Solved malware and virus removal: logs as requested part 1

[Resolved] malware and virus removal: logs as requested part 1

These are the logs of the programs:
1 MALWAREBYTES:

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Databaseversie: 7296

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

27/07/2011 17:38:38
mbam-log-2011-07-27 (17-38-37).txt

Scantype: Snelle scan
Objecten gescand: 186003
Verstreken tijd: 24 minuut/minuten, 27 seconde(n)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 0
Registerwaarden geïnfecteerd: 0
Registerdata geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 0

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registersleutels geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registerdata geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Bestanden geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

2 MER :

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-07-28 11:07:09
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST3160815A rev.3.AAD
Running: 2ur1cs3n.exe; Driver: C:\DOCUME~1\JANRIJ~1\LOCALS~1\Temp\fxtdypog.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwCreateEvent [0xF249F99A]
SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwCreateFile [0xF249F3B8]
SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwCreateProcess [0xF249E83E]
SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwCreateProcessEx [0xF249E86E]
SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwCreateThread [0xF249E89E]
SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwSetSystemInformation [0xF249F4C2]
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xF23AB620]
SSDT \??\C:\Program Files\Norman\Ngs\Bin\nprosec.sys (Process Security Driver/Norman ASA) ZwWriteVirtualMemory [0xF249F1B6]

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 108 804E2774 8 Bytes [3E, E8, 49, F2, 6E, E8, 49, ...]
.text ntoskrnl.exe!_abnormal_termination + 120 804E278C 4 Bytes [9E, E8, 49, F2]
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF78DA340, 0xFFF3F, 0xF8000020]
.text C:\WINDOWS\System32\nv4_disp.dll section is writeable [0xBF012300, 0x234A20, 0xF8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\SearchIndexer.exe[224] kernel32.dll!WriteFile 7C7E0E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text C:\Documents and Settings\Jan Rijken\Bureaublad\2ur1cs3n.exe[532] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 003D0001
.text C:\Documents and Settings\Jan Rijken\Bureaublad\2ur1cs3n.exe[532] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\WINDOWS\Mixer.exe[548] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 01930001
.text C:\Program Files\Norman\Nvc\bin\nvcoas.exe[684] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[916] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00DF0001
.text C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe[1284] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00F10001
.text C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe[1284] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe[1284] WS2_32.dll!htons 71A32E53 6 Bytes JMP 5F040F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe[1284] WS2_32.dll!WSAGetLastError + 2 71A33CD0 4 Bytes JMP 5F0B001E
.text C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe[1284] WS2_32.dll!closesocket 71A33E2B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe[1284] WS2_32.dll!connect 71A34A07 6 Bytes JMP 5F130F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe[1284] WS2_32.dll!WSAEventSelect 71A364D9 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe[1284] WS2_32.dll!WSAAsyncSelect 71A40991 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe[1284] WS2_32.dll!WSAConnect 71A40C81 6 Bytes JMP 5F190F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe[1284] WS2_32.dll!WSAAccept 71A40DC1 6 Bytes JMP 5F160F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe[1284] WS2_32.dll!accept 71A41040 6 Bytes JMP 5F100F5A
.text C:\Program Files\Internet Explorer\iexplore.exe[1516] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Internet Explorer\iexplore.exe[1516] USER32.dll!DialogBoxParamW 7E3A47AB 5 Bytes JMP 415854C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1516] USER32.dll!CreateWindowExW 7E3AD0A3 5 Bytes JMP 4165DB04 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1516] USER32.dll!DialogBoxIndirectParamW 7E3B2072 5 Bytes JMP 41755329 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1516] USER32.dll!MessageBoxIndirectA 7E3BA082 5 Bytes JMP 4175525B C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1516] USER32.dll!DialogBoxParamA 7E3BB144 5 Bytes JMP 417552C6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1516] USER32.dll!MessageBoxExW 7E3D0838 5 Bytes JMP 4175512C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1516] USER32.dll!MessageBoxExA 7E3D085C 5 Bytes JMP 4175518E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1516] USER32.dll!DialogBoxIndirectParamA 7E3D6D7D 5 Bytes JMP 4175538C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1516] USER32.dll!MessageBoxIndirectW 7E3E64D5 5 Bytes JMP 417551F0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] USER32.dll!DialogBoxParamW 7E3A47AB 5 Bytes JMP 415854C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 41659A91 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] USER32.dll!CallNextHookEx 7E3AB3C6 5 Bytes JMP 4164D0CD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] USER32.dll!CreateWindowExW 7E3AD0A3 5 Bytes JMP 4165DB04 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 415C466E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] USER32.dll!DialogBoxIndirectParamW 7E3B2072 5 Bytes JMP 41755329 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] USER32.dll!MessageBoxIndirectA 7E3BA082 5 Bytes JMP 4175525B C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] USER32.dll!DialogBoxParamA 7E3BB144 5 Bytes JMP 417552C6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] USER32.dll!MessageBoxExW 7E3D0838 5 Bytes JMP 4175512C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] USER32.dll!MessageBoxExA 7E3D085C 5 Bytes JMP 4175518E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] USER32.dll!DialogBoxIndirectParamA 7E3D6D7D 5 Bytes JMP 4175538C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] USER32.dll!MessageBoxIndirectW 7E3E64D5 5 Bytes JMP 417551F0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] ole32.dll!CoCreateInstance 774BF1AC 5 Bytes JMP 4165DB60 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1684] ole32.dll!OleLoadFromStream 774E981B 5 Bytes JMP 41755691 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\WINDOWS\system32\NOTEPAD.EXE[1760] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00A00001
.text C:\WINDOWS\system32\NOTEPAD.EXE[1760] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[2104] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 003F0001
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[2104] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[2104] WS2_32.dll!htons 71A32E53 6 Bytes JMP 5F040F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[2104] WS2_32.dll!WSAGetLastError + 2 71A33CD0 4 Bytes JMP 5F0B001E
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[2104] WS2_32.dll!closesocket 71A33E2B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[2104] WS2_32.dll!connect 71A34A07 6 Bytes JMP 5F130F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[2104] WS2_32.dll!WSAEventSelect 71A364D9 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[2104] WS2_32.dll!WSAAsyncSelect 71A40991 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[2104] WS2_32.dll!WSAConnect 71A40C81 6 Bytes JMP 5F190F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[2104] WS2_32.dll!WSAAccept 71A40DC1 6 Bytes JMP 5F160F5A
.text C:\Program Files\Windows Live\Contacts\wlcomm.exe[2104] WS2_32.dll!accept 71A41040 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\system32\RUNDLL32.EXE[2220] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00C00001
.text C:\WINDOWS\system32\RUNDLL32.EXE[2220] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Norman\Nvc\Bin\cclaw.exe[2312] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] kernel32.dll!CreateFileA 7C7D1A28 6 Bytes JMP 5F2C0F5A
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 011F0001
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] kernel32.dll!CloseHandle 7C7D9BE7 6 Bytes JMP 5F3E0F5A
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] kernel32.dll!FindFirstFileW 7C7DEF81 6 Bytes JMP 5F3B0F5A
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] kernel32.dll!CreateFileW 7C7E0800 6 Bytes JMP 5F290F5A
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] kernel32.dll!FindFirstFileA 7C7E3879 6 Bytes JMP 5F2F0F5A
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] WS2_32.dll!htons 71A32E53 6 Bytes JMP 5F040F5A
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] WS2_32.dll!WSAGetLastError + 2 71A33CD0 4 Bytes JMP 5F0B001E
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] WS2_32.dll!closesocket 71A33E2B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] WS2_32.dll!connect 71A34A07 6 Bytes JMP 5F1A0F5A
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] WS2_32.dll!WSAEventSelect 71A364D9 6 Bytes JMP 5F260F5A
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] WS2_32.dll!WSAAsyncSelect 71A40991 6 Bytes JMP 5F230F5A
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] WS2_32.dll!WSAConnect 71A40C81 6 Bytes JMP 5F200F5A
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] WS2_32.dll!WSAAccept 71A40DC1 6 Bytes JMP 5F1D0F5A
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2456] WS2_32.dll!accept 71A41040 6 Bytes JMP 5F170F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[2472] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00FF0001
.text C:\Program Files\Google\Google Talk\googletalk.exe[2472] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Google\Google Talk\googletalk.exe[2472] WS2_32.dll!htons 71A32E53 6 Bytes JMP 5F040F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[2472] WS2_32.dll!WSAGetLastError + 2 71A33CD0 4 Bytes JMP 5F0B001E
.text C:\Program Files\Google\Google Talk\googletalk.exe[2472] WS2_32.dll!closesocket 71A33E2B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[2472] WS2_32.dll!connect 71A34A07 6 Bytes JMP 5F130F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[2472] WS2_32.dll!WSAEventSelect 71A364D9 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[2472] WS2_32.dll!WSAAsyncSelect 71A40991 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[2472] WS2_32.dll!WSAConnect 71A40C81 6 Bytes JMP 5F190F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[2472] WS2_32.dll!WSAAccept 71A40DC1 6 Bytes JMP 5F160F5A
.text C:\Program Files\Google\Google Talk\googletalk.exe[2472] WS2_32.dll!accept 71A41040 6 Bytes JMP 5F100F5A
.text C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.5.3.949\Badoo.Desktop.exe[2496] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00AF0001
.text C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.5.3.949\Badoo.Desktop.exe[2496] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.5.3.949\Badoo.Desktop.exe[2496] WS2_32.dll!htons 71A32E53 6 Bytes JMP 5F040F5A
.text C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.5.3.949\Badoo.Desktop.exe[2496] WS2_32.dll!WSAGetLastError + 2 71A33CD0 4 Bytes JMP 5F0B001E
.text C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.5.3.949\Badoo.Desktop.exe[2496] WS2_32.dll!closesocket 71A33E2B 6 Bytes JMP 5F0D0F5A
.text C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.5.3.949\Badoo.Desktop.exe[2496] WS2_32.dll!connect 71A34A07 6 Bytes JMP 5F130F5A
.text C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.5.3.949\Badoo.Desktop.exe[2496] WS2_32.dll!WSAEventSelect 71A364D9 6 Bytes JMP 5F1F0F5A
.text C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.5.3.949\Badoo.Desktop.exe[2496] WS2_32.dll!WSAAsyncSelect 71A40991 6 Bytes JMP 5F1C0F5A
.text C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.5.3.949\Badoo.Desktop.exe[2496] WS2_32.dll!WSAConnect 71A40C81 6 Bytes JMP 5F190F5A
.text C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.5.3.949\Badoo.Desktop.exe[2496] WS2_32.dll!WSAAccept 71A40DC1 6 Bytes JMP 5F160F5A
.text C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.5.3.949\Badoo.Desktop.exe[2496] WS2_32.dll!accept 71A41040 6 Bytes JMP 5F100F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2504] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 04D40001
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2504] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2504] WS2_32.dll!htons 71A32E53 6 Bytes JMP 5F040F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2504] WS2_32.dll!WSAGetLastError + 2 71A33CD0 4 Bytes JMP 5F0B001E
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2504] WS2_32.dll!closesocket 71A33E2B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2504] WS2_32.dll!connect 71A34A07 6 Bytes JMP 5F130F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2504] WS2_32.dll!WSAEventSelect 71A364D9 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2504] WS2_32.dll!WSAAsyncSelect 71A40991 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2504] WS2_32.dll!WSAConnect 71A40C81 6 Bytes JMP 5F190F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2504] WS2_32.dll!WSAAccept 71A40DC1 6 Bytes JMP 5F160F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2504] WS2_32.dll!accept 71A41040 6 Bytes JMP 5F100F5A
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] USER32.dll!DialogBoxParamW 7E3A47AB 5 Bytes JMP 415854C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 41659A91 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] USER32.dll!CallNextHookEx 7E3AB3C6 5 Bytes JMP 4164D0CD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] USER32.dll!CreateWindowExW 7E3AD0A3 5 Bytes JMP 4165DB04 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 415C466E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] USER32.dll!DialogBoxIndirectParamW 7E3B2072 5 Bytes JMP 41755329 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] USER32.dll!MessageBoxIndirectA 7E3BA082 5 Bytes JMP 4175525B C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] USER32.dll!DialogBoxParamA 7E3BB144 5 Bytes JMP 417552C6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] USER32.dll!MessageBoxExW 7E3D0838 5 Bytes JMP 4175512C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] USER32.dll!MessageBoxExA 7E3D085C 5 Bytes JMP 4175518E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] USER32.dll!DialogBoxIndirectParamA 7E3D6D7D 5 Bytes JMP 4175538C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] USER32.dll!MessageBoxIndirectW 7E3E64D5 5 Bytes JMP 417551F0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] ole32.dll!CoCreateInstance 774BF1AC 5 Bytes JMP 4165DB60 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2636] ole32.dll!OleLoadFromStream 774E981B 5 Bytes JMP 41755691 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[2652] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00D30001
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[2652] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[2652] WS2_32.dll!htons 71A32E53 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[2652] WS2_32.dll!WSAGetLastError + 2 71A33CD0 4 Bytes JMP 5F0B001E
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[2652] WS2_32.dll!closesocket 71A33E2B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[2652] WS2_32.dll!connect 71A34A07 6 Bytes JMP 5F130F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[2652] WS2_32.dll!WSAEventSelect 71A364D9 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[2652] WS2_32.dll!WSAAsyncSelect 71A40991 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[2652] WS2_32.dll!WSAConnect 71A40C81 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[2652] WS2_32.dll!WSAAccept 71A40DC1 6 Bytes JMP 5F160F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[2652] WS2_32.dll!accept 71A41040 6 Bytes JMP 5F100F5A
.text C:\Program Files\Secunia\PSI\psi_tray.exe[2764] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00A40001
.text C:\Program Files\Secunia\PSI\psi_tray.exe[2764] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Norman\Nse\bin\NSESVC.EXE[2848] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe[3232] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\WINDOWS\system32\ctfmon.exe[3440] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00C30001
.text C:\Program Files\Norman\Nvc\Bin\Nip.exe[3488] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\WINDOWS\system32\rundll32.exe[3696] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 00DD0001
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[3740] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[3852] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 003F0001
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[3852] kernel32.dll!FreeLibrary + 15 7C7DAC93 4 Bytes CALL 7170003D
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[3852] WS2_32.dll!htons 71A32E53 6 Bytes JMP 5F040F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[3852] WS2_32.dll!WSAGetLastError + 2 71A33CD0 4 Bytes JMP 5F0B001E
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[3852] WS2_32.dll!closesocket 71A33E2B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[3852] WS2_32.dll!connect 71A34A07 6 Bytes JMP 5F130F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[3852] WS2_32.dll!WSAEventSelect 71A364D9 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[3852] WS2_32.dll!WSAAsyncSelect 71A40991 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[3852] WS2_32.dll!WSAConnect 71A40C81 6 Bytes JMP 5F190F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[3852] WS2_32.dll!WSAAccept 71A40DC1 6 Bytes JMP 5F160F5A
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[3852] WS2_32.dll!accept 71A41040 6 Bytes JMP 5F100F5A
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[3928] kernel32.dll!LoadLibraryExW + C4 7C7D1BB9 4 Bytes CALL 01320001
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[3928] ws2_32.dll!htons 71A32E53 6 Bytes JMP 5F040F5A
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[3928] ws2_32.dll!WSAGetLastError + 2 71A33CD0 4 Bytes JMP 5F0B001E
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[3928] ws2_32.dll!closesocket 71A33E2B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[3928] ws2_32.dll!connect 71A34A07 6 Bytes JMP 5F130F5A
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[3928] ws2_32.dll!WSAEventSelect 71A364D9 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[3928] ws2_32.dll!WSAAsyncSelect 71A40991 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[3928] ws2_32.dll!WSAConnect 71A40C81 6 Bytes JMP 5F190F5A
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[3928] ws2_32.dll!WSAAccept 71A40DC1 6 Bytes JMP 5F160F5A
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[3928] ws2_32.dll!accept 71A41040 6 Bytes JMP 5F100F5A

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Internet Explorer\iexplore.exe[1684] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a3a57aae7
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a3a57aae7@001d6eb6c5f9 0xFE 0x58 0x6F 0xCA ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a3a57aae7 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a3a57aae7@001d6eb6c5f9 0xFE 0x58 0x6F 0xCA ...

---- EOF - GMER 1.0.15 ----

3 mbr :

aswMBR version 0.9.8.977 Copyright(c) 2011 AVAST Software
Run date: 2011-07-28 11:10:06
-----------------------------
11:10:06.265 OS Version: Windows 5.1.2600 Service Pack 3
11:10:06.265 Number of processors: 1 586 0x102
11:10:06.265 ComputerName: JAN UserName:
11:10:08.703 Initialize success
11:10:36.656 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
11:10:36.656 Disk 0 Vendor: ST3160815A 3.AAD Size: 152627MB BusType: 3
11:10:36.656 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-c
11:10:36.656 Disk 1 Vendor: ST3250820A 3.AAE Size: 238475MB BusType: 3
11:10:36.750 Disk 0 MBR read successfully
11:10:36.750 Disk 0 MBR scan
11:10:36.750 Disk 0 unknown MBR code
11:10:36.828 Disk 0 scanning sectors +312576705
11:10:37.062 Disk 0 scanning C:\WINDOWS\system32\drivers
11:11:50.203 Service scanning
11:11:51.609 Modules scanning
11:12:59.015 Disk 0 trace - called modules:
11:12:59.062 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys intelide.sys PCIIDEX.SYS
11:12:59.062 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8233bab8]
11:12:59.093 3 CLASSPNP.SYS[f8596fd7] -> nt!IofCallDriver -> \Device\00000062[0x823d9e98]
11:12:59.093 5 ACPI.sys[f84ec620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x82377d98]
11:12:59.093 Scan finished successfully
11:14:07.828 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Jan Rijken\Bureaublad\MBRlog\MBR.dat "
11:14:07.828 The log file has been saved successfully to "C:\Documents and Settings\Jan Rijken\Bureaublad\MBRlog\aswMBR.txt "

 

part 2

4 DDS :

DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Jan Rijken at 11:14:27 on 2011-07-28
Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.511.46 [GMT 2:00]
.
AV: Norman Security Suite *Enabled/Updated* {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}
.
============== Running Processes ===============
.
C:\Program Files\Norman\Npm\Bin\Elogsvc.exe
C:\Program Files\Norman\Ngs\Bin\Nnf.exe
C:\Program Files\Norman\Ngs\Bin\Nprosec.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Program Files\Norman\npm\bin\nvoy.exe
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k bthsvcs
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Update\NASvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Secunia\PSI\PSIA.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Norman\Npm\Bin\scheduler.exe
C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
C:\Program Files\Secunia\PSI\sua.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Norman\Npm\Bin\ZLH.EXE
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.5.3.949\Badoo.Desktop.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Secunia\PSI\psi_tray.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Norman\Nse\bin\NSESVC.EXE
C:\Program Files\Norman\Nvc\Bin\Nip.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jan Rijken\Bureaublad\2ur1cs3n.exe
C:\Program Files\Norman\Npm\Bin\Nbrowser.exe
C:\Program Files\Norman\Nvc\bin\nvcoas.exe
C:\Program Files\Norman\Nvc\Bin\cclaw.exe
C:\Documents and Settings\Jan Rijken\Bureaublad\aswMBR.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.be/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Aanmelden - Help: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: WOT Helper: {c920e44a-7f78-4e64-bdd7-a57026e7feb7} - c:\program files\wot\WOT.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: WOT: {71576546-354d-41c9-aae8-31f2ec22bf0d} - c:\program files\wot\WOT.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NVMCTRAY.DLL,NvTaskbarInit
uRun: [msnmsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [googletalk] "c:\program files\google\google talk\googletalk.exe" /autostart
uRun: [Badoo Desktop] "c:\documents and settings\all users\application data\badoo\badoo desktop\1.5.3.949\Badoo.Desktop.exe "
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
uRun: [FileHippo.com] "c:\program files\filehippo.com\UpdateChecker.exe" /background
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSCONFIG.EXE /auto
mRun: [Norman ZANDA] "c:\program files\norman\npm\bin\ZLH.EXE" /LOAD /SPLASH
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe "
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [C-Media Mixer] Mixer.exe /startup
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe "
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
StartupFolder: c:\docume~1\alluse~1\menust~1\progra~1\opstar~1\secuni~1.lnk - c:\program files\secunia\psi\psi_tray.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/E/3/9/E39C664F-A8E3-4F69-A109-1AE9849204EE/OGAControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
DPF: {FB298ECE-4D17-414A-A5E8-FABC938796B2} - hxxp://www.kohlerplus.com/_bin/AWSDrawingViewer.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - c:\program files\wot\WOT.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
============= SERVICES / DRIVERS ===============
.
R1 NGS;Norman General Security Driver;c:\program files\norman\ngs\bin\ngs.sys [2010-8-5 26744]
R1 NPROSEC;Norman Security driver;c:\program files\norman\ngs\bin\nprosec.sys [2010-8-5 74144]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2011-4-26 54760]
R2 NAUpdate;@c:\program files\nero\update\nasvc.exe,-200;c:\program files\nero\update\NASvc.exe [2010-5-4 503080]
R2 Ndiskio;Ndiskio;c:\program files\norman\nse\bin\Ndiskio.sys [2009-10-16 22880]
R2 NNFSVC;Norman Network Filtering service;c:\program files\norman\ngs\bin\nnf.exe [2010-8-5 223000]
R2 nregsec;Norman Registry Security driver;c:\program files\norman\ngs\bin\nregsec.sys [2010-8-5 40384]
R3 ham50;Creatix V.90 HAM Data Fax Modem;c:\windows\system32\drivers\CTXH51.sys [2001-11-7 454815]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-6-17 22712]
R3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [2009-6-15 24176]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]
R3 TotRec8;Total Recorder WDM audio filter driver;c:\windows\system32\drivers\TotRec8.sys [2011-7-2 90192]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-17 135664]
S3 fsssvc;De service Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872]
S3 gupdatem;Google Update-service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-17 135664]
.
=============== Created Last 30 ================
.
2011-07-25 12:09:30 -------- d-----w- c:\documents and settings\all users\application data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
2011-07-25 08:15:03 414 ----a-w- c:\windows\AeDebugSave.reg
2011-07-02 14:27:49 -------- d-----w- c:\documents and settings\jan rijken\application data\TotalRecorder
2011-07-02 14:27:12 90192 ----a-w- c:\windows\system32\drivers\TotRec8.sys
2011-07-02 14:27:06 -------- d-----w- c:\program files\HighCriteria
.
==================== Find3M ====================
.
2011-07-06 17:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-20 17:53:49 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-12 19:51:26 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-12 19:51:25 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-06 11:35:33 1859072 ----a-w- c:\windows\system32\win32k.sys
2011-05-02 15:31:53 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25:06 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.
============= FINISH: 11:16:39,12 ===============

5 ATTACH :

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-23.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 28/08/2007 21:48:44
System Uptime: 26/07/2011 18:22:04 (41 hours ago)
.
Motherboard: MICRO-STAR INTERNATIONAL CO., LTD | | MS-6399
Processor: Intel(R) Pentium(R) 4 CPU 1.80GHz | Socket 478 | 1800/100mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 45 GiB total, 27,985 GiB free.
D: is FIXED (NTFS) - 88 GiB total, 70,996 GiB free.
E: is FIXED (NTFS) - 16 GiB total, 14,748 GiB free.
F: is CDROM ()
G: is CDROM ()
H: is FIXED (NTFS) - 233 GiB total, 210,192 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description: CMI8738/C3DX PCI Audio Device
Device ID: PCI\VEN_13F6&DEV_0111&SUBSYS_39901462&REV_10\4&172A2BDD&0&38F0
Manufacturer: C-Media
Name: CMI8738/C3DX PCI Audio Device
PNP Device ID: PCI\VEN_13F6&DEV_0111&SUBSYS_39901462&REV_10\4&172A2BDD&0&38F0
Service:
.
Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia E51
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: Nokia E51
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd
.
==== System Restore Points ===================
.
RP80: 7/06/2011 20:03:32 - Software Distribution Service 3.0
RP81: 8/06/2011 7:15:49 - Software Distribution Service 3.0
RP82: 8/06/2011 20:02:39 - Software Distribution Service 3.0
RP83: 9/06/2011 7:16:41 - Software Distribution Service 3.0
RP84: 12/06/2011 21:50:06 - Removed Java(TM) 6 Update 25
RP85: 13/06/2011 20:00:23 - Software Distribution Service 3.0
RP86: 14/06/2011 20:00:34 - Software Distribution Service 3.0
RP87: 16/06/2011 20:00:46 - Software Distribution Service 3.0
RP88: 17/06/2011 7:14:19 - Software Distribution Service 3.0
RP89: 18/06/2011 20:00:44 - Software Distribution Service 3.0
RP90: 19/06/2011 20:00:38 - Software Distribution Service 3.0
RP91: 20/06/2011 23:06:58 - Controlepunt van systeem
RP92: 21/06/2011 23:25:02 - Controlepunt van systeem
RP93: 23/06/2011 13:02:40 - Controlepunt van systeem
RP94: 24/06/2011 13:28:33 - Controlepunt van systeem
RP95: 25/06/2011 14:29:38 - Controlepunt van systeem
RP96: 25/06/2011 20:21:05 - Software Distribution Service 3.0
RP97: 26/06/2011 20:00:35 - Software Distribution Service 3.0
RP98: 28/06/2011 20:55:36 - Controlepunt van systeem
RP99: 29/06/2011 7:22:10 - Software Distribution Service 3.0
RP100: 1/07/2011 0:19:41 - Controlepunt van systeem
RP101: 1/07/2011 20:00:22 - Software Distribution Service 3.0
RP102: 2/07/2011 8:47:29 - Software Distribution Service 3.0
RP103: 2/07/2011 20:00:22 - Software Distribution Service 3.0
RP104: 3/07/2011 20:00:21 - Software Distribution Service 3.0
RP105: 4/07/2011 5:09:01 - Software Distribution Service 3.0
RP106: 4/07/2011 20:00:22 - Software Distribution Service 3.0
RP107: 5/07/2011 7:07:40 - Software Distribution Service 3.0
RP108: 5/07/2011 20:00:28 - Software Distribution Service 3.0
RP109: 6/07/2011 20:00:36 - Software Distribution Service 3.0
RP110: 7/07/2011 7:16:53 - Software Distribution Service 3.0
RP111: 8/07/2011 7:16:26 - Software Distribution Service 3.0
RP112: 9/07/2011 20:00:24 - Software Distribution Service 3.0
RP113: 10/07/2011 20:00:24 - Software Distribution Service 3.0
RP114: 11/07/2011 20:00:26 - Software Distribution Service 3.0
RP115: 12/07/2011 20:00:33 - Software Distribution Service 3.0
RP116: 13/07/2011 20:01:21 - Software Distribution Service 3.0
RP117: 14/07/2011 20:00:24 - Software Distribution Service 3.0
RP118: 14/07/2011 20:01:53 - Software Distribution Service 3.0
RP119: 15/07/2011 11:10:36 - Software Distribution Service 3.0
RP120: 15/07/2011 20:00:45 - Software Distribution Service 3.0
RP121: 16/07/2011 20:00:48 - Software Distribution Service 3.0
RP122: 17/07/2011 20:00:47 - Software Distribution Service 3.0
RP123: 17/07/2011 21:43:06 - Software Distribution Service 3.0
RP124: 18/07/2011 20:00:47 - Software Distribution Service 3.0
RP125: 19/07/2011 20:00:48 - Software Distribution Service 3.0
RP126: 19/07/2011 20:35:40 - Software Distribution Service 3.0
RP127: 20/07/2011 7:35:26 - Software Distribution Service 3.0
RP128: 20/07/2011 20:00:43 - Software Distribution Service 3.0
RP129: 21/07/2011 20:00:47 - Software Distribution Service 3.0
RP130: 21/07/2011 23:21:50 - Software Distribution Service 3.0
RP131: 21/07/2011 23:52:50 - Software Distribution Service 3.0
RP132: 22/07/2011 14:09:30 - Software Distribution Service 3.0
RP133: 25/07/2011 0:38:11 - Controlepunt van systeem
RP134: 25/07/2011 10:14:53 - Installed Microsoft Fix it 50540
RP135: 26/07/2011 12:23:39 - Controlepunt van systeem
RP136: 27/07/2011 12:26:38 - Controlepunt van systeem
.
==== Installed Programs ======================
.
Adobe Flash Player 10 ActiveX
Adobe Reader 9.4.3 - Nederlands
Adobe Reader X (10.1.0)
Badoo Desktop
Belarc Advisor 8.1
Beveiligingsupdate for Windows XP (KB923689)
Beveiligingsupdate for Windows XP (KB941569)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB938127-v2)
Beveiligingsupdate voor Windows Internet Explorer 7 (KB969897)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB2183461)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB2360131)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB2416400)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB2482017)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB2497640)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB2510531)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB2530548)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB2544521)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB971961)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB974455)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB976325)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB978207)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB981332)
Beveiligingsupdate voor Windows Internet Explorer 8 (KB982381)
Beveiligingsupdate voor Windows Media Player (KB2378111)
Beveiligingsupdate voor Windows Media Player (KB911564)
Beveiligingsupdate voor Windows Media Player (KB952069)
Beveiligingsupdate voor Windows Media Player (KB954155)
Beveiligingsupdate voor Windows Media Player (KB968816)
Beveiligingsupdate voor Windows Media Player (KB973540)
Beveiligingsupdate voor Windows Media Player (KB975558)
Beveiligingsupdate voor Windows Media Player (KB978695)
Beveiligingsupdate voor Windows Media Player 11 (KB936782)
Beveiligingsupdate voor Windows Media Player 11 (KB954154)
Beveiligingsupdate voor Windows Media Player 6.4 (KB925398)
Beveiligingsupdate voor Windows Media Player 9 (KB936782)
Beveiligingsupdate voor Windows XP (KB2079403)
Beveiligingsupdate voor Windows XP (KB2115168)
Beveiligingsupdate voor Windows XP (KB2121546)
Beveiligingsupdate voor Windows XP (KB2160329)
Beveiligingsupdate voor Windows XP (KB2229593)
Beveiligingsupdate voor Windows XP (KB2259922)
Beveiligingsupdate voor Windows XP (KB2279986)
Beveiligingsupdate voor Windows XP (KB2286198)
Beveiligingsupdate voor Windows XP (KB2296011)
Beveiligingsupdate voor Windows XP (KB2296199)
Beveiligingsupdate voor Windows XP (KB2347290)
Beveiligingsupdate voor Windows XP (KB2360937)
Beveiligingsupdate voor Windows XP (KB2387149)
Beveiligingsupdate voor Windows XP (KB2393802)
Beveiligingsupdate voor Windows XP (KB2412687)
Beveiligingsupdate voor Windows XP (KB2419632)
Beveiligingsupdate voor Windows XP (KB2423089)
Beveiligingsupdate voor Windows XP (KB2436673)
Beveiligingsupdate voor Windows XP (KB2440591)
Beveiligingsupdate voor Windows XP (KB2443105)
Beveiligingsupdate voor Windows XP (KB2476490)
Beveiligingsupdate voor Windows XP (KB2476687)
Beveiligingsupdate voor Windows XP (KB2478960)
Beveiligingsupdate voor Windows XP (KB2478971)
Beveiligingsupdate voor Windows XP (KB2479628)
Beveiligingsupdate voor Windows XP (KB2479943)
Beveiligingsupdate voor Windows XP (KB2481109)
Beveiligingsupdate voor Windows XP (KB2483185)
Beveiligingsupdate voor Windows XP (KB2485376)
Beveiligingsupdate voor Windows XP (KB2485663)
Beveiligingsupdate voor Windows XP (KB2503658)
Beveiligingsupdate voor Windows XP (KB2503665)
Beveiligingsupdate voor Windows XP (KB2506212)
Beveiligingsupdate voor Windows XP (KB2506223)
Beveiligingsupdate voor Windows XP (KB2507618)
Beveiligingsupdate voor Windows XP (KB2507938)
Beveiligingsupdate voor Windows XP (KB2508272)
Beveiligingsupdate voor Windows XP (KB2508429)
Beveiligingsupdate voor Windows XP (KB2509553)
Beveiligingsupdate voor Windows XP (KB2511455)
Beveiligingsupdate voor Windows XP (KB2524375)
Beveiligingsupdate voor Windows XP (KB2535512)
Beveiligingsupdate voor Windows XP (KB2536276)
Beveiligingsupdate voor Windows XP (KB2544893)
Beveiligingsupdate voor Windows XP (KB2555917)
Beveiligingsupdate voor Windows XP (KB923561)
Beveiligingsupdate voor Windows XP (KB923789)
Beveiligingsupdate voor Windows XP (KB938464-v2)
Beveiligingsupdate voor Windows XP (KB946648)
Beveiligingsupdate voor Windows XP (KB950760)
Beveiligingsupdate voor Windows XP (KB950762)
Beveiligingsupdate voor Windows XP (KB950974)
Beveiligingsupdate voor Windows XP (KB951066)
Beveiligingsupdate voor Windows XP (KB951376-v2)
Beveiligingsupdate voor Windows XP (KB951748)
Beveiligingsupdate voor Windows XP (KB952004)
Beveiligingsupdate voor Windows XP (KB952954)
Beveiligingsupdate voor Windows XP (KB954459)
Beveiligingsupdate voor Windows XP (KB954600)
Beveiligingsupdate voor Windows XP (KB955069)
Beveiligingsupdate voor Windows XP (KB956572)
Beveiligingsupdate voor Windows XP (KB956744)
Beveiligingsupdate voor Windows XP (KB956802)
Beveiligingsupdate voor Windows XP (KB956803)
Beveiligingsupdate voor Windows XP (KB956844)
Beveiligingsupdate voor Windows XP (KB957097)
Beveiligingsupdate voor Windows XP (KB958644)
Beveiligingsupdate voor Windows XP (KB958687)
Beveiligingsupdate voor Windows XP (KB958869)
Beveiligingsupdate voor Windows XP (KB959426)
Beveiligingsupdate voor Windows XP (KB960225)
Beveiligingsupdate voor Windows XP (KB960803)
Beveiligingsupdate voor Windows XP (KB960859)
Beveiligingsupdate voor Windows XP (KB961371)
Beveiligingsupdate voor Windows XP (KB961373)
Beveiligingsupdate voor Windows XP (KB961501)
Beveiligingsupdate voor Windows XP (KB968537)
Beveiligingsupdate voor Windows XP (KB969059)
Beveiligingsupdate voor Windows XP (KB969898)
Beveiligingsupdate voor Windows XP (KB969947)
Beveiligingsupdate voor Windows XP (KB970238)
Beveiligingsupdate voor Windows XP (KB970430)
Beveiligingsupdate voor Windows XP (KB971468)
Beveiligingsupdate voor Windows XP (KB971486)
Beveiligingsupdate voor Windows XP (KB971557)
Beveiligingsupdate voor Windows XP (KB971633)
Beveiligingsupdate voor Windows XP (KB971657)
Beveiligingsupdate voor Windows XP (KB972270)
Beveiligingsupdate voor Windows XP (KB973346)
Beveiligingsupdate voor Windows XP (KB973354)
Beveiligingsupdate voor Windows XP (KB973507)
Beveiligingsupdate voor Windows XP (KB973525)
Beveiligingsupdate voor Windows XP (KB973869)
Beveiligingsupdate voor Windows XP (KB973904)
Beveiligingsupdate voor Windows XP (KB974112)
Beveiligingsupdate voor Windows XP (KB974318)
Beveiligingsupdate voor Windows XP (KB974392)
Beveiligingsupdate voor Windows XP (KB974571)
Beveiligingsupdate voor Windows XP (KB975025)
Beveiligingsupdate voor Windows XP (KB975467)
Beveiligingsupdate voor Windows XP (KB975560)
Beveiligingsupdate voor Windows XP (KB975561)
Beveiligingsupdate voor Windows XP (KB975562)
Beveiligingsupdate voor Windows XP (KB975713)
Beveiligingsupdate voor Windows XP (KB977165)
Beveiligingsupdate voor Windows XP (KB977816)
Beveiligingsupdate voor Windows XP (KB977914)
Beveiligingsupdate voor Windows XP (KB978037)
Beveiligingsupdate voor Windows XP (KB978251)
Beveiligingsupdate voor Windows XP (KB978262)
Beveiligingsupdate voor Windows XP (KB978338)
Beveiligingsupdate voor Windows XP (KB978542)
Beveiligingsupdate voor Windows XP (KB978601)
Beveiligingsupdate voor Windows XP (KB978706)
Beveiligingsupdate voor Windows XP (KB979309)
Beveiligingsupdate voor Windows XP (KB979482)
Beveiligingsupdate voor Windows XP (KB979559)
Beveiligingsupdate voor Windows XP (KB979683)
Beveiligingsupdate voor Windows XP (KB979687)
Beveiligingsupdate voor Windows XP (KB980195)
Beveiligingsupdate voor Windows XP (KB980218)
Beveiligingsupdate voor Windows XP (KB980232)
Beveiligingsupdate voor Windows XP (KB980436)
Beveiligingsupdate voor Windows XP (KB981322)
Beveiligingsupdate voor Windows XP (KB981852)
Beveiligingsupdate voor Windows XP (KB981957)
Beveiligingsupdate voor Windows XP (KB981997)
Beveiligingsupdate voor Windows XP (KB982132)
Beveiligingsupdate voor Windows XP (KB982214)
Beveiligingsupdate voor Windows XP (KB982665)
Beveiligingsupdate voor Windows XP (KB982802)
CCleaner
DivX Converter
DivX Plus DirectShow Filters
DivX Setup
DivX Version Checker
DVD Decrypter (Remove Only)
DVD Shrink 3.2
DVDFab Platinum 3.0.7.0
Essentiële update voor Windows Media Player 11 (KB959772)
FileHippo.com Update Checker
Free Picture Resize Starter 4.5
Google Chrome
Google Earth
Google Talk (remove only)
Google Update Helper
HiJackThis
HijackThis 2.0.2
HiYo
HiYo
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB976002-v5)
Hotfix voor Windows Media Player 11 (KB939683)
Hotfix voor Windows XP (KB2158563)
Hotfix voor Windows XP (KB2443685)
Hotfix voor Windows XP (KB942288-v3)
Hotfix voor Windows XP (KB952287)
Hotfix voor Windows XP (KB961118)
Hotfix voor Windows XP (KB970653-v3)
Hotfix voor Windows XP (KB976098-v2)
Hotfix voor Windows XP (KB979306)
Hotfix voor Windows XP (KB981793)
ImgBurn
Java Auto Updater
Java(TM) 6 Update 26
Junk Mail filter update
KB943729: Update voor Windows XP
Malwarebytes' Anti-Malware versie 1.51.1.1800
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Dutch Language Pack
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - NLD
Microsoft .NET Framework 3.0 Dutch Language Pack
Microsoft .NET Framework 3.0 Nederlands taalpakket
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - NLD
Microsoft .NET Framework 3.5 Language Pack SP1 - nld
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft National Language Support Downlevel APIs
Microsoft Office File Validation Add-In
Microsoft Office Live Add-in 1.3
Microsoft Office Outlook Connector
Microsoft Office Professional Editie 2003
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft User-Mode Driver Framework Feature Pack 1.9
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
MSVC80_x86_v2
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB933579)
Nero 8
Nero BurnLite 10
Nero Control Center 10
Nero ControlCenter 10 Help (CHM)
Nero Core Components 10
Nero Update
neroxml
Norman Security Suite
NVIDIA Windows 2000/XP Display Drivers
Off-linediensten van Home'Bank 4.55
OGA Notifier 2.0.0048.0
Pakket voor de provider van Microsoft Base-smartcardcryptografieservice
PC Connectivity Solution
PCI Audio Driver
Secunia PSI (2.0.0.3001)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Search 4 - KB963093
Segoe UI
SequoiaView
SUPERAntiSpyware
System Requirements Lab
Total Recorder 8.2
Uninstall Borinato DVR Client
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update voor Windows Internet Explorer 8 (KB973874)
Update voor Windows Internet Explorer 8 (KB976662)
Update voor Windows Internet Explorer 8 (KB976749)
Update voor Windows Internet Explorer 8 (KB980182)
Update voor Windows XP (KB2141007)
Update voor Windows XP (KB2345886)
Update voor Windows XP (KB2467659)
Update voor Windows XP (KB2541763)
Update voor Windows XP (KB951978)
Update voor Windows XP (KB955759)
Update voor Windows XP (KB955839)
Update voor Windows XP (KB961503)
Update voor Windows XP (KB967715)
Update voor Windows XP (KB968389)
Update voor Windows XP (KB971029)
Update voor Windows XP (KB971737)
Update voor Windows XP (KB973687)
Update voor Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.4053
VCRedistSetup
WebFldrs XP
Windows-stuurprogrammapakket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live - Hulpprogramma voor uploaden
Windows Live aanmeldhulp
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sync
Windows Live Toolbar
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Player 11
Windows Presentation Foundation
Windows Presentation Foundation Language Pack (NLD)
Windows Search 4.0
Windows XP Service Pack 3
WinRAR 4.01 (32-bit)
WOT for Internet Explorer
XML Paper Specification Shared Components Language Pack 1.0
XML Paper Specification Shared Components Pack 1.0
.
==== End Of File ===========================

 

log combofix

ComboFix 11-07-28.07 - Jan Rijken 29/07/2011 8:24.7.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.511.239 [GMT 2:00]
Gestart vanuit: c:\documents and settings\Jan Rijken\Bureaublad\ComboFix.exe
AV: Norman Security Suite *Disabled/Updated* {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}
.
.
(((((((((((((((((((( Bestanden Gemaakt van 2011-06-28 to 2011-07-29 ))))))))))))))))))))))))))))))
.
.
2011-07-28 18:50 . 2011-07-28 18:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Badoo
2011-07-25 12:09 . 2011-07-25 12:09 -------- d-----w- c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
2011-07-25 08:15 . 2011-07-25 08:15 414 ----a-w- c:\windows\AeDebugSave.reg
2011-07-02 14:27 . 2011-07-02 14:28 -------- d-----w- c:\documents and settings\Jan Rijken\Application Data\TotalRecorder
2011-07-02 14:27 . 2010-11-23 10:40 90192 ----a-w- c:\windows\system32\drivers\TotRec8.sys
2011-07-02 14:27 . 2011-07-02 14:27 -------- d-----w- c:\program files\HighCriteria
.
.
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-06 17:52 . 2009-06-17 21:26 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-06 17:52 . 2009-06-17 21:26 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-20 17:53 . 2011-04-09 08:05 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-12 19:51 . 2011-06-12 19:52 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-12 19:51 . 2011-04-10 22:40 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-06 11:35 . 2002-09-11 12:00 1859072 ----a-w- c:\windows\system32\win32k.sys
2011-05-02 15:31 . 2007-08-28 19:42 692736 ----a-w- c:\windows\system32\inetcomm.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter "= "c:\windows\system32\NVMCTRAY.DLL" [2003-07-28 49152]
"msnmsgr "= "c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2010-04-16 3872080]
"googletalk "= "c:\program files\Google\Google Talk\googletalk.exe" [2007-11-21 3293184]
"SUPERAntiSpyware "= "c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-06-30 2424192]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"FileHippo.com "= "c:\program files\FileHippo.com\UpdateChecker.exe" [2010-08-09 248832]
"Badoo Desktop "= "c:\documents and settings\All Users\Application Data\Badoo\Badoo Desktop\1.6.30.1018\Badoo.Desktop.exe" [2011-07-22 1032704]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent "= "bthprops.cpl" [2008-04-14 110592]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]
"nwiz "= "nwiz.exe" [2003-07-28 323584]
"Norman ZANDA "= "c:\program files\Norman\Npm\Bin\ZLH.EXE" [2011-03-22 189824]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-06-06 35736]
"DivXUpdate "= "c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"C-Media Mixer "= "Mixer.exe" [2002-10-15 1818624]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"NeroFilterCheck "= "c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"NBKeyScan "= "c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"Malwarebytes' Anti-Malware "= "c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2011-1-10 291896]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@= "Service "
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
"c:\\networkdvr\\remote.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe "=
.
R1 NGS;Norman General Security Driver;c:\program files\Norman\ngs\bin\ngs.sys [5/08/2010 12:21 26744]
R1 NPROSEC;Norman Security driver;c:\program files\Norman\ngs\bin\nprosec.sys [5/08/2010 12:21 74144]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 20:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 20:41 67656]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [17/06/2009 23:26 366640]
R2 NAUpdate;@c:\program files\Nero\Update\NASvc.exe,-200;c:\program files\Nero\Update\NASvc.exe [4/05/2010 12:07 503080]
R2 Ndiskio;Ndiskio;c:\program files\Norman\Nse\Bin\Ndiskio.sys [16/10/2009 21:04 22880]
R2 NNFSVC;Norman Network Filtering service;c:\program files\Norman\ngs\bin\nnf.exe [5/08/2010 12:21 223000]
R2 NPROSECSVC;Norman Security service;c:\program files\Norman\ngs\bin\nprosec.exe [5/08/2010 12:21 90656]
R2 nregsec;Norman Registry Security driver;c:\program files\Norman\ngs\bin\nregsec.sys [5/08/2010 12:21 40384]
R2 NVOY;Norman Resource Provider;c:\program files\Norman\Npm\Bin\nvoy.exe [15/06/2009 22:48 98776]
R2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\psia.exe [10/01/2011 16:24 993848]
R2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [10/01/2011 16:24 399416]
R3 ham50;Creatix V.90 HAM Data Fax Modem;c:\windows\system32\drivers\CTXH51.sys [7/11/2001 13:47 454815]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [17/06/2009 23:26 22712]
R3 nsesvc;Norman Scanner Engine Service;c:\program files\Norman\Nse\Bin\Nsesvc.exe [5/01/2011 21:11 288072]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [1/09/2010 10:30 15544]
R3 Scheduler;Norman Scheduler Service;c:\program files\Norman\Npm\Bin\scheduler.exe [17/06/2009 22:21 133272]
R3 TotRec8;Total Recorder WDM audio filter driver;c:\windows\system32\drivers\TotRec8.sys [2/07/2011 16:27 90192]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [17/01/2010 19:59 135664]
S3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [17/01/2010 19:59 135664]
S3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [15/06/2009 22:47 24176]
S3 nvcoas;Norman Virus Control on-access component;c:\program files\Norman\nvc\bin\Nvcoas.exe [30/08/2010 20:32 210248]
S3 NVCScheduler;Norman Virus Control Scheduler; "c:\program files\Norman\Npm\bin\NVCSCHED.EXE" --> c:\program files\Norman\Npm\bin\NVCSCHED.EXE [?]
.
--- Andere Services/Drivers In Geheugen ---
.
*Deregistered* - mchInjDrv
.
Inhoud van de 'Gedeelde Taken' map
.
2011-07-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 17:59]
.
2011-07-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 17:59]
.
2011-07-29 c:\windows\Tasks\User_Feed_Synchronization-{DB14428F-5D41-4FB7-941C-F5A28B49E3B4}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.be/
TCP: DhcpNameServer = 192.168.1.1
.
- - - - ORPHANS VERWIJDERD - - - -
.
MSConfigStartUp-RegistryBooster - c:\program files\Uniblue\RegistryBooster\launcher.exe
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}\bm_installer.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-29 08:40
Windows 5.1.2600 Service Pack 3 NTFS
.
scannen van verborgen processen ...
.
scannen van verborgen autostart items ...
.
scannen van verborgen bestanden ...
.
Scan succesvol afgerond
verborgen bestanden: 0
.
**************************************************************************
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–}|ÿÿÿÿÀ•}|ù•9~*]
"3140110900063D11C8EF10054038389C "= "C?\\WINDOWS\\system32\\FM20ENU.DLL "
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------
.
- - - - - - - > 'winlogon.exe'(580)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
- - - - - - - > 'explorer.exe'(3516)
c:\program files\Norman\nvc\bin\Niphk.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\nl-nl\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\nl-nl\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Voltooingstijd: 2011-07-29 08:50:54
ComboFix-quarantined-files.txt 2011-07-29 06:50
.
Pre-Run: 30.481.022.976 bytes beschikbaar
Post-Run: 30.586.155.008 bytes beschikbaar
.
- - End Of File - - E1D042B36B30667557794234C8ACAA7A

 

otl log

OTL logfile created on: 29/07/2011 20:53:46 - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\Jan Rijken\Bureaublad
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000813 | Country: België | Language: NLB | Date Format: d/MM/yyyy

511,49 Mb Total Physical Memory | 117,64 Mb Available Physical Memory | 23,00% Memory free
2,38 Gb Paging File | 1,63 Gb Available in Paging File | 68,45% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 44,73 Gb Total Space | 28,25 Gb Free Space | 63,16% Space Free | Partition Type: NTFS
Drive D: | 87,89 Gb Total Space | 71,00 Gb Free Space | 80,78% Space Free | Partition Type: NTFS
Drive E: | 16,43 Gb Total Space | 14,75 Gb Free Space | 89,75% Space Free | Partition Type: NTFS
Drive H: | 232,88 Gb Total Space | 210,19 Gb Free Space | 90,26% Space Free | Partition Type: NTFS

Computer Name: JAN | User Name: Jan Rijken | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/07/29 20:51:33 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jan Rijken\Bureaublad\OTL.exe
PRC - [2011/07/22 10:08:20 | 001,032,704 | ---- | M] (Badoo) -- C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.6.30.1018\Badoo.Desktop.exe
PRC - [2011/07/06 19:52:38 | 000,449,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/06/30 23:52:46 | 002,424,192 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2011/03/22 16:15:33 | 000,189,824 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Npm\Bin\Zlh.exe
PRC - [2011/03/21 20:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2011/01/10 16:24:20 | 000,993,848 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psia.exe
PRC - [2011/01/10 16:24:20 | 000,399,416 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\sua.exe
PRC - [2011/01/10 16:24:20 | 000,291,896 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psi_tray.exe
PRC - [2010/12/17 16:22:48 | 000,288,072 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Nse\Bin\Nsesvc.exe
PRC - [2010/12/02 11:13:55 | 000,308,408 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Npm\Bin\Zanda.exe
PRC - [2010/11/10 14:59:37 | 000,090,656 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\ngs\bin\nprosec.exe
PRC - [2010/11/10 14:48:32 | 000,223,000 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\ngs\bin\nnf.exe
PRC - [2010/08/12 13:44:29 | 000,210,248 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\nvc\bin\Nvcoas.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Update\NASvc.exe
PRC - [2010/04/12 12:16:40 | 000,095,560 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\nvc\bin\CClaw.exe
PRC - [2010/03/15 13:14:41 | 000,098,776 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Npm\Bin\nvoy.exe
PRC - [2010/01/28 14:33:08 | 000,169,344 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\nvc\bin\Nip.exe
PRC - [2009/10/15 15:50:54 | 000,133,272 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Npm\Bin\scheduler.exe
PRC - [2009/10/11 15:07:33 | 000,152,904 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Npm\Bin\elogsvc.exe
PRC - [2009/10/07 13:04:51 | 000,129,928 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\Npm\Bin\Njeeves.exe
PRC - [2008/06/24 16:06:06 | 001,840,424 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
PRC - [2008/04/14 19:02:58 | 001,037,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/11/21 04:15:08 | 003,293,184 | ---- | M] (Google) -- C:\Program Files\Google\Google Talk\googletalk.exe
PRC - [2002/10/15 18:00:20 | 001,818,624 | ---- | M] (C-Media Electronic Inc. (www.cmedia.com.tw)) -- C:\WINDOWS\mixer.exe


========== Modules (SafeList) ==========

MOD - [2011/07/29 20:51:33 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jan Rijken\Bureaublad\OTL.exe
MOD - [2010/08/23 18:13:25 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2009/10/11 15:11:19 | 000,267,656 | ---- | M] (Norman ASA) -- C:\Program Files\Norman\nvc\bin\Niphk.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (NVCScheduler)
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/01/10 16:24:20 | 000,993,848 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2011/01/10 16:24:20 | 000,399,416 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2010/12/17 16:22:48 | 000,288,072 | ---- | M] (Norman ASA) [On_Demand | Running] -- C:\Program Files\Norman\Nse\bin\NSESVC.EXE -- (nsesvc)
SRV - [2010/12/02 11:13:55 | 000,308,408 | ---- | M] (Norman ASA) [Auto | Running] -- C:\Program Files\Norman\Npm\Bin\Zanda.exe -- (Norman ZANDA)
SRV - [2010/11/10 14:59:37 | 000,090,656 | ---- | M] (Norman ASA) [Auto | Running] -- C:\Program Files\Norman\Ngs\Bin\Nprosec.exe -- (NPROSECSVC)
SRV - [2010/11/10 14:48:32 | 000,223,000 | ---- | M] (Norman ASA) [Auto | Running] -- C:\Program Files\Norman\Ngs\Bin\Nnf.exe -- (NNFSVC)
SRV - [2010/08/12 13:44:29 | 000,210,248 | ---- | M] (Norman ASA) [On_Demand | Running] -- C:\Program Files\Norman\Nvc\bin\nvcoas.exe -- (nvcoas)
SRV - [2010/06/14 15:07:14 | 000,615,936 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/03/15 13:14:41 | 000,098,776 | ---- | M] (Norman ASA) [Auto | Running] -- C:\Program Files\Norman\npm\bin\nvoy.exe -- (NVOY)
SRV - [2009/10/15 15:50:54 | 000,133,272 | ---- | M] (Norman ASA) [On_Demand | Running] -- C:\Program Files\Norman\Npm\Bin\scheduler.exe -- (Scheduler)
SRV - [2009/10/11 15:07:33 | 000,152,904 | ---- | M] (Norman ASA) [Auto | Running] -- C:\Program Files\Norman\Npm\Bin\Elogsvc.exe -- (eLoggerSvc6)
SRV - [2009/10/07 13:04:51 | 000,129,928 | ---- | M] (Norman ASA) [On_Demand | Running] -- C:\Program Files\Norman\Npm\bin\NJEEVES.EXE -- (Norman NJeeves)


========== Driver Services (SafeList) ==========

DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2010/11/23 12:40:40 | 000,090,192 | ---- | M] (High Criteria inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\TotRec8.sys -- (TotRec8)
DRV - [2010/11/11 14:01:54 | 000,024,176 | ---- | M] (Norman ASA) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvcw32mf.sys -- (NvcMFlt)
DRV - [2010/11/10 15:48:11 | 000,040,384 | ---- | M] (Norman ASA) [Kernel | Auto | Running] -- C:\Program Files\Norman\ngs\bin\nregsec.sys -- (nregsec)
DRV - [2010/11/10 15:48:00 | 000,074,144 | ---- | M] (Norman ASA) [Kernel | System | Running] -- C:\Program Files\Norman\ngs\bin\nprosec.sys -- (NPROSEC)
DRV - [2010/09/01 10:30:58 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\psi_mf.sys -- (PSI)
DRV - [2010/05/10 20:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/04/28 07:44:02 | 000,054,760 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)
DRV - [2010/02/17 20:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2010/01/04 14:44:43 | 000,026,744 | ---- | M] (Norman ASA) [Kernel | System | Running] -- c:\Program Files\Norman\ngs\bin\ngs.sys -- (NGS)
DRV - [2009/10/09 13:24:40 | 000,022,880 | ---- | M] (Norman ASA) [Kernel | Auto | Running] -- C:\Program Files\Norman\Nse\Bin\Ndiskio.sys -- (Ndiskio)
DRV - [2008/08/26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/04/13 20:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2008/02/27 13:49:00 | 000,003,840 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\BANTExt.sys -- (BANTExt)
DRV - [2004/08/03 22:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) NT-stuurprogramma voor Realtek RTL8139(A/B/C)
DRV - [2001/08/18 00:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)
DRV - [2001/08/04 08:50:08 | 000,454,815 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CTXH51.sys -- (ham50)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-746137067-1500820517-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
IE - HKU\S-1-5-21-746137067-1500820517-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = nl-be
IE - HKU\S-1-5-21-746137067-1500820517-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 82 CF EE 4B C9 04 CC 01 [binary data]
IE - HKU\S-1-5-21-746137067-1500820517-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.0.60401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/04/09 10:01:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/04/09 10:01:49 | 000,000,000 | ---D | M]


O1 HOSTS File: ([2011/04/26 23:51:55 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKU\S-1-5-21-746137067-1500820517-839522115-1003\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [C-Media Mixer] C:\WINDOWS\mixer.exe (C-Media Electronic Inc. (www.cmedia.com.tw))
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [Norman ZANDA] C:\Program Files\Norman\Npm\Bin\ZLH.EXE (Norman ASA)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKU\S-1-5-21-746137067-1500820517-839522115-1003..\Run: [Badoo Desktop] C:\Documents and Settings\All Users\Application Data\Badoo\Badoo Desktop\1.6.30.1018\Badoo.Desktop.exe (Badoo)
O4 - HKU\S-1-5-21-746137067-1500820517-839522115-1003..\Run: [FileHippo.com] C:\Program Files\FileHippo.com\UpdateChecker.exe (FileHippo.com)
O4 - HKU\S-1-5-21-746137067-1500820517-839522115-1003..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe (Google)
O4 - HKU\S-1-5-21-746137067-1500820517-839522115-1003..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O4 - HKU\S-1-5-21-746137067-1500820517-839522115-1003..\Run: [NvMediaCenter] C:\WINDOWS\System32\NVMCTRAY.DLL (NVIDIA Corporation)
O4 - HKU\S-1-5-21-746137067-1500820517-839522115-1003..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Secunia PSI Tray.lnk = C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-746137067-1500820517-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-746137067-1500820517-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-746137067-1500820517-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-746137067-1500820517-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/E/3/9/E39C664F-A8E3-4F69-A109-1AE9849204EE/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O16 - DPF: {FB298ECE-4D17-414A-A5E8-FABC938796B2} http://www.kohlerplus.com/_bin/AWSDrawingViewer.cab (ActiveWebParts Illustration Viewer)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop Components:0 (Mijn huidige introductiepagina) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/08/28 21:45:19 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/07/29 20:51:25 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Jan Rijken\Bureaublad\OTL.exe
[2011/07/29 08:55:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Bureaublad\combofixlog
[2011/07/29 08:17:26 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/07/29 08:17:26 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/07/29 08:17:26 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/07/29 08:17:26 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/07/29 08:16:42 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/07/29 08:10:49 | 004,157,170 | R--- | C] (Swearware) -- C:\Documents and Settings\Jan Rijken\Bureaublad\ComboFix.exe
[2011/07/28 20:50:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Badoo
[2011/07/28 11:20:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Bureaublad\attach log
[2011/07/28 11:19:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Bureaublad\ddslog
[2011/07/28 11:13:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Bureaublad\MBRlog
[2011/07/27 22:30:00 | 000,607,017 | R--- | C] (Swearware) -- C:\Documents and Settings\Jan Rijken\Bureaublad\dds.scr
[2011/07/27 22:29:13 | 001,915,904 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Jan Rijken\Bureaublad\aswMBR.exe
[2011/07/26 09:27:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Mijn documenten\autorunslog
[2011/07/25 14:09:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
[2011/07/19 13:24:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Bureaublad\Err
[2011/07/02 16:27:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jan Rijken\Application Data\TotalRecorder
[2011/07/02 16:27:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programma's\Total Recorder
[2011/07/02 16:27:12 | 000,090,192 | ---- | C] (High Criteria inc.) -- C:\WINDOWS\System32\drivers\TotRec8.sys
[2011/07/02 16:27:06 | 000,000,000 | ---D | C] -- C:\Program Files\HighCriteria
[2009/06/18 16:24:59 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Jan Rijken\Application Data\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2011/07/29 21:16:03 | 000,001,052 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/29 21:16:00 | 000,000,464 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{DB14428F-5D41-4FB7-941C-F5A28B49E3B4}.job
[2011/07/29 20:51:33 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jan Rijken\Bureaublad\OTL.exe
[2011/07/29 09:33:02 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/07/29 08:10:58 | 004,157,170 | R--- | M] (Swearware) -- C:\Documents and Settings\Jan Rijken\Bureaublad\ComboFix.exe
[2011/07/28 23:16:03 | 000,001,048 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/28 20:42:01 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/07/28 20:41:47 | 536,403,968 | -HS- | M] () -- C:\hiberfil.sys
[2011/07/27 22:30:02 | 000,607,017 | R--- | M] (Swearware) -- C:\Documents and Settings\Jan Rijken\Bureaublad\dds.scr
[2011/07/27 22:29:13 | 001,915,904 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Jan Rijken\Bureaublad\aswMBR.exe
[2011/07/27 22:23:55 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\2ur1cs3n.exe
[2011/07/27 17:12:19 | 000,000,794 | ---- | M] () -- C:\Documents and Settings\All Users\Bureaublad\Malwarebytes' Anti-Malware.lnk
[2011/07/25 10:15:03 | 000,000,414 | ---- | M] () -- C:\WINDOWS\AeDebugSave.reg
[2011/07/24 23:06:09 | 000,001,642 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\Update Checker.lnk
[2011/07/24 22:45:13 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/07/22 00:53:07 | 000,537,322 | ---- | M] () -- C:\WINDOWS\System32\perfh013.dat
[2011/07/22 00:53:07 | 000,444,348 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/07/22 00:53:07 | 000,101,956 | ---- | M] () -- C:\WINDOWS\System32\perfc013.dat
[2011/07/22 00:53:07 | 000,072,606 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/07/19 07:49:25 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011/07/15 02:23:39 | 000,001,823 | ---- | M] () -- C:\Documents and Settings\All Users\Bureaublad\Google Chrome.lnk
[2011/07/13 20:43:35 | 000,248,696 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/07/13 20:04:04 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/07/06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/07/02 16:27:15 | 000,000,891 | ---- | M] () -- C:\Documents and Settings\All Users\Bureaublad\Total Recorder.LNK

========== Files Created - No Company Name ==========

[2011/07/29 08:17:26 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/07/29 08:17:26 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/07/29 08:17:26 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/07/29 08:17:26 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/07/29 08:17:26 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/07/27 22:23:47 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\2ur1cs3n.exe
[2011/07/25 10:15:03 | 000,000,414 | ---- | C] () -- C:\WINDOWS\AeDebugSave.reg
[2011/07/24 23:06:09 | 000,001,648 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Menu Start\Programma's\Update Checker.lnk
[2011/07/24 23:06:09 | 000,001,642 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Bureaublad\Update Checker.lnk
[2011/07/24 20:28:48 | 000,000,763 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Secunia PSI Tray.lnk
[2011/07/15 09:21:18 | 536,403,968 | -HS- | C] () -- C:\hiberfil.sys
[2011/07/02 16:27:15 | 000,000,891 | ---- | C] () -- C:\Documents and Settings\All Users\Bureaublad\Total Recorder.LNK
[2011/04/30 16:37:30 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys
[2010/01/17 19:58:23 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009/12/21 22:06:41 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/09/02 22:01:42 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\Dtctrace.dll
[2009/09/01 22:05:26 | 000,010,240 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2009/06/19 10:01:08 | 000,000,030 | ---- | C] () -- C:\WINDOWS\capture.ini
[2009/06/19 10:00:23 | 000,000,412 | ---- | C] () -- C:\WINDOWS\mapping.ini
[2009/06/19 09:59:56 | 000,001,145 | ---- | C] () -- C:\WINDOWS\addrbook.ini
[2009/06/19 09:59:27 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\uninst.exe
[2009/06/19 09:59:27 | 000,000,102 | ---- | C] () -- C:\WINDOWS\dvr2.ini
[2009/06/18 17:28:01 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2009/06/18 17:07:45 | 000,000,146 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Application Data\default.pls
[2009/06/18 17:06:44 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/06/18 16:24:59 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Application Data\ezpinst.exe
[2009/06/18 16:24:59 | 000,007,824 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Application Data\pcouffin.cat
[2009/06/18 16:24:59 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Application Data\pcouffin.inf
[2009/06/16 00:25:19 | 000,000,133 | ---- | C] () -- C:\Documents and Settings\Jan Rijken\Local Settings\Application Data\fusioncache.dat
[2009/06/15 21:57:38 | 000,000,395 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/05/26 22:22:14 | 000,017,438 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2008/05/26 22:22:10 | 000,023,146 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2008/05/26 22:22:06 | 000,016,842 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2008/05/26 21:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 21:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2007/08/29 09:02:57 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2007/08/28 23:23:46 | 000,004,207 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2007/08/28 23:22:33 | 000,248,696 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2007/08/28 22:43:29 | 000,000,025 | ---- | C] () -- C:\WINDOWS\mixerdef.ini
[2007/08/28 22:37:59 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI
[2007/08/28 21:48:52 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2007/08/28 21:41:16 | 000,021,748 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003/04/07 13:10:22 | 000,005,443 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/11/19 15:46:20 | 000,039,104 | ---- | C] () -- C:\WINDOWS\cmijack.dat
[2002/11/19 15:43:38 | 000,022,178 | ---- | C] () -- C:\WINDOWS\cmaudio.dat
[2002/09/11 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002/09/11 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2002/09/11 14:00:00 | 000,537,322 | ---- | C] () -- C:\WINDOWS\System32\perfh013.dat
[2002/09/11 14:00:00 | 000,444,348 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2002/09/11 14:00:00 | 000,318,670 | ---- | C] () -- C:\WINDOWS\System32\perfi013.dat
[2002/09/11 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2002/09/11 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2002/09/11 14:00:00 | 000,101,956 | ---- | C] () -- C:\WINDOWS\System32\perfc013.dat
[2002/09/11 14:00:00 | 000,072,606 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2002/09/11 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2002/09/11 14:00:00 | 000,039,178 | ---- | C] () -- C:\WINDOWS\System32\perfd013.dat
[2002/09/11 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2002/09/11 14:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2002/09/11 14:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2002/09/11 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2011/07/28 20:50:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Badoo
[2010/01/21 21:03:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HiYo
[2011/04/25 15:03:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Installations
[2010/09/13 13:04:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Suite
[2011/03/07 23:33:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2011/03/07 23:41:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2011/07/25 14:09:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
[2009/06/18 18:17:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\Bidgood Svcs
[2011/04/09 10:03:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\DDMSettings
[2009/08/16 16:03:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\HiYo
[2009/06/18 17:16:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\ImgBurn
[2010/09/13 13:06:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\Nokia
[2010/09/13 13:04:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\PC Suite
[2009/06/19 14:38:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\TeamViewer
[2011/07/02 16:28:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\TotalRecorder
[2009/06/18 16:25:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\Vso
[2009/06/16 00:19:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\Windows Desktop Search
[2009/06/18 23:16:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jan Rijken\Application Data\Windows Search
[2011/07/29 21:16:00 | 000,000,464 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{DB14428F-5D41-4FB7-941C-F5A28B49E3B4}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2007/08/28 21:45:19 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2007/08/28 22:18:58 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/07/24 22:45:13 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2002/09/11 14:00:00 | 000,004,952 | RHS- | M] () -- C:\Bootfont.bin
[2004/08/04 00:00:14 | 000,261,936 | RHS- | M] () -- C:\cmldr
[2011/07/29 08:51:22 | 000,010,427 | ---- | M] () -- C:\ComboFix.txt
[2007/08/28 21:45:19 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2011/04/28 19:48:11 | 000,000,616 | ---- | M] () -- C:\eset1 log.txt
[2011/07/28 20:41:47 | 536,403,968 | -HS- | M] () -- C:\hiberfil.sys
[2007/08/28 21:45:19 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2011/04/27 20:52:29 | 000,039,838 | ---- | M] () -- C:\JavaRa.log
[2007/08/28 21:45:19 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2007/08/28 22:11:18 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2009/06/15 22:31:12 | 000,251,712 | RHS- | M] () -- C:\ntldr
[2011/07/29 09:32:33 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys
[2009/06/17 22:17:14 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2009/06/17 22:17:14 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2007/08/28 21:44:41 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 14:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 12:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/04/17 02:11:10 | 000,307,056 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2007/08/28 23:21:18 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2007/08/28 23:21:18 | 000,630,784 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2007/08/28 23:21:18 | 000,413,696 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/08/28 21:59:26 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Application Data\Microsoft\Internet Explorer\Quick Launch\Bureaublad weergeven.scf
[2007/08/28 22:29:18 | 000,000,189 | -HS- | M] () -- C:\Documents and Settings\Jan Rijken\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2010/06/07 21:58:42 | 000,000,130 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Application Data\Microsoft\Internet Explorer\Quick Launch\Hifiketens vergelijken en vind de goedkoopste hifi keten op VERGELIJK.BE.url

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/07/29 09:05:57 | 000,131,072 | ---- | M] () -- C:\Documents and Settings\Jan Rijken\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/27 15:57:10 | 000,317,952 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/14 19:02:23 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2002/09/11 14:00:00 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2002/08/20 12:32:18 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2002/04/11 12:00:02 | 000,000,898 | ---- | M] () -- C:\Program Files\Messenger\mailtmpl.txt
[2008/05/02 16:05:59 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 19:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/14 19:03:07 | 001,695,232 | -HS- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2002/08/20 15:08:38 | 000,069,663 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgsin.exe
[2002/09/11 14:00:00 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2002/09/11 14:00:00 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2002/09/11 14:00:00 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2002/08/20 12:32:20 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/07/17 11:35:48 | 000,118,265 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< MD5 for: DWWIN.EXE >
[2004/08/04 01:03:30 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=AAE33D1ED1238E834B4F5FE214EAC59E -- C:\WINDOWS\$NtServicePackUninstall$\dwwin.exe
[2008/04/14 19:02:56 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=DD80524C67AF4017A7ABE51C99D1A33A -- C:\WINDOWS\ServicePackFiles\i386\dwwin.exe
[2008/04/14 19:02:56 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=DD80524C67AF4017A7ABE51C99D1A33A -- C:\WINDOWS\system32\dwwin.exe

< >

< End of report >

 

extras log

OTL Extras logfile created on: 29/07/2011 20:53:46 - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\Jan Rijken\Bureaublad
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000813 | Country: België | Language: NLB | Date Format: d/MM/yyyy

511,49 Mb Total Physical Memory | 117,64 Mb Available Physical Memory | 23,00% Memory free
2,38 Gb Paging File | 1,63 Gb Available in Paging File | 68,45% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 44,73 Gb Total Space | 28,25 Gb Free Space | 63,16% Space Free | Partition Type: NTFS
Drive D: | 87,89 Gb Total Space | 71,00 Gb Free Space | 80,78% Space Free | Partition Type: NTFS
Drive E: | 16,43 Gb Total Space | 14,75 Gb Free Space | 89,75% Space Free | Partition Type: NTFS
Drive H: | 232,88 Gb Total Space | 210,19 Gb Free Space | 90,26% Space Free | Partition Type: NTFS

Computer Name: JAN | User Name: Jan Rijken | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Google\Google Talk\googletalk.exe" = C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk -- (Google)
"C:\networkdvr\remote.exe" = C:\networkdvr\remote.exe:*:Enabled:remote -- ()


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00E1E235-AB45-4695-A156-073118949ED4}" = HiYo
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{101738D7-D805-37A9-BB91-1F2C351782BF}" = Microsoft .NET Framework 3.5 Language Pack SP1 - nld
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{168F8BAC-A269-48E9-BB7A-A51B594CF6FF}" = Microsoft .NET Framework 1.1 Dutch Language Pack
"{1BD6AE96-4742-4498-9D03-9451C7E5A214}" = Windows Live aanmeldhulp
"{1D10C273-3F95-42A2-8371-AB6B1F59821B}" = WOT for Internet Explorer
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live - Hulpprogramma voor uploaden
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26
"{2869F5EA-93C3-48E5-80DF-DB696BC84A91}" = Windows Live Mail
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C9413-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35CA031C-D3CD-4A28-8D9B-C71466C4F045}" = Windows Live Writer
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{41DFDD57-21B7-4C48-8C75-FFB35696CA8B}" = Windows Live Toolbar
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{64371D22-A18B-436E-863B-2E12DA8042FF}" = Microsoft .NET Framework 3.0 Dutch Language Pack
"{655A0785-CB7A-42C2-A1AE-B3FE1BFB2617}" = Windows Presentation Foundation Language Pack (NLD)
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{6FEC9863-5EF2-4A07-9D0B-CA81B47E3F59}" = Windows Live Photo Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{842BEE12-CCCB-43F4-ABAF-CBA6DFE2583D}" = Nero BurnLite 10
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90110413-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Editie 2003
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0413-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9A1027CE-83F6-3CB2-B9BA-9DA38D0907D0}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - NLD
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A36B158D-8E9D-4BD3-8BDA-4B5EDC9C2E8C}" = Norman Security Suite
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB627AF2-9C7E-4DBD-816B-3B2646B81E89}" = Nero BurnLite 10
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.0)
"{AC76BA86-7AD7-1043-7B44-A94000000001}" = Adobe Reader 9.4.3 - Nederlands
"{B00ACF0E-0520-468C-B01E-7A5E8CC48F2F}" = Badoo Desktop
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C20C2630-B3A7-44BA-BDD0-31E256AE490E}" = Windows Live Call
"{CAEB2BE8-EF9E-4BFE-8165-3B54B62AF6CF}" = Windows Live Family Safety
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC38A00D-7EED-46CE-9281-D1D97B81F22A}" = Windows Live Messenger
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D6C9AF27-9414-46C8-B9D8-D878BA041033}" = Nero 8
"{E34F703A-1C9D-4B1F-ABBE-D7E8800B860D}" = Windows Live Sync
"{EB5A3E9D-91CF-4C97-B816-72DE0625ACA3}" = Windows Live Essentials
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F73EA8BF-81F5-32AF-8D8A-24F12FD23B79}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - NLD
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-stuurprogrammapakket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Belarc Advisor" = Belarc Advisor 8.1
"CCleaner" = CCleaner
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX Setup
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Shrink_is1" = DVD Shrink 3.2
"DVDFab Platinum_is1" = DVDFab Platinum 3.0.7.0
"FileHippo.com" = FileHippo.com Update Checker
"Google Chrome" = Google Chrome
"HijackThis" = HijackThis 2.0.2
"HiYo" = HiYo
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"ImgBurn" = ImgBurn
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware versie 1.51.1.1800
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.0 Dutch Language Pack" = Microsoft .NET Framework 3.0 Nederlands taalpakket
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA" = NVIDIA Windows 2000/XP Display Drivers
"Off-linediensten van Home'Bank_is1" = Off-linediensten van Home'Bank 4.55
"PCI Audio Driver" = PCI Audio Driver
"Picture Resize_is1" = Free Picture Resize Starter 4.5
"Secunia PSI" = Secunia PSI (2.0.0.3001)
"SequoiaView" = SequoiaView
"SystemRequirementsLab" = System Requirements Lab
"TibetSystem - Uninstall Borinato DVR Client" = Uninstall Borinato DVR Client
"TotalRecorder" = Total Recorder 8.2
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.01 (32-bit)
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 24/07/2011 17:06:22 | Computer Name = JAN | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 updatechecker.exe, P2 1.38.0.0, P3 4c5ff8fb,
P4 system.configuration, P5 2.0.0.0, P6 4889de74, P7 1a6, P8 136, P9 ioibmurhynrxkw0zxkyrvfn0boyyufow,
P10 NIL.

Error - 25/07/2011 4:34:17 | Computer Name = JAN | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 updatechecker.exe, P2 1.38.0.0, P3 4c5ff8fb,
P4 system.configuration, P5 2.0.0.0, P6 4889de74, P7 1a6, P8 136, P9 ioibmurhynrxkw0zxkyrvfn0boyyufow,
P10 NIL.

Error - 26/07/2011 11:17:09 | Computer Name = JAN | Source = Application Hang | ID = 1002
Description = Vastgelopen toepassing: msnmsgr.exe, versie: 14.0.8117.416, vastgelopen
module: hungapp, versie: 0.0.0.0, vastgelopen op: 0x00000000.

Error - 26/07/2011 11:27:14 | Computer Name = JAN | Source = Application Hang | ID = 1002
Description = Vastgelopen toepassing: iexplore.exe, versie: 8.0.6001.18702, vastgelopen
module: hungapp, versie: 0.0.0.0, vastgelopen op: 0x00000000.

Error - 26/07/2011 12:18:22 | Computer Name = JAN | Source = Application Hang | ID = 1002
Description = Vastgelopen toepassing: msnmsgr.exe, versie: 14.0.8117.416, vastgelopen
module: hungapp, versie: 0.0.0.0, vastgelopen op: 0x00000000.

Error - 26/07/2011 12:56:49 | Computer Name = JAN | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 updatechecker.exe, P2 1.38.0.0, P3 4c5ff8fb,
P4 system.configuration, P5 2.0.0.0, P6 4889de74, P7 1a6, P8 136, P9 ioibmurhynrxkw0zxkyrvfn0boyyufow,
P10 NIL.

Error - 28/07/2011 5:51:56 | Computer Name = JAN | Source = Application Hang | ID = 1002
Description = Vastgelopen toepassing: mbam.exe, versie: 1.51.1.1076, vastgelopen
module: hungapp, versie: 0.0.0.0, vastgelopen op: 0x00000000.

Error - 28/07/2011 5:51:56 | Computer Name = JAN | Source = Application Hang | ID = 1002
Description = Vastgelopen toepassing: mbam.exe, versie: 1.51.1.1076, vastgelopen
module: hungapp, versie: 0.0.0.0, vastgelopen op: 0x00000000.

Error - 28/07/2011 5:51:56 | Computer Name = JAN | Source = Application Hang | ID = 1002
Description = Vastgelopen toepassing: mbam.exe, versie: 1.51.1.1076, vastgelopen
module: hungapp, versie: 0.0.0.0, vastgelopen op: 0x00000000.

Error - 28/07/2011 14:44:48 | Computer Name = JAN | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 updatechecker.exe, P2 1.38.0.0, P3 4c5ff8fb,
P4 system.configuration, P5 2.0.0.0, P6 4889de74, P7 1a6, P8 136, P9 ioibmurhynrxkw0zxkyrvfn0boyyufow,
P10 NIL.

[ System Events ]
Error - 24/07/2011 14:22:37 | Computer Name = JAN | Source = Service Control Manager | ID = 7000
Description = De Norman NJeeves-service kan vanwege de volgende fout niet worden
gestart: %%1053

Error - 26/07/2011 9:42:15 | Computer Name = JAN | Source = SideBySide | ID = 16842811
Description = Generate Activation Context mislukt voor C:\WINDOWS\system32\comctl32.dll.
Foutmelding
voor referentie: Error Message is unavailable .

Error - 26/07/2011 10:35:43 | Computer Name = JAN | Source = Service Control Manager | ID = 7034
Description = De Secunia PSI Agent-service is onverwacht beëindigd. Dit is nu 1
keer gebeurd.

Error - 26/07/2011 10:35:52 | Computer Name = JAN | Source = DCOM | ID = 10010
Description = De server {9E175B68-F52A-11D8-B9A5-505054503030} heeft zich binnen
de vereiste termijn niet bij DCOM geregistreerd.

Error - 26/07/2011 10:37:52 | Computer Name = JAN | Source = DCOM | ID = 10010
Description = De server {9E175B68-F52A-11D8-B9A5-505054503030} heeft zich binnen
de vereiste termijn niet bij DCOM geregistreerd.

Error - 26/07/2011 10:49:47 | Computer Name = JAN | Source = DCOM | ID = 10010
Description = De server {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} heeft zich binnen
de vereiste termijn niet bij DCOM geregistreerd.

Error - 26/07/2011 11:17:32 | Computer Name = JAN | Source = DCOM | ID = 10010
Description = De server {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} heeft zich binnen
de vereiste termijn niet bij DCOM geregistreerd.

Error - 26/07/2011 11:19:32 | Computer Name = JAN | Source = DCOM | ID = 10010
Description = De server {9E175B68-F52A-11D8-B9A5-505054503030} heeft zich binnen
de vereiste termijn niet bij DCOM geregistreerd.

Error - 26/07/2011 12:20:25 | Computer Name = JAN | Source = DCOM | ID = 10010
Description = De server {9E175B68-F52A-11D8-B9A5-505054503030} heeft zich binnen
de vereiste termijn niet bij DCOM geregistreerd.

Error - 26/07/2011 12:20:57 | Computer Name = JAN | Source = Service Control Manager | ID = 7034
Description = De NMIndexingService-service is onverwacht beëindigd. Dit is nu 1
keer gebeurd.


< End of report >

 

Well, so far so good. But i haven't shut down my pc yet. So i wouldn't know yet. This is the checkup; log:

Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Norman Security Suite
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
CCleaner
Java(TM) 6 Update 26
Out of date Java installed!
Adobe Flash Player
Adobe Reader X (10.1.0)
Adobe Reader 9.4.3 - Nederlands
````````````````````````````````
Process Check:
objlist.exe by Laurent
Malwarebytes' Anti-Malware mbamservice.exe
Malwarebytes' Anti-Malware mbamgui.exe
``````````End of Log````````````

 

tfc problems

By starting up TFC my pc got stuck. Nothing seems to be working. TFC wasn't responding. Even ending the TFC task wasn't responding. So i had to close down my pc by hand. After that i will run the eset. I'm sending this with my other pc. Sorry.

 

Tfc

By starting up my pc i could run the TFC. So, that's all right now. Now i'm running the eset, that will take a while. I let you know. Thanks for the help!!!!!!

 

No everything looks fine now. Thanks.

 

eset log

C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP134\A0008089.exe Win32/RegistryBooster application cleaned by deleting - quarantined
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP134\A0008090.exe Win32/RegistryBooster application cleaned by deleting - quarantined
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP134\A0008091.exe Win32/RegistryBooster application cleaned by deleting - quarantined
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP134\A0008092.exe Win32/RegistryBooster application cleaned by deleting - quarantined
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP134\A0008093.exe Win32/RegistryBooster application cleaned by deleting - quarantined
C:\System Volume Information\_restore{10653A04-BA63-4562-BDEC-F4804E906485}\RP134\A0008094.exe Win32/RegistryBooster application cleaned by deleting - quarantined
D:\download\9Down.COM___Hirens.BootCD.9.7.with.keyboardpatch\Hiren's.BootCD.9.7.iso probably unknown NewHeur_PE virus deleted - quarantined


When the pc comes out of non-activity in the morning it is slow but after that it's not that slow anymore. Once it was faster.

For now i think everything looks good! Thank you!

 

OTL log

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Jan Rijken
->Temp folder emptied: 390148 bytes
->Temporary Internet Files folder emptied: 1811228 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

User: LocalService
->Temp folder emptied: 275267825 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: software

User: vreemde
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 265,00 mb


[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User

User: Jan Rijken
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: software

User: vreemde

Total Flash Files Cleaned = 0,00 mb

Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.26.1 log created on 07302011_194234

Files\Folders moved on Reboot...
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\KPQR5MFP\01[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\KPQR5MFP\15175-127174-39835-1[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\KPQR5MFP\B5230255[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\KPQR5MFP\Messenger[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\JUVKM0TV\default[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\JUVKM0TV\messengerscripttracking[1].aspx moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\JUVKM0TV\refresh_auth[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\JUVKM0TV\resourcespreload[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\JUVKM0TV\resourcespreload[2].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\9SO3G2NH\99791-active-malware-virus-removal-logs-requested-part-1-a-2[1].html moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\9SO3G2NH\adloader[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\9SO3G2NH\ADSAdClient31[1].txt moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\9SO3G2NH\EditMessageLight[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\9SO3G2NH\RteFrame_16.0.1702.0709[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\245KCZ1E\01[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\245KCZ1E\LocalStorage[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\245KCZ1E\xmlProxy[1].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\Content.IE5\245KCZ1E\xmlProxy[2].htm moved successfully.
C:\Documents and Settings\Jan Rijken\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
File\Folder C:\Documents and Settings\LocalService\Local Settings\Temp\nvcbin.def.3c6d0ea9.tmp not found!

Registry entries deleted on Reboot...
Thanks for your help, Broni!!!

So all the problems, all the errors, i had a few days ago are solved?