatix V.90 HAM Data Fax Modem;c:\windows\system32\drivers\CTXH51.sys [7/11/2001 13:47 454815]
R3 nsesvc;Norman Scanner Engine Service;c:\program files\Norman\Nse\Bin\Nsesvc.exe [5/01/2011 21:11 288072]
R3 Scheduler;Norman Scheduler Service;c:\program files\Norman\Npm\Bin\scheduler.exe [17/06/2009 22:21 133272]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [17/01/2010 19:59 135664]
S3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [15/06/2009 22:47 24176]
S3 nvcoas;Norman Virus Control on-access component;c:\program files\Norman\nvc\bin\Nvcoas.exe [30/08/2010 20:32 210248]
S3 NVCScheduler;Norman Virus Control Scheduler; "c:\program files\Norman\Npm\bin\NVCSCHED.EXE" --> c:\program files\Norman\Npm\bin\NVCSCHED.EXE [?]
.
--- Andere Services/Drivers In Geheugen ---
.
*Deregistered* - mchInjDrv
.
Inhoud van de 'Gedeelde Taken' map
.
2011-04-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 17:59]
.
2011-04-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 17:59]
.
2011-04-08 c:\windows\Tasks\User_Feed_Synchronization-{DB14428F-5D41-4FB7-941C-F5A28B49E3B4}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.be/
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-08 22:27
Windows 5.1.2600 Service Pack 3 NTFS
.
scannen van verborgen processen ...
.
scannen van verborgen autostart items ...
.
scannen van verborgen bestanden ...
.
Scan succesvol afgerond
verborgen bestanden: 0
.
**************************************************************************
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–}|ÿÿÿÿÀ•}|ù•9~*]
"3140110900063D11C8EF10054038389C "= "C?\\WINDOWS\\system32\\FM20ENU.DLL "
.
Voltooingstijd: 2011-04-08 22:30:48
ComboFix-quarantined-files.txt 2011-04-08 20:30
ComboFix2.txt 2011-04-05 10:49
ComboFix3.txt 2011-04-02 13:54
ComboFix4.txt 2010-12-18 11:25
.
Pre-Run: 31.041.318.912 bytes beschikbaar
Post-Run: 31.036.809.216 bytes beschikbaar
.
- - End Of File - - BE9297A0BCB4A9231703E2D9B635A670

 

logs

Hello Broni,
Did you get my logs?
Thank you.

 

otl log

I thought i've already send them, but not. Sorry.
here they are.

OTL logfile created on: 8/04/2011 23:19:31 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Jan Rijken\Bureaublad
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000813 | Country: België | Language: NLB | Date Format: d/MM/yyyy

511,00 Mb Total Physical Memory | 180,00 Mb Available Physical Memory | 35,00% Memory free
994,00 Mb Paging File | 449,00 Mb Available in Paging File | 45,00% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 44,73 Gb Total Space | 28,93 Gb Free Space | 64,67% Space Free | Partition Type: NTFS
Drive D: | 87,89 Gb Total Space | 70,83 Gb Free Space | 80,59% Space Free | Partition Type: NTFS
Drive E: | 16,43 Gb Total Space | 14,75 Gb Free Space | 89,75% Space Free | Partition Type: NTFS
Drive H: | 232,88 Gb Total Space | 215,30 Gb Free Space | 92,45% Space Free | Partition Type: NTFS
Drive I: | 1,86 Gb Total Space | 1,21 Gb Free Space | 65,03% Space Free | Partition Type: FAT

Computer Name: JAN | User Name: Jan Rijken | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/08 23:13:23 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jan Rijken\Bureaublad\OTL.exe
PRC - [2011/03/22 16:15:33 | 000,189,824 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Npm\Bin\Zlh.exe
PRC - [2010/12/17 16:22:48 | 000,288,072 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Nse\Bin\Nsesvc.exe
PRC - [2010/12/02 11:13:55 | 000,308,408 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Npm\Bin\Zanda.exe
PRC - [2010/11/10 14:59:37 | 000,090,656 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\ngs\bin\nprosec.exe
PRC - [2010/11/10 14:48:32 | 000,223,000 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\ngs\bin\nnf.exe
PRC - [2010/03/15 13:14:41 | 000,098,776 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Npm\Bin\nvoy.exe
PRC - [2010/01/28 14:33:08 | 000,169,344 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\nvc\bin\Nip.exe
PRC - [2009/10/15 15:50:54 | 000,133,272 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Npm\Bin\scheduler.exe
PRC - [2009/10/11 15:07:33 | 000,152,904 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Npm\Bin\elogsvc.exe
PRC - [2009/10/07 13:04:51 | 000,129,928 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Npm\Bin\Njeeves.exe
PRC - [2008/06/24 16:06:06 | 001,840,424 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
PRC - [2008/04/14 19:02:58 | 001,037,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/11/21 04:15:08 | 003,293,184 | ---- | M] (Google) -- C:\Program Files\Google\Google Talk\googletalk.exe


========== Modules (SafeList) ==========

MOD - [2011/04/08 23:13:23 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jan Rijken\Bureaublad\OTL.exe
MOD - [2010/08/23 18:13:25 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2009/10/11 15:11:19 | 000,267,656 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\nvc\bin\Niphk.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (NVCScheduler)
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2010/12/17 16:22:48 | 000,288,072 | ---- | M] (Norman ASA) [On_Demand | Running] -- C:\Program Files\Norman\Nse\bin\NSESVC.EXE -- (nsesvc)
SRV - [2010/12/02 11:13:55 | 000,308,408 | ---- | M] (Norman ASA) [Auto | Running] -- C:\Program Files\Norman\Npm\Bin\Zanda.exe -- (Norman ZANDA)
SRV - [2010/11/10 14:59:37 | 000,090,656 | ---- | M] (Norman ASA) [Auto | Running] -- C:\Program Files\Norman\Ngs\Bin\Nprosec.exe -- (NPROSECSVC)
SRV - [2010/11/10 14:48:32 | 000,223,000 | ---- | M] (Norman ASA) [Auto | Running] -- C:\Program Files\Norman\Ngs\Bin\Nnf.exe -- (NNFSVC)
SRV - [2010/08/12 13:44:29 | 000,210,248 | ---- | M] (Norman ASA) [On_Demand | Stopped] -- C:\Program Files\Norman\Nvc\bin\nvcoas.exe -- (nvcoas)
SRV - [2010/06/14 15:07:14 | 000,615,936 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010/03/15 13:14:41 | 000,098,776 | ---- | M] (Norman ASA) [Auto | Running] -- C:\Program Files\Norman\npm\bin\nvoy.exe -- (NVOY)
SRV - [2009/10/15 15:50:54 | 000,133,272 | ---- | M] (Norman ASA) [On_Demand | Running] -- C:\Program Files\Norman\Npm\Bin\scheduler.exe -- (Scheduler)
SRV - [2009/10/11 15:07:33 | 000,152,904 | ---- | M] (Norman ASA) [Auto | Running] -- C:\Program Files\Norman\Npm\Bin\Elogsvc.exe -- (eLoggerSvc6)
SRV - [2009/10/07 13:04:51 | 000,129,928 | ---- | M] (Norman ASA) [On_Demand | Running] -- C:\Program Files\Norman\Npm\bin\NJEEVES.EXE -- (Norman NJeeves)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
DRV - [2010/11/11 14:01:54 | 000,024,176 | ---- | M] (Norman ASA) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nvcw32mf.sys -- (NvcMFlt)
DRV - [2010/11/10 15:48:11 | 000,040,384 | ---- | M] (Norman ASA) [Kernel | Auto | Running] -- C:\Program Files\Norman\ngs\bin\nregsec.sys -- (nregsec)
DRV - [2010/11/10 15:48:00 | 000,074,144 | ---- | M] (Norman ASA) [Kernel | System | Running] -- C:\Program Files\Norman\ngs\bin\nprosec.sys -- (NPROSEC)
DRV - [2010/04/28 08:44:02 | 000,054,760 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)
DRV - [2010/01/04 14:44:43 | 000,026,744 | ---- | M] (Norman ASA) [Kernel | System | Running] -- c:\Program Files\Norman\ngs\bin\ngs.sys -- (NGS)
DRV - [2009/10/09 13:24:40 | 000,022,880 | ---- | M] (Norman ASA) [Kernel | Auto | Running] -- C:\Program Files\Norman\Nse\Bin\Ndiskio.sys -- (Ndiskio)
DRV - [2008/08/26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/04/13 20:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2004/08/03 22:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) NT-stuurprogramma voor Realtek RTL8139(A/B/C)
DRV - [2001/08/18 00:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)
DRV - [2001/08/04 08:50:08 | 000,454,815 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CTXH51.sys -- (ham50)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-746137067-1500820517-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
IE - HKU\S-1-5-21-746137067-1500820517-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = nl-be
IE - HKU\S-1-5-21-746137067-1500820517-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3E E6 81 DD 34 0D CA 01 [binary data]
IE - HKU\S-1-5-21-746137067-1500820517-839522115-1003\..\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-746137067-1500820517-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



O1 HOSTS File: ([2011/04/08 22:27:14 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Softonic-Eng7 Toolbar) - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic-Eng7 Toolbar) - {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-746137067-1500820517-839522115-1003\..\Toolbar\WebBrowser: (Softonic-Eng7 Toolbar) - {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [Norman ZANDA] C:\Program Files\Norman\Npm\Bin\ZLH.EXE (Norman ASA)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKU\S-1-5-21-746137067-1500820517-839522115-1003..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe (Google)
O4 - HKU\S-1-5-21-746137067-1500820517-839522115-1003..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O4 - HKU\S-1-5-21-746137067-1500820517-839522115-1003..\Run: [NvMediaCenter] C:\WINDOWS\System32\NVMCTRAY.DLL (NVIDIA Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-746137067-1500820517-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-746137067-1500820517-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-746137067-1500820517-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-746137067-1500820517-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/E/3/9/E39C664F-A8E3-4F69-A109-1AE9849204EE/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Mijn huidige introductiepagina) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/08/28 21:45:19 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17746534284132352)

========== Files/Folders - Created Within 30 Days ==========

[2011/04/08 23:13:20 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Jan Rijken\Bureaublad\OTL.exe
[2011/04/08 22:43:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Application Data\PriceGong
[2011/04/08 22:30:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2011/04/08 07:26:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Bureaublad\GMERlogs
[2011/04/08 00:35:38 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Jan Rijken\Bureaublad\TFC.exe
[2011/04/02 19:47:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Application Data\SUPERAntiSpyware.com
[2011/04/02 18:46:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Mijn documenten\Nieuwe map
[2011/04/02 15:13:24 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Jan Rijken\Onlangs geopend
[2011/04/02 14:25:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Mijn documenten\software
[2011/04/01 20:22:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Menu Start\Programma's\SequoiaView
[2011/04/01 20:22:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\Conduit
[2011/04/01 20:22:18 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2011/04/01 20:22:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\Softonic-Eng7
[2011/04/01 20:22:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\ConduitEngine
[2011/04/01 20:22:14 | 000,000,000 | ---D | C] -- C:\Program Files\ConduitEngine
[2011/04/01 20:22:10 | 000,000,000 | ---D | C] -- C:\Program Files\Softonic-Eng7
[2011/04/01 20:22:02 | 000,000,000 | ---D | C] -- C:\Program Files\SequoiaView
[2011/04/01 20:06:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Temp
[2009/06/18 16:24:59 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Jan Rijken\Application Data\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2011/04/08 23:20:00 | 000,000,464 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{DB14428F-5D41-4FB7-941C-F5A28B49E3B4}.job
[2011/04/08 23:13:23 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jan Rijken\Bureaublad\OTL.exe
[2011/04/08 23:06:01 | 000,001,050 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/08 22:27:14 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/04/08 21:56:31 | 004,316,701 | R--- | M] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\ComboFix.exe
[2011/04/08 20:58:42 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/04/08 20:11:00 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/04/08 12:27:44 | 000,001,046 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/08 12:26:04 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/04/08 01:12:08 | 000,625,664 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\dds.scr
[2011/04/08 01:08:24 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\MBRCheck.exe
[2011/04/08 00:47:39 | 000,301,568 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\sv4tcb8x.exe
[2011/04/08 00:44:34 | 000,537,320 | ---- | M] () -- C:\WINDOWS\System32\perfh013.dat
[2011/04/08 00:44:34 | 000,444,346 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/04/08 00:44:34 | 000,101,954 | ---- | M] () -- C:\WINDOWS\System32\perfc013.dat
[2011/04/08 00:44:34 | 000,072,604 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/04/08 00:35:52 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jan Rijken\Bureaublad\TFC.exe
[2011/04/08 00:31:19 | 000,000,794 | ---- | M] () -- C:\Documents and Settings\All Users\Bureaublad\Malwarebytes' Anti-Malware.lnk
[2011/04/06 02:20:06 | 000,001,744 | ---- | M] () -- C:\Documents and Settings\All Users\Bureaublad\Adobe Reader X .lnk
[2011/04/03 20:57:05 | 000,133,632 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\RKUnhookerLE.EXE
[2011/04/02 22:40:23 | 000,001,811 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Live Messenger (2).lnk
[2011/04/02 19:45:16 | 000,001,823 | ---- | M] () -- C:\Documents and Settings\All Users\Bureaublad\Google Chrome.lnk
[2011/04/02 15:49:01 | 000,002,457 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\HiJackThis.lnk
[2011/04/02 15:12:53 | 000,000,692 | ---- | M] () -- C:\Documents and Settings\All Users\Bureaublad\CCleaner.lnk
[2011/04/02 13:28:54 | 000,000,146 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Application Data\default.pls
[2011/04/02 13:28:50 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011/04/02 10:51:06 | 000,006,144 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/01 20:22:24 | 000,000,706 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\SequoiaView.lnk
[2011/04/01 20:21:45 | 000,567,047 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\Sequoia1_3Install.exe
[2011/03/25 20:53:33 | 000,001,739 | ---- | M] () -- C:\Documents and Settings\All Users\Bureaublad\Adobe Reader 9.lnk

========== Files Created - No Company Name ==========

[2011/04/08 21:56:22 | 004,316,701 | R--- | C] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\ComboFix.exe
[2011/04/08 01:12:07 | 000,625,664 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\dds.scr
[2011/04/08 01:08:21 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\MBRCheck.exe
[2011/04/08 00:47:29 | 000,301,568 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\sv4tcb8x.exe
[2011/04/06 02:20:05 | 000,002,315 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programma's\Adobe Reader X .lnk
[2011/04/06 02:20:05 | 000,001,744 | ---- | C] () -- C:\Documents and Settings\All Users\Bureaublad\Adobe Reader X .lnk
[2011/04/03 20:56:58 | 000,133,632 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\RKUnhookerLE.EXE
[2011/04/02 22:40:23 | 000,001,811 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Live Messenger (2).lnk
[2011/04/01 20:22:23 | 000,000,706 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\SequoiaView.lnk
[2011/04/01 20:21:44 | 000,567,047 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\Sequoia1_3Install.exe
[2010/12/18 12:55:40 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/12/18 12:55:40 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/12/18 12:55:40 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/12/18 12:55:40 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/12/18 12:55:40 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/01/17 19:58:23 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009/12/21 22:06:41 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/09/02 22:01:42 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\Dtctrace.dll
[2009/09/01 22:05:26 | 000,006,144 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2009/06/19 10:01:08 | 000,000,030 | ---- | C] () -- C:\WINDOWS\capture.ini
[2009/06/19 10:00:23 | 000,000,413 | ---- | C] () -- C:\WINDOWS\mapping.ini
[2009/06/19 09:59:56 | 000,001,145 | ---- | C] () -- C:\WINDOWS\addrbook.ini
[2009/06/19 09:59:27 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\uninst.exe
[2009/06/19 09:59:27 | 000,000,102 | ---- | C] () -- C:\WINDOWS\dvr2.ini
[2009/06/18 17:28:01 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2009/06/18 17:07:45 | 000,000,146 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Application Data\default.pls
[2009/06/18 17:06:44 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/06/18 16:24:59 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Application Data\ezpinst.exe
[2009/06/18 16:24:59 | 000,007,824 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Application Data\pcouffin.cat
[2009/06/18 16:24:59 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Application Data\pcouffin.inf
[2009/06/16 00:25:19 | 000,000,133 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\fusioncache.dat
[2009/06/15 21:57:38 | 000,000,395 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/05/26 22:22:14 | 000,017,438 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2008/05/26 22:22:10 | 000,023,146 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2008/05/26 22:22:06 | 000,016,842 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2008/05/26 21:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 21:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2007/08/29 09:02:57 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2007/08/28 23:23:46 | 000,004,207 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2007/08/28 23:22:33 | 000,248,696 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2007/08/28 22:43:29 | 000,000,025 | ---- | C] () -- C:\WINDOWS\mixerdef.ini
[2007/08/28 22:37:59 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI
[2007/08/28 21:48:52 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2007/08/28 21:41:16 | 000,021,748 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2006/10/22 12:22:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/10/22 12:22:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2006/10/22 12:22:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/10/22 12:22:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006/10/22 12:22:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2006/10/22 12:22:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006/10/22 12:22:00 | 000,212,992 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2004/08/02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003/04/07 13:10:22 | 000,005,443 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/11/19 15:46:20 | 000,039,104 | ---- | C] () -- C:\WINDOWS\cmijack.dat
[2002/11/19 15:43:38 | 000,022,178 | ---- | C] () -- C:\WINDOWS\cmaudio.dat
[2002/09/11 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002/09/11 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2002/09/11 14:00:00 | 000,537,320 | ---- | C] () -- C:\WINDOWS\System32\perfh013.dat
[2002/09/11 14:00:00 | 000,444,346 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2002/09/11 14:00:00 | 000,318,670 | ---- | C] () -- C:\WINDOWS\System32\perfi013.dat
[2002/09/11 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2002/09/11 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2002/09/11 14:00:00 | 000,101,954 | ---- | C] () -- C:\WINDOWS\System32\perfc013.dat
[2002/09/11 14:00:00 | 000,072,604 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2002/09/11 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2002/09/11 14:00:00 | 000,039,178 | ---- | C] () -- C:\WINDOWS\System32\perfd013.dat
[2002/09/11 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2002/09/11 14:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2002/09/11 14:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2002/09/11 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2010/01/21 21:03:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HiYo
[2011/01/26 20:47:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Installations
[2010/09/13 13:04:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Suite
[2011/03/07 23:33:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2011/03/07 23:41:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/06/18 18:17:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\Bidgood Svcs
[2009/08/16 16:03:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\HiYo
[2009/06/18 17:16:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\ImgBurn
[2010/09/13 13:06:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\Nokia
[2010/09/13 13:04:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\PC Suite
[2011/04/08 23:13:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\PriceGong
[2009/06/19 14:38:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\TeamViewer
[2011/03/07 22:14:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\Uniblue
[2009/06/18 16:25:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\Vso
[2009/06/16 00:19:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\Windows Desktop Search
[2009/06/18 23:16:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\Windows Search
[2011/04/08 23:20:00 | 000,000,464 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{DB14428F-5D41-4FB7-941C-F5A28B49E3B4}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2007/08/28 21:45:19 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2007/08/28 22:18:58 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/12/18 12:58:51 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2002/09/11 14:00:00 | 000,004,952 | RHS- | M] () -- C:\Bootfont.bin
[2004/08/04 00:00:14 | 000,261,936 | RHS- | M] () -- C:\cmldr
[2011/04/08 22:30:49 | 000,014,264 | ---- | M] () -- C:\ComboFix.txt
[2007/08/28 21:45:19 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2007/08/28 21:45:19 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2007/08/28 21:45:19 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2007/08/28 22:11:18 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2009/06/15 22:31:12 | 000,251,712 | RHS- | M] () -- C:\ntldr
[2011/04/08 12:25:59 | 536,870,912 | -HS- | M] () -- C:\pagefile.sys
[2009/06/17 22:17:14 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2009/06/17 22:17:14 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2007/08/28 21:44:41 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 14:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 12:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/04/17 03:11:10 | 000,307,056 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2007/08/28 23:21:18 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2007/08/28 23:21:18 | 000,630,784 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2007/08/28 23:21:18 | 000,413,696 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/08/28 21:59:26 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Application Data\Microsoft\Internet Explorer\Quick Launch\Bureaublad weergeven.scf
[2007/08/28 22:29:18 | 000,000,189 | -HS- | M] () -- C:\Documents and Settings\Jan Rijken\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2010/06/07 21:58:42 | 000,000,130 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Application Data\Microsoft\Internet Explorer\Quick Launch\Hifiketens vergelijken en vind de goedkoopste hifi keten op VERGELIJK.BE.url

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/04/08 23:19:11 | 000,065,536 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/27 15:57:10 | 000,317,952 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/14 19:02:23 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2002/09/11 14:00:00 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2002/08/20 12:32:18 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2002/04/11 12:00:02 | 000,000,898 | ---- | M] () -- C:\Program Files\Messenger\mailtmpl.txt
[2008/05/02 16:05:59 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 19:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/14 19:03:07 | 001,695,232 | -HS- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2002/08/20 15:08:38 | 000,069,663 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgsin.exe
[2002/09/11 14:00:00 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2002/09/11 14:00:00 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2002/09/11 14:00:00 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2002/08/20 12:32:20 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/07/17 11:35:48 | 000,118,265 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 171 bytes -> C:\Documents and Settings\All Users\Application Data\TEMPFC5A2B2
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

< End of report >

 

extras log

This is the extras log:



OTL Extras logfile created on: 8/04/2011 23:19:31 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Jan Rijken\Bureaublad
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000813 | Country: België | Language: NLB | Date Format: d/MM/yyyy

511,00 Mb Total Physical Memory | 180,00 Mb Available Physical Memory | 35,00% Memory free
994,00 Mb Paging File | 449,00 Mb Available in Paging File | 45,00% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 44,73 Gb Total Space | 28,93 Gb Free Space | 64,67% Space Free | Partition Type: NTFS
Drive D: | 87,89 Gb Total Space | 70,83 Gb Free Space | 80,59% Space Free | Partition Type: NTFS
Drive E: | 16,43 Gb Total Space | 14,75 Gb Free Space | 89,75% Space Free | Partition Type: NTFS
Drive H: | 232,88 Gb Total Space | 215,30 Gb Free Space | 92,45% Space Free | Partition Type: NTFS
Drive I: | 1,86 Gb Total Space | 1,21 Gb Free Space | 65,03% Space Free | Partition Type: FAT

Computer Name: JAN | User Name: Jan Rijken | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Google\Google Talk\googletalk.exe" = C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk -- (Google)
"C:\networkdvr\remote.exe" = C:\networkdvr\remote.exe:*:Enabled:remote -- ()


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00E1E235-AB45-4695-A156-073118949ED4}" = HiYo
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{101738D7-D805-37A9-BB91-1F2C351782BF}" = Microsoft .NET Framework 3.5 Language Pack SP1 - nld
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{168F8BAC-A269-48E9-BB7A-A51B594CF6FF}" = Microsoft .NET Framework 1.1 Dutch Language Pack
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1BD6AE96-4742-4498-9D03-9451C7E5A214}" = Windows Live aanmeldhulp
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live - Hulpprogramma voor uploaden
"{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}" = Nokia PC Suite
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2869F5EA-93C3-48E5-80DF-DB696BC84A91}" = Windows Live Mail
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C9413-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35CA031C-D3CD-4A28-8D9B-C71466C4F045}" = Windows Live Writer
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{41DFDD57-21B7-4C48-8C75-FFB35696CA8B}" = Windows Live Toolbar
"{4216D328-0FE8-48B8-85B8-BD300E6F080F}" = Nokia Connectivity Cable Driver
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{64371D22-A18B-436E-863B-2E12DA8042FF}" = Microsoft .NET Framework 3.0 Dutch Language Pack
"{655A0785-CB7A-42C2-A1AE-B3FE1BFB2617}" = Windows Presentation Foundation Language Pack (NLD)
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6FEC9863-5EF2-4A07-9D0B-CA81B47E3F59}" = Windows Live Photo Gallery
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90110413-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Editie 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0413-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9A1027CE-83F6-3CB2-B9BA-9DA38D0907D0}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - NLD
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A36B158D-8E9D-4BD3-8BDA-4B5EDC9C2E8C}" = Norman Security Suite
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1043-7B44-A94000000001}" = Adobe Reader 9.4.3 - Nederlands
"{AC76BA86-7AD7-1043-7B44-AA0000000001}" = Adobe Reader X - Nederlands
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C20C2630-B3A7-44BA-BDD0-31E256AE490E}" = Windows Live Call
"{CAEB2BE8-EF9E-4BFE-8165-3B54B62AF6CF}" = Windows Live Family Safety
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC38A00D-7EED-46CE-9281-D1D97B81F22A}" = Windows Live Messenger
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D6C9AF27-9414-46C8-B9D8-D878BA041033}" = Nero 8
"{E34F703A-1C9D-4B1F-ABBE-D7E8800B860D}" = Windows Live Sync
"{EB5A3E9D-91CF-4C97-B816-72DE0625ACA3}" = Windows Live Essentials
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F73EA8BF-81F5-32AF-8D8A-24F12FD23B79}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - NLD
"34EA302E7F4CBD17A19E33BBCB72363234956D7E" = Windows-stuurprogrammapakket - Nokia Modem (06/09/2010 4.5)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-stuurprogrammapakket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"CCleaner" = CCleaner
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Shrink_is1" = DVD Shrink 3.2
"DVDFab Platinum_is1" = DVDFab Platinum 3.0.7.0
"EEEE705096F837B7907659F100C9FE6DA001970F" = Windows-stuurprogrammapakket - Nokia Modem (06/09/2010 7.01.0.7)
"Google Chrome" = Google Chrome
"HijackThis" = HijackThis 2.0.2
"HiYo" = HiYo
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"ImgBurn" = ImgBurn
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.0 Dutch Language Pack" = Microsoft .NET Framework 3.0 Nederlands taalpakket
"Microsoft .NET Framework 3.5 Language Pack SP1 - nld" = Taalpakket voor Microsoft .NET Framework 3.5 SP1 - NL
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA" = NVIDIA Windows 2000/XP Display Drivers
"NVIDIA Drivers" = NVIDIA Drivers
"Off-linediensten van Home'Bank_is1" = Off-linediensten van Home'Bank 4.55
"PCI Audio Driver" = PCI Audio Driver
"Picture Resize_is1" = Free Picture Resize Starter 4.5
"SequoiaView" = SequoiaView
"Softonic-Eng7 Toolbar" = Softonic-Eng7 Toolbar
"TibetSystem - Uninstall Borinato DVR Client" = Uninstall Borinato DVR Client
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/04/2011 14:07:54 | Computer Name = JAN | Source = MsiInstaller | ID = 1024
Description = Product: Microsoft Office Professional Editie 2003 - Update 'Security
Update for Office 2003 (KB976382): VBE6' kan niet worden geïnstalleerd. Foutcode:
1603. Windows Installer kan logboekbestanden maken om te helpen bij het oplossen
van problemen tijdens het installeren van softwarepakketten. Raadpleeg de volgende
koppeling voor aanwijzingen over het inschakelen van ondersteuning via logboekregistratie:
http://go.microsoft.com/fwlink/?LinkId=23127

Error - 1/04/2011 14:08:24 | Computer Name = JAN | Source = MsiInstaller | ID = 11327
Description = Product: Microsoft Office Professional Editie 2003 -- Fout 1327. Ongeldig
station: R:\

Error - 1/04/2011 14:08:24 | Computer Name = JAN | Source = MsiInstaller | ID = 1024
Description = Product: Microsoft Office Professional Editie 2003 - Update 'Outlook
2003-beveiligingsupdate (KB2293428): OLKINTL' kan niet worden geïnstalleerd. Foutcode:
1603. Windows Installer kan logboekbestanden maken om te helpen bij het oplossen
van problemen tijdens het installeren van softwarepakketten. Raadpleeg de volgende
koppeling voor aanwijzingen over het inschakelen van ondersteuning via logboekregistratie:
http://go.microsoft.com/fwlink/?LinkId=23127

Error - 1/04/2011 14:31:17 | Computer Name = JAN | Source = Application Hang | ID = 1002
Description = Vastgelopen toepassing: msnmsgr.exe, versie: 14.0.8117.416, vastgelopen
module: hungapp, versie: 0.0.0.0, vastgelopen op: 0x00000000.

Error - 2/04/2011 4:57:05 | Computer Name = JAN | Source = Application Error | ID = 1000
Description = Vastgelopen toepassing: nero.exe, versie: 8.3.6.0, vastgelopen module:
msvcr80.dll, versie: 8.0.50727.4053, vastgelopen op: 0x0000f880.

Error - 2/04/2011 8:29:28 | Computer Name = JAN | Source = Application Hang | ID = 1002
Description = Vastgelopen toepassing: explorer.exe, versie: 6.0.2900.5512, vastgelopen
module: hungapp, versie: 0.0.0.0, vastgelopen op: 0x00000000.

Error - 2/04/2011 11:20:31 | Computer Name = JAN | Source = Application Hang | ID = 1002
Description = Vastgelopen toepassing: iexplore.exe, versie: 8.0.6001.18702, vastgelopen
module: hungapp, versie: 0.0.0.0, vastgelopen op: 0x00000000.

Error - 2/04/2011 11:22:03 | Computer Name = JAN | Source = Application Hang | ID = 1002
Description = Vastgelopen toepassing: iexplore.exe, versie: 8.0.6001.18702, vastgelopen
module: hungapp, versie: 0.0.0.0, vastgelopen op: 0x00000000.

Error - 6/04/2011 6:54:47 | Computer Name = JAN | Source = crypt32 | ID = 131083
Description = Het uitpakken van een basislijst uit de cab voor automatische updates
is mislukt op <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
met de fout: Een vereist certificaat valt niet binnen de geldigheidsperiode als
gekeken wordt naar de huidige systeemklok of de tijdstempel in het ondertekende
bestand.

Error - 6/04/2011 6:54:47 | Computer Name = JAN | Source = crypt32 | ID = 131083
Description = Het uitpakken van een basislijst uit de cab voor automatische updates
is mislukt op <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
met de fout: Een vereist certificaat valt niet binnen de geldigheidsperiode als
gekeken wordt naar de huidige systeemklok of de tijdstempel in het ondertekende
bestand.

[ System Events ]
Error - 7/04/2011 18:36:49 | Computer Name = JAN | Source = Service Control Manager | ID = 7031
Description = De Norman ZANDA-service is onverwacht gestopt. Dit is 1 keer gebeurd.
De volgende herstelbewerking zal over 900000 milliseconden worden uitgevoerd: Service
opnieuw starten.

Error - 7/04/2011 18:36:49 | Computer Name = JAN | Source = Service Control Manager | ID = 7031
Description = De Norman Resource Provider-service is onverwacht gestopt. Dit is
1 keer gebeurd. De volgende herstelbewerking zal over 0 milliseconden worden uitgevoerd:
Service opnieuw starten.

Error - 7/04/2011 18:36:50 | Computer Name = JAN | Source = Service Control Manager | ID = 7034
Description = De Nero BackItUp Scheduler 3-service is onverwacht beëindigd. Dit
is nu 1 keer gebeurd.

Error - 7/04/2011 18:36:50 | Computer Name = JAN | Source = Service Control Manager | ID = 7034
Description = De PLFlash DeviceIoControl Service-service is onverwacht beëindigd.
Dit is nu 1 keer gebeurd.

Error - 7/04/2011 18:36:51 | Computer Name = JAN | Source = Service Control Manager | ID = 7034
Description = De SeaPort-service is onverwacht beëindigd. Dit is nu 1 keer gebeurd.

Error - 7/04/2011 18:36:51 | Computer Name = JAN | Source = Service Control Manager | ID = 7034
Description = De NMIndexingService-service is onverwacht beëindigd. Dit is nu 1
keer gebeurd.

Error - 7/04/2011 18:36:51 | Computer Name = JAN | Source = Service Control Manager | ID = 7034
Description = De Norman Scheduler Service-service is onverwacht beëindigd. Dit is
nu 1 keer gebeurd.

Error - 7/04/2011 18:36:51 | Computer Name = JAN | Source = Service Control Manager | ID = 7034
Description = De Norman NJeeves-service is onverwacht beëindigd. Dit is nu 1 keer
gebeurd.

Error - 7/04/2011 18:36:52 | Computer Name = JAN | Source = Service Control Manager | ID = 7034
Description = De Norman Virus Control on-access component-service is onverwacht
beëindigd. Dit is nu 1 keer gebeurd.

Error - 7/04/2011 19:01:26 | Computer Name = JAN | Source = atapi | ID = 262153
Description = Het apparaat \Device\Ide\IdePort0 heeft niet binnen de tijd voor time-out
gereageerd.


< End of report >


Thank you!

 

otllog

All processes killed
========== OTL ==========
Starting removal of ActiveX control {7530BFB8-7293-4D34-9923-61A11451AFC5}
C:\WINDOWS\Downloaded Program Files\OnlineScanner.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
File Animation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab not found.
Starting removal of ActiveX control DirectAnimation Java Classes
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DirectAnimation Java Classes\ not found.
C:\Documents and Settings\Jan Rijken\Application Data\PriceGong\Data folder moved successfully.
C:\Documents and Settings\Jan Rijken\Application Data\PriceGong folder moved successfully.
C:\Documents and Settings\Jan Rijken\Application Data\Uniblue\RegistryBooster\_temp folder moved successfully.
C:\Documents and Settings\Jan Rijken\Application Data\Uniblue\RegistryBooster\history folder moved successfully.
C:\Documents and Settings\Jan Rijken\Application Data\Uniblue\RegistryBooster\backup folder moved successfully.
C:\Documents and Settings\Jan Rijken\Application Data\Uniblue\RegistryBooster folder moved successfully.
C:\Documents and Settings\Jan Rijken\Application Data\Uniblue folder moved successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMPFC5A2B2 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Jan Rijken
->Temp folder emptied: 311086209 bytes
->Temporary Internet Files folder emptied: 16087865 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 839 bytes

User: LocalService
->Temp folder emptied: 285458393 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: software

User: vreemde
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 584,00 mb


[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User

User: Jan Rijken
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: software

User: vreemde

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 04112011_010103

Files\Folders moved on Reboot...
File move failed. C:\Documents and Settings\Jan Rijken\Local Settings\Temp\MessengerCache\sY3O1uW8rRJm71Ti0kMB4YtqU3M= scheduled to be moved on reboot.
File\Folder C:\Documents and Settings\Jan Rijken\Local Settings\Temp\flaF.tmp not found!
File\Folder C:\Documents and Settings\Jan Rijken\Local Settings\Temp\~DF49C5.tmp not found!
File\Folder C:\Documents and Settings\Jan Rijken\Local Settings\Temp\~DF49D7.tmp not found!
File\Folder C:\Documents and Settings\Jan Rijken\Local Settings\Temp\~DF4AA6.tmp not found!
File\Folder C:\Documents and Settings\Jan Rijken\Local Settings\Temp\~DF4AB8.tmp not found!
File\Folder C:\Documents and Settings\Jan Rijken\Local Settings\Temp\~DF4BAC.tmp not found!
File\Folder C:\Documents and Settings\Jan Rijken\Local Settings\Temp\~DF4BBE.tmp not found!
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\W2RLWSTL\98577-active-spam-spyware[1].html moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\W2RLWSTL\WebIMPop[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\RWHUM3ZO\ADSAdClient31[1].txt moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\2DMT0T3C\default[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\2DMT0T3C\HistoryFrame[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\2DMT0T3C\InboxLight[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\2DMT0T3C\messengerscripttracking[1].aspx moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\2DMT0T3C\resourcespreload[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\2DMT0T3C\xmlProxy[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\0D2RCOA4\adloader[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\0D2RCOA4\LocalStorage[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\0D2RCOA4\Messenger[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\0D2RCOA4\xmlProxy[2].htm moved successfully.
File move failed. C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\SuggestedSites.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\nvcbin.def.6659469d.tmp scheduled to be moved on reboot.

Registry entries deleted on Reboot...


this is the checkuplog:


Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Norman Security Suite
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
CCleaner
Java(TM) 6 Update 24
Out of date Java installed!
Adobe Flash Player
Adobe Reader 9.4.3 - Nederlands
Adobe Reader X (10.0.1) - Nederlands
````````````````````````````````
Process Check:
objlist.exe by Laurent
``````````End of Log````````````

 

eset

The eset scanner is still running but it will take more then 5 hours to run.
So When it's done i will send it to you. Thank you!!!!!

 

esetlog

I still have 16 threads.
This is the log/

C:\Documents and Settings\Jan Rijken\Bureaublad\BE Patched Hiren's.BootCD.9.7.iso probably unknown NewHeur_PE virus
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP353\A0032138.exe Win32/Toolbar.AskSBar application
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP358\A0032356.rbf Win32/RegistryBooster application
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP358\A0032357.rbf Win32/RegistryBooster application
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP358\A0032358.rbf Win32/RegistryBooster application
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP358\A0032359.rbf Win32/RegistryBooster application
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP358\A0032360.rbf Win32/RegistryBooster application
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP358\A0032393.rbf Win32/RegistryBooster application
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP358\A0032394.rbf Win32/RegistryBooster application
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP358\A0032395.rbf Win32/RegistryBooster application
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP358\A0032396.rbf Win32/RegistryBooster application
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP358\A0032397.rbf Win32/RegistryBooster application
D:\download\9Down.COM___Hirens.BootCD.9.7.with.keyboardpatch\BE Patched Hiren's.BootCD.9.7.iso probably unknown NewHeur_PE virus
D:\download\9Down.COM___Hirens.BootCD.9.7.with.keyboardpatch\Hiren's.BootCD.9.7.iso probably unknown NewHeur_PE virus
D:\Muziek\04 Track 4.wma Win32/Adware.180Solutions application
H:\software\software\Nero 8\Nero-8.3.6.0_eng.exe Win32/Toolbar.AskSBar application


Sorry!

 

otllog

All processes killed
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\Documents and Settings\Jan Rijken\Bureaublad\BE Patched Hiren's.BootCD.9.7.iso not found.
File\Folder D:\download\9Down.COM___Hirens.BootCD.9.7.with.keyboardpatch\BE Patched Hiren's.BootCD.9.7.iso not found.
File\Folder D:\download\9Down.COM___Hirens.BootCD.9.7.with.keyboardpatch\Hiren's.BootCD .9.7.iso not found.
Invalid Switch: Adware.180Solutions application
File\Folder H:\software\software\Nero 8\Nero-8.3.6.0_eng.exe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Jan Rijken
->Temp folder emptied: 117042 bytes
->Temporary Internet Files folder emptied: 3966928 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

User: LocalService
->Temp folder emptied: 285458393 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: software

User: vreemde
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 276,00 mb


[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User

User: Jan Rijken
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: software

User: vreemde

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 04112011_080508

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Jan Rijken\Local Settings\Temp\~DF7FC.tmp not found!
File\Folder C:\Documents and Settings\Jan Rijken\Local Settings\Temp\~DF849.tmp not found!
File\Folder C:\Documents and Settings\Jan Rijken\Local Settings\Temp\~DF9B9.tmp not found!
File\Folder C:\Documents and Settings\Jan Rijken\Local Settings\Temp\~DF9CB.tmp not found!
File\Folder C:\Documents and Settings\Jan Rijken\Local Settings\Temp\~DFAED.tmp not found!
File\Folder C:\Documents and Settings\Jan Rijken\Local Settings\Temp\~DFAFF.tmp not found!
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\UVP2E0QN\98577-active-spam-spyware-2[1].html moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\UVP2E0QN\adloader[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\UVP2E0QN\default[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\UVP2E0QN\resourcespreload[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\UVP2E0QN\xmlProxy[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\THO3XY9W\HistoryFrame[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\THO3XY9W\messengerscripttracking[1].aspx moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\THO3XY9W\WebIMPop[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\THO3XY9W\xmlProxy[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\I85JISC9\01[2].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\I85JISC9\ADSAdClient31[2].txt moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\I85JISC9\InboxLight[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\A30RP1A7\LocalStorage[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\A30RP1A7\Messenger[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
File\Folder C:\Documents and Settings\LocalService\Local Settings\Temp\nvcbin.def.6659469d.tmp not found!

Registry entries deleted on Reboot...