Opgelost - Fonts telkens weer verdwenen/verwijderd

[jasper936]

hallo,
Ik heb het probleem dat al mijn fonts keer op keer verdwenen zijn.
Zelf heb ik al op virussen gescant (Avira Antivir Personal) en op malware (Malwarebytes' Anti-Malware). Als ik alle fonts heb terug gezet, deze heb ik gekopieërd van een andere computer met windows XP, verdwijnen ze telkens nadat ik mijn computer heb afgesloten. Als ik uitlog blijven ze wel staan.
Mvg Jasper
p.s. In de bijlage staat de uninstall list.

HijackThis Log
Created with: Hijack This kleurcodering

Zelf een logje plaatsen? Klik eerst hier.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:47:12, on 9-3-2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
c:\windows\system32\smss.exe
c:\windows\system32\winlogon.exe
c:\windows\system32\services.exe
c:\windows\system32\lsass.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\windows\system32\spoolsv.exe
c:\program files\avira\antivir desktop\sched.exe
c:\program files\avira\antivir desktop\avguard.exe
c:\program files\bonjour\mdnsresponder.exe
c:\program files\common files\intervideo\regmgr\iviregmgr.exe
c:\program files\java\jre6\bin\jqs.exe
c:\program files\common files\protexis\license service\psiservice_2.exe
c:\windows\system32\svchost.exe
c:\windows\explorer.exe
c:\program files\avira\antivir desktop\avgnt.exe
c:\windows\soundman.exe
c:\windows\alcwzrd.exe
c:\windows\alcmtr.exe
c:\program files\java\jre6\bin\jusched.exe
c:\windows\system32\ctfmon.exe
c:\program files\windows live\messenger\msnmsgr.exe
c:\program files\philips\gogear sa19xx device manager\main.exe
c:\program files\windows live\contacts\wlcomm.exe
c:\program files\java\jre6\bin\jucheck.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\trend micro\hijackthis\hijackthis.exe

r0 - hkcu\software\microsoft\internet explorer\main,start page = http://www.google.nl/
r1 - hklm\software\microsoft\internet explorer\main,default_page_url = http://go.microsoft.com/fwlink/?linkid=69157
r1 - hklm\software\microsoft\internet explorer\main,default_search_url = http://go.microsoft.com/fwlink/?linkid=54896
r1 - hklm\software\microsoft\internet explorer\main,search page = http://go.microsoft.com/fwlink/?linkid=54896
r0 - hklm\software\microsoft\internet explorer\main,start page = http://www.nixat.com/
r1 - hkcu\software\microsoft\windows\currentversion\int ernet settings,proxyoverride = *.local
o2 - bho: acroiehelperstub - {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll
o2 - bho: skype add-on (mastermind) - {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - (no file)
o2 - bho: spybot-s&d ie protection - {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\sdhelper.dll
o2 - bho: (no name) - {5c255c8a-e604-49b4-9d64-90988571cecb} - (no file)
o2 - bho: windows live aanmelden - help - {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
o2 - bho: vmn toolbar astro gemini - {a057a204-bacc-4d26-8287-79a187e26987} - c:\progra~1\vmntoo~1\vmntoo~1.dll
o2 - bho: ask toolbar bho - {d4027c7f-154a-4066-a1ad-4243d8127440} - (no file)
o2 - bho: java(tm) plug-in 2 ssv helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
o2 - bho: jqsiestartdetectorimpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
o3 - toolbar: ask toolbar - {d4027c7f-154a-4066-a1ad-4243d8127440} - (no file)
o3 - toolbar: vmn toolbar astro gemini - {a057a204-bacc-4d26-8287-79a187e26987} - c:\progra~1\vmntoo~1\vmntoo~1.dll
o4 - hklm\..\run: [avgnt] c:\program files\avira\antivir desktop\avgnt.exe /min
o4 - hklm\..\run: [soundman] soundman.exe
o4 - hklm\..\run: [alcwzrd] alcwzrd.exe
o4 - hklm\..\run: [alcmtr] alcmtr.exe
o4 - hklm\..\run: [sunjavaupdatesched] c:\program files\java\jre6\bin\jusched.exe
o4 - hklm\..\run: [nerofiltercheck] c:\program files\common files\ahead\lib\nerocheck.exe
o4 - hklm\..\run: [adobe reader speed launcher] c:\program files\adobe\reader 9.0\reader\reader_sl.exe
o4 - hklm\..\run: [adobe arm] c:\program files\common files\adobe\arm\1.0\adobearm.exe
o4 - hklm\..\run: [quicktime task] c:\program files\quicktime\qttask.exe -atboottime
o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe
o4 - hkcu\..\run: [msnmsgr] c:\program files\windows live\messenger\msnmsgr.exe /background
o4 - hkcu\..\run: [pando media booster] c:\program files\pando networks\media booster\pmb.exe
o4 - hkus\s-1-5-19\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'local service')
o4 - hkus\s-1-5-20\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'network service')
o4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')
o4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')
o4 - global startup: philips sa19xx device manager.lnk = c:\program files\philips\gogear sa19xx device manager\main.exe
o8 - extra context menu item: e&xporteren naar microsoft excel - res://c:\progra~1\micros~2\office11\excel.exe/3000
o9 - extra button: (no name) - {5067a26b-1337-4436-8afe-ee169c2da79f} - c:\windows\system32\shdocvw.dll
o9 - extra 'tools' menuitem: skype add-on for internet explorer - {5067a26b-1337-4436-8afe-ee169c2da79f} - c:\windows\system32\shdocvw.dll
o9 - extra button: skype - {77bf5300-1474-4ec7-9980-d32b190e9b07} - c:\windows\system32\shdocvw.dll
o9 - extra button: onderzoek - {92780b25-18cc-41c8-b9be-3c9c571a8263} - c:\progra~1\micros~2\office11\refiebar.dll
o9 - extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - c:\progra~1\spybot~1\sdhelper.dll
o9 - extra 'tools' menuitem: spybot - search & destroy configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - c:\progra~1\spybot~1\sdhelper.dll
o9 - extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra 'tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra button: messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o9 - extra 'tools' menuitem: windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o16 - dpf: {1e54d648-b804-468d-bc78-4affed8e262f} (system requirements lab) - http://www.nvidia.com/content/driverdownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
o16 - dpf: {20a60f0d-9afa-4515-a0fd-83bd84642501} (checkers class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
o16 - dpf: {40f576ad-8680-4f9e-9490-99d069cd665f} (system requirements lab class) - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
o16 - dpf: {5c051655-fcd5-4969-9182-770ea5aa5565} (solitaire showdown class) - http://messenger.zone.msn.com/binary/solitaireshowdown.cab56986.cab
o16 - dpf: {5d6f45b3-9043-443d-a792-115447494d24} (unoctrl class) - http://messenger.zone.msn.com/messengergamescontent/gamecontent/nl/uno1/game_uno1.cab
o16 - dpf: {67dabfbf-d0ab-41fa-9c46-cc0f21721616} (divxbrowserplugin object) - http://download.divx.com/player/divxbrowserplugin.cab
o16 - dpf: {c3f79a2b-b9b4-4a66-b012-3ee46475b072} (messengerstatsclient class) - http://messenger.zone.msn.com/binary/messengerstatspaclient.cab56907.cab
o16 - dpf: {c9a2cbf3-b7f9-463e-a690-82cc077dcfc6} (zemidetecthardware control) - http://www.4story.com/active_x/zemidetecthardware.cab
o16 - dpf: {e2883e8f-472f-4fb0-9522-ac9bf37916a7} - http://platformdl.adobe.com/nos/getplusplus/1.6/gp.cab
o16 - dpf: {f5a7706b-b9c0-4c89-a715-7a0c6b05dd48} (minesweeper flags class) - http://messenger.zone.msn.com/binary/minesweeper.cab56986.cab
o23 - service: avira antivir scheduler (antivirschedulerservice) - avira gmbh - c:\program files\avira\antivir desktop\sched.exe
o23 - service: avira antivir guard (antivirservice) - avira gmbh - c:\program files\avira\antivir desktop\avguard.exe
o23 - service: avira upgrade service (antivirupgradeservice) - unknown owner - c:\docume~1\jasper\locals~1\temp\avsetup_4ae47998\ basic\avupgsvc.exe (file missing)
o23 - service: bonjour-service (bonjour service) - apple inc. - c:\program files\bonjour\mdnsresponder.exe
o23 - service: google updateservice (gupdate) (gupdate) - google inc. - c:\program files\google\update\googleupdate.exe
o23 - service: installdriver table manager (idrivert) - macrovision corporation - c:\program files\common files\installshield\driver\1050\intel 32\idrivert.exe
o23 - service: iviregmgr - intervideo - c:\program files\common files\intervideo\regmgr\iviregmgr.exe
o23 - service: java quick starter (javaquickstarterservice) - sun microsystems, inc. - c:\program files\java\jre6\bin\jqs.exe
o23 - service: nbservice - nero ag - c:\program files\nero\nero 7\nero backitup\nbservice.exe
o23 - service: protexis licensing v2 (psi_svc_2) - protexis inc. - c:\program files\common files\protexis\license service\psiservice_2.exe
--
end of file - 8822 bytes

D Drmmr's HJT kleurcodering; gemaakt voor het NCF (www.nationaalcomputerforum.nl)

µTorrent
3DVIA player 5.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3 - Nederlands
Adobe Shockwave Player 11.5
Apple Application Support
Avira AntiVir Personal - Free Antivirus
Bonjour
Compatibility Pack for the 2007 Office system
Easy DVD Player 2.0
Fable - The Lost Chapters
Fontlist
GoGear SA19xx Device Manager
Google Earth
Google Update Helper
GrabIt 1.7.2 Beta 4 (build 997)
Guild Wars
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Java(TM) 6 Update 16
LimeWire 5.4.8
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Editie 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.5.5)
MSN
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 7 Ultra Edition
OGA Notifier 2.0.0048.0
Pando Media Booster
QuickPar 0.9
QuickTime
Realtek High Definition Audio Driver
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
Segoe UI
Skype web features
Smarty Uninstaller Pro 2006
Spybot - Search & Destroy
System Requirements Lab
System Requirements Lab
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB973874)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB973687)
Ventrilo Client
VentriloMIX
Victory media converter
Visual C++ 8.0 MFC (x86) WinSXS MSM
Visual C++ 8.0 MFC.Policy (x86) WinSXS MSM
VLC media player 1.0.5
VMN Toolbar
Windows Internet Explorer 8
Windows Live - Hulpprogramma voor uploaden
Windows Live aanmeldhulp
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
WinRAR archiver
World of Warcraft
YouTube Downloader 2.5.3

[Abraham54]

Hallo Jasper, ik vraag je hierbij de de opdrachten specifiek in de volgorde af te werken - zoals ik deze heb gepost!

•1•
Deaktiveer SDHelper van Spybot tijdens de fix want dit onderdeel kan veranderingen ongedaan maken.

• Start Spybot S&D
• Ga naar het Mode menu en selecteer "Advanced Mode"
• In de linker kolom kies "Tools" (of gereedschap ) en klik op > Resident
• Uitvinken "Resident SDHelper" en sluit Spybot S&D.

•2•
Ga naar Start\Configuratiescherm\Software en verwijder daar

• vmn toolbar astro gemini

Deze toolbar heeft ondertussen heel wat over jouw surfgedrag doorgezonden!


•3•
Sluit alle openstaande vensters en start dan HijackThis en klik op de knop Do a Scan only,

• zet een vinkje voor die regel(s) welke met de onderstaande regels corresponderen
• vervolgens klik je daarna op de knop Fix checked

r1 - hkcu\software\microsoft\windows\currentversion\int ernet settings,proxyoverride = *.local
o2 - bho: skype add-on (mastermind) - {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - (no file)
o2 - bho: vmn toolbar astro gemini - {a057a204-bacc-4d26-8287-79a187e26987} - c:\progra~1\vmntoo~1\vmntoo~1.dll
o3 - toolbar: ask toolbar - {d4027c7f-154a-4066-a1ad-4243d8127440} - (no file)
o3 - toolbar: vmn toolbar astro gemini - {a057a204-bacc-4d26-8287-79a187e26987} - c:\progra~1\vmntoo~1\vmntoo~1.dll


•4•
Daarom het volgende: laat Combofix jouw Windows scannen (klik).

• Om Combofix te kunnen gebruiken geldt het volgende:
• er mogen geen webbrowsers openstaan
• antivirus moet geheel gedeaktiveerd zijn
• actieve mal- en spywarescanners moeten gedeaktiveerd zijn.
  
• Niet in het actieve Combofixvnster klikken – dit zal Combofix doen bevriezen!
  
• Combofix sluit de internet verbinding – probeer deze tussentijds niet te herstellen!
  
• Vistagebruikers starten Combofix op met Administratorrechten!
• En vergeten niet Windows Defender tijdelijk uit te schakelen: zie daarvoor http://windowshelp.microsoft.com/Win...bf0dc1043.mspx
  .
  
• Hier vindt je gegevens hoe antivirus te deaktiveren http://www.bleepingcomputer.com/forums/topic114351.html
  
  
• Post aansluitend het Combofix log via de kleurcodeerder.

[jasper936]

Ik heb gedaan wat je daarboven hebt beschreven.
Hier is de log die je vroeg.
Gr Jasper

HijackThis Log
Created with: Hijack This kleurcodering

Zelf een logje plaatsen? Klik eerst hier.

combofix 10-03-09.08 - jasper 10-03-2010 14:23:18.1.1 - x86
microsoft windows xp professional 5.1.2600.3.1252.1.1033.18.2039.1678 [gmt 1:00]
running from: c:\documents and settings\jasper\desktop\combofix.exe
av: antivir desktop *on-access scanning disabled* (updated) {ad166499-45f9-482a-a743-fdd3350758c7}
* created a new restore point
.
((((((((((((((((((((((((( files created from 2010-02-10 to 2010-03-10 )))))))))))))))))))))))))))))))
.
2010-03-09 20:46 . 2010-03-09 20:46 -------- d-----w- c:\program files\trend micro
2010-03-07 21:41 . 2010-03-07 21:41 -------- d-----w- c:\documents and settings\jasper\application data\malwarebytes
2010-03-07 21:40 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-07 21:40 . 2010-03-07 21:40 -------- d-----w- c:\documents and settings\all users\application data\malwarebytes
2010-03-07 21:40 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-07 21:40 . 2010-03-07 21:41 -------- d-----w- c:\program files\malwarebytes' anti-malware
2010-03-07 20:26 . 2010-03-07 20:26 -------- d-----w- c:\program files\fontlist
2010-03-02 15:32 . 2010-03-02 15:32 -------- d-----w- c:\program files\easy dvd player
2010-02-20 14:42 . 2010-03-09 20:45 -------- d-----w- c:\documents and settings\jasper\application data\vlc
2010-02-20 14:39 . 2010-02-20 14:39 -------- d-----w- c:\program files\videolan
2010-02-20 14:23 . 2010-02-20 14:23 8192 ----a-w- c:\documents and settings\jasper\application data\limewire\browser\xulrunner\accessiblemarshal.dll
2010-02-20 14:23 . 2010-02-20 14:23 20480 ----a-w- c:\documents and settings\jasper\application data\limewire\browser\xulrunner\ia2marshal.dll
2010-02-10 13:50 . 2009-12-04 18:22 455424 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-10 13:50 . 2009-12-08 18:20 2145280 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-02-10 13:50 . 2009-12-08 17:40 2023936 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
.
(((((((((((((((((((((((((((((((((((((((( find3m report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2010-03-06 12:30 . 2009-10-28 11:17 -------- d-----w- c:\program files\divx
2010-03-06 12:27 . 2010-01-31 18:56 -------- d-----w- c:\program files\common files\apple
2010-03-02 15:24 . 2010-01-04 18:20 -------- d-----w- c:\documents and settings\jasper\application data\dvdcss
2010-02-20 14:48 . 2009-11-30 13:02 -------- d-----w- c:\documents and settings\jasper\application data\limewire
2010-02-20 14:21 . 2009-12-04 08:25 -------- d-----w- c:\program files\limewire
2010-02-10 15:07 . 2010-02-03 21:27 -------- d-----w- c:\program files\world of warcraft
2010-02-06 23:22 . 2010-02-06 23:22 -------- d-----w- c:\program files\victory nederland
2010-02-06 23:11 . 2009-10-30 14:46 -------- d-----w- c:\documents and settings\jasper\application data\grabit
2010-02-05 15:48 . 2010-02-05 15:48 -------- d-----w- c:\documents and settings\jasper\application data\office genuine advantage
2010-02-04 08:51 . 2009-12-30 22:18 -------- d-----w- c:\program files\google
2010-02-04 08:23 . 2010-02-04 07:56 -------- d-----w- c:\documents and settings\all users\application data\blizzard entertainment
2010-02-03 23:47 . 2010-02-03 17:38 -------- d-----w- c:\program files\common files\blizzard entertainment
2010-02-03 17:49 . 2010-02-03 17:49 -------- d-----w- c:\documents and settings\all users\application data\blizzard
2010-02-02 21:27 . 2010-02-02 21:27 -------- d-----w- c:\documents and settings\all users\application data\office genuine advantage
2010-02-01 19:44 . 2010-02-01 19:39 -------- d-----w- c:\program files\systemrequirementslab
2010-02-01 16:46 . 2010-02-01 15:25 -------- d-----w- c:\documents and settings\all users\application data\pmb files
2010-02-01 16:35 . 2009-10-25 14:13 48392 ----a-w- c:\documents and settings\jasper\local settings\application data\gdipfontcachev1.dat
2010-02-01 15:24 . 2010-02-01 15:24 -------- d-----w- c:\program files\pando networks
2010-01-31 19:01 . 2009-12-20 16:47 -------- d-----w- c:\documents and settings\jasper\application data\apple computer
2010-01-31 18:59 . 2010-01-31 18:59 -------- d-----w- c:\documents and settings\all users\application data\{755ac846-7372-4ac8-8550-c52491daa8bd}
2010-01-31 18:59 . 2009-12-19 15:06 -------- d-----w- c:\documents and settings\all users\application data\apple computer
2010-01-31 18:58 . 2010-01-31 18:58 -------- d-----w- c:\program files\bonjour
2010-01-31 18:58 . 2010-01-31 18:57 -------- d-----w- c:\program files\quicktime
2010-01-31 18:56 . 2010-01-31 18:56 -------- d-----w- c:\documents and settings\all users\application data\apple
2010-01-27 18:57 . 2009-10-28 14:28 -------- d-----w- c:\program files\common files\adobe
2010-01-20 16:56 . 2009-11-04 19:44 -------- d-----w- c:\program files\microsoft silverlight
2010-01-13 16:49 . 2010-01-04 16:56 2516 --sha-w- c:\documents and settings\all users\application data\kgygaavl.sys
2010-01-13 16:49 . 2010-01-04 16:56 2516 --sha-w- c:\documents and settings\all users\application data\kgygaavl.sys
2010-01-13 16:49 . 2010-01-04 16:56 88 --sh--r- c:\documents and settings\all users\application data\9dac9c0b7c.sys
2010-01-13 16:49 . 2010-01-04 16:56 88 --sh--r- c:\documents and settings\all users\application data\9dac9c0b7c.sys
2010-01-13 16:01 . 2010-01-13 16:01 -------- d-----w- c:\documents and settings\jasper\application data\canneverbe_limited
2010-01-13 16:01 . 2010-01-13 16:01 -------- d-----w- c:\documents and settings\all users\application data\canneverbe limited
2010-01-04 16:11 . 2010-01-03 11:02 53319 ----a-w- c:\documents and settings\all users\application data\temp\{a8516ac9-aaf1-47f9-9766-03e2d4cdbcf8}\postbuild.exe
2010-01-03 11:02 . 2010-01-03 11:03 29480 ----a-w- c:\windows\system32\msxml3a.dll
2010-01-03 11:02 . 2009-10-29 04:48 505128 ----a-w- c:\windows\system32\msvcp71.dll
2010-01-03 11:02 . 2009-10-29 04:48 353576 ----a-w- c:\windows\system32\msvcr71.dll
2009-12-31 16:50 . 2009-09-08 19:22 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2009-10-13 17:21 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2009-10-25 13:56 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
.
((((((((((((((((((((((((((((((((((((( reg loading points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*note* empty entries & legit default entries are not shown
regedit4
[hkey_current_user\software\microsoft\windows\curre ntversion\run]
"msnmsgr"=c:\program files\windows live\messenger\msnmsgr.exe [2009-07-26 3883856]
"pando media booster"=c:\program files\pando networks\media booster\pmb.exe [2010-02-01 2937528]
[hkey_local_machine\software\microsoft\windows\curr entversion\run]
"avgnt"=c:\program files\avira\antivir desktop\avgnt.exe [2009-03-02 209153]
"soundman"="soundman.exe" [2008-08-19 77824]
"alcwzrd"="alcwzrd.exe" [2008-06-19 2808832]
"sunjavaupdatesched"=c:\program files\java\jre6\bin\jusched.exe [2009-11-30 149280]
"nerofiltercheck"=c:\program files\common files\ahead\lib\nerocheck.exe [2006-01-12 155648]
"adobe reader speed launcher"=c:\program files\adobe\reader 9.0\reader\reader_sl.exe [2009-12-22 35760]
"adobe arm"=c:\program files\common files\adobe\arm\1.0\adobearm.exe [2009-12-11 948672]
"quicktime task"=c:\program files\quicktime\qttask.exe [2009-11-10 417792]
[hkey_users\.default\software\microsoft\windows\cur rentversion\run]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe [2008-04-14 15360]
c:\documents and settings\all users\start menu\programs\startup\
philips sa19xx device manager.lnk - c:\program files\philips\gogear sa19xx device manager\main.exe [2009-12-28 119296]
[hklm\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\authorizedapplications\list]
%windir%\\network diagnostic\\xpnetdiag.exe=
%windir%\\system32\\sessmgr.exe=
c:\\program files\\windows live\\messenger\\wlcsdk.exe=
c:\\program files\\windows live\\messenger\\msnmsgr.exe=
c:\\program files\\ventrilo\\ventrilo.exe=
c:\\program files\\utorrent\\utorrent.exe=
c:\\program files\\nero\\nero 7\\nero showtime\\showtime.exe=
c:\\program files\\videolan\\vlc\\vlc.exe=
c:\\program files\\limewire\\limewire.exe=
c:\\program files\\bonjour\\mdnsresponder.exe=
c:\\program files\\pando networks\\media booster\\pmb.exe=
c:\\program files\\world of warcraft\\wow-3.2.0-enus-downloader.exe=
c:\\program files\\world of warcraft\\launcher.exe=
c:\\windows\\system32\\usmt\\migwiz.exe=
[hklm\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\globallyopenports\list]
"58796:tcp"= 58796:tcp:pando media booster
"58796:udp"= 58796:udp:pando media booster
r2 antivirschedulerservice;avira antivir scheduler;c:\program files\avira\antivir desktop\sched.exe [25-10-2009 17:19 108289]
r2 regi;regi;c:\windows\system32\drivers\regi.sys [17-4-2007 20:09 11032]
s0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30-11-2009 17:29 691696]
s2 antivirupgradeservice;avira upgrade service;c:\docume~1\jasper\locals~1\temp\avsetup_4ae47998\ basic\avupgsvc.exe /tempstart:"c:\docume~1\jasper\locals~1\temp\avsetup_4ae47998\ basic\setup.exe /notempcleanup /crossupgrade" --> c:\docume~1\jasper\locals~1\temp\avsetup_4ae47998\ basic\avupgsvc.exe [?]
s2 gupdate;google updateservice (gupdate);c:\program files\google\update\googleupdate.exe [30-12-2009 23:18 135664]
.
contents of the 'scheduled tasks' folder
2010-03-10 c:\windows\tasks\googleupdatetaskmachinecore.job
- c:\program files\google\update\googleupdate.exe [2009-12-30 22:18]
2010-03-09 c:\windows\tasks\googleupdatetaskmachineua.job
- c:\program files\google\update\googleupdate.exe [2009-12-30 22:18]
2010-03-10 c:\windows\tasks\ogalogon.job
- c:\windows\system32\ogaexec.exe [2009-08-03 14:07]
.
.
------- supplementary scan -------
.
ustart page = hxxp://www.google.nl/
mstart page = hxxp://www.nixat.com/
uinternet settings,proxyoverride = *.local
ie: e&xporteren naar microsoft excel - c:\progra~1\micros~2\office11\excel.exe/3000
dpf: {c9a2cbf3-b7f9-463e-a690-82cc077dcfc6} - hxxp://www.4story.com/active_x/zemidetecthardware.cab
ff - profilepath - c:\documents and settings\jasper\application data\mozilla\firefox\profiles\q5l0htbb.default\
ff - prefs.js: browser.startup.homepage - hxxp://www.dymasearch.com/
ff - prefs.js: keyword.url - hxxp://www.dymasearch.com/search.php?src=tops&q=
ff - prefs.js: keyword.enabled - true
ff - prefs.js: browser.search.defaulturl - hxxp://www.dymasearch.com/search.php?src=tops&q=
ff - plugin: c:\program files\virtools\3d life player\npvirtools.dll
ff - hiddenextension: microsoft .net framework assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
.
- - - - orphans removed - - - -
webbrowser-{d4027c7f-154a-4066-a1ad-4243d8127440} - (no file)
addremove-vmntoolbar - c:\program files\vmntoolbar\uninstall.exe
************************************************** ************************
catchme 0.3.1398 w2k/xp/vista - rootkit/stealth malware detector by gmer, http://www.gmer.net
rootkit scan 2010-03-10 14:28
windows 5.1.2600 service pack 3 ntfs
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
--------------------- locked registry keys ---------------------
[hkey_local_machine\software\microsoft\windows\curr entversion\installer\userdata\localsystem\componen ts\€–€|ÿÿÿÿà•€|ù•a~*]
"3140110900063d11c8ef10054038389c"="c?\\windows\\s ystem32\\fm20enu.dll"
.
completion time: 2010-03-10 14:29:39
combofix-quarantined-files.txt 2010-03-10 13:29
pre-run: 13.493.129.216 bytes free
post-run: 13.770.436.608 bytes free
windowsxp-kb310994-sp2-pro-bootdisk-enu.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\window s
[operating systems]
c:\cmdcons\bootsect.dat="microsoft windows recovery console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\windows="micro soft windows xp professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(2)\windows="micro soft windows xp home edition" /noexecute=optin /fastdetect
- - end of file - - 68e815ef5c137a74e0ae2f476be9f81e

D Drmmr's HJT kleurcodering; gemaakt voor het NCF (www.nationaalcomputerforum.nl)

[Abraham54]

Hallo Jasper, Combofix heeft niks gevonden!
Dus: Combofix mag nu verwijderd worden:

• ga daarvoor naar Start - Uitvoeren
• kopieer en plak hierin het volgende: Combofix /Uninstall
• klik daarna op OK.
• indien het goed is, krijg je vervolgens een melding, dat Combofix verwijderd werd.

Voorbeeld:



Uitvoeren kan ook gestart worden door de toetsencombinatie

Of Combofix handmatig verwijderen:

Verwijder dan:

• ComboFix.exe
• C:\combofix.txt
• C:\ComboFix-quarantined-files.txt
• C:\ComboFix2.txt
• C:\ComboFix3.txt
• etc.etc.
• de map c:\Qoobox (mits aanwezig)

Download TFC naar je bureaublad (klick)
N.B.: Gebruikers van Windows Vista en Windows 7 starten het tool middels rechtsklik en daarbij dan kiezend voor Als Administrator uitvoeren!

• Klik/dubbelklik op TFC.exe om het programma te starten.
• Niet schrikken - het tool sluit alle lopende programma's - ergo: verzeker je dus ervan, dat je werk al is opgeslagen!
• Vervolgens klik je op de knop Start om de scan te starten. Deze scan kan kort of langer duren, wees geduldig en laat TFC zijn taak doen en wacht to TFC klaaar is.
• Indien TFC klaar is, dan komt de melding dat de computer opnieu opgestart wordt.
• Gebeurt het afsluiten niet automatisch, start dan zelf de computer opnieuw op.
• Noot: TFC vertoont geen log!

Download CKScanner by askey 127 en sla het op je bueaublad op.
Vista en Win 7 gebruikers gebruiken dit tool via rechtsklik en kiezen voor Als Administrator uitvoeren.

• Klik/dubbelklik op CKScanner by askey 127 om het tool te starten en klik op Search for Files.
• Na een korte tijd, wanneer de zandloper verdwijnt, klik dan op Save List To File
• Een berichtvenster zal bevestigen dat het dokument is opgelagen.
• Klik/dubbelklik op de CKFiles.txt snelkoppeling op je bureaublad en kopiëer en plak de inhoud in je volgende post.

[jasper936]

Ik heb gedaan wat hierboven staat vermeld dit kwam eruit:

CKScanner - Additional Security Risks - These are not necessarily bad
scanner sequence 3.MN.11
----- EOF -----

[Abraham54]

Hallo Jasper, prima dus tot nu toe.

Download, installeer en blijf MBAM gebruiken (KLIK)

• Al meteen na de installatie wil MBAM zijn database opwaarderen – toestaan dus.
• Ook bij herhaald gebruik: eerst MBAM updaten via de tab Update!
  
• Start MBAM en kies voor Snelle Scan
  
• N.B.: Vistagebruik(st)ers starten MBAM middels rechtsklikken en dan kiezen voor Als Administrator uitvoeren.
  
• Het scannen kan een tijdje duren, dus wees geduldig.
• Indien de scan voltooid is, klik dan op de knop OK
• Klik daarna op de knop Bekijk Resultaten om de resultaten te zien.
• Zorg ervoor, dat alles aangevinkt is.
• Vervolgens klik je op: Verwijder geselecteerde .
• Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten.
  
• Het log wordt automatisch bewaard door MBAM en dat kan je terugvinden door op de tab Logs te klikken in MBAM .
  
• Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven – dan telkens op OK klikken!
• Daarna zal MBAM vragen om de Computer opnieuw op te starten - dus sta toe dat de computer opnieuw opgestart wordt.

Indien er de rootkit (TDSS) aanwezig is, zal MBAM ook vragen te herstarten. Doe dit dan ook.
MBAM zal dan na de herstart opnieuw scannen en de rootkit verwijderen.

Hierna post je de inhoud van de volgende logs:

• een nieuw Hijackthis-log
• MBAM scanlog

• Tevens een Uninstall-lijst posten:
• start HijackThis,
• klik op de knop Open the Misc Tools section,
• klik op de knop Open Uninstall Manager
• Klik op de knop Save.

[jasper936]

Hallo,
Ik heb gedaan wat hierboven staat vermeld.
Mvg Jasper

HijackThis Log
Created with: Hijack This kleurcodering

Zelf een logje plaatsen? Klik eerst hier.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:16:35, on 13-3-2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
c:\windows\system32\smss.exe
c:\windows\system32\winlogon.exe
c:\windows\system32\services.exe
c:\windows\system32\lsass.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\windows\system32\spoolsv.exe
c:\program files\avira\antivir desktop\sched.exe
c:\program files\avira\antivir desktop\avguard.exe
c:\program files\bonjour\mdnsresponder.exe
c:\program files\common files\intervideo\regmgr\iviregmgr.exe
c:\program files\java\jre6\bin\jqs.exe
c:\program files\common files\protexis\license service\psiservice_2.exe
c:\windows\system32\svchost.exe
c:\windows\explorer.exe
c:\program files\avira\antivir desktop\avgnt.exe
c:\windows\soundman.exe
c:\windows\alcwzrd.exe
c:\program files\java\jre6\bin\jusched.exe
c:\program files\windows live\messenger\msnmsgr.exe
c:\program files\pando networks\media booster\pmb.exe
c:\windows\system32\ctfmon.exe
c:\program files\philips\gogear sa19xx device manager\main.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\trend micro\hijackthis\hijackthis.exe

r0 - hkcu\software\microsoft\internet explorer\main,start page = http://www.google.nl/
r1 - hklm\software\microsoft\internet explorer\main,default_page_url = http://go.microsoft.com/fwlink/?linkid=69157
r1 - hklm\software\microsoft\internet explorer\main,default_search_url = http://go.microsoft.com/fwlink/?linkid=54896
r1 - hklm\software\microsoft\internet explorer\main,search page = http://go.microsoft.com/fwlink/?linkid=54896
r0 - hklm\software\microsoft\internet explorer\main,start page = http://www.nixat.com/
r1 - hkcu\software\microsoft\windows\currentversion\int ernet settings,proxyoverride = *.local
o2 - bho: acroiehelperstub - {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll
o2 - bho: (no name) - {5c255c8a-e604-49b4-9d64-90988571cecb} - (no file)
o2 - bho: windows live aanmelden - help - {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
o2 - bho: java(tm) plug-in 2 ssv helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
o2 - bho: jqsiestartdetectorimpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
o4 - hklm\..\run: [avgnt] c:\program files\avira\antivir desktop\avgnt.exe /min
o4 - hklm\..\run: [soundman] soundman.exe
o4 - hklm\..\run: [alcwzrd] alcwzrd.exe
o4 - hklm\..\run: [sunjavaupdatesched] c:\program files\java\jre6\bin\jusched.exe
o4 - hklm\..\run: [nerofiltercheck] c:\program files\common files\ahead\lib\nerocheck.exe
o4 - hklm\..\run: [adobe reader speed launcher] c:\program files\adobe\reader 9.0\reader\reader_sl.exe
o4 - hklm\..\run: [adobe arm] c:\program files\common files\adobe\arm\1.0\adobearm.exe
o4 - hklm\..\run: [quicktime task] c:\program files\quicktime\qttask.exe -atboottime
o4 - hklm\..\run: [combofix] "c:\combofix\cf14505.cfxxe" /c "c:\combofix\c.bat"
o4 - hkcu\..\run: [msnmsgr] c:\program files\windows live\messenger\msnmsgr.exe /background
o4 - hkcu\..\run: [pando media booster] c:\program files\pando networks\media booster\pmb.exe
o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe
o4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')
o4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')
o4 - global startup: philips sa19xx device manager.lnk = c:\program files\philips\gogear sa19xx device manager\main.exe
o8 - extra context menu item: e&xporteren naar microsoft excel - res://c:\progra~1\micros~2\office11\excel.exe/3000
o9 - extra button: (no name) - {5067a26b-1337-4436-8afe-ee169c2da79f} - c:\windows\system32\shdocvw.dll
o9 - extra 'tools' menuitem: skype add-on for internet explorer - {5067a26b-1337-4436-8afe-ee169c2da79f} - c:\windows\system32\shdocvw.dll
o9 - extra button: skype - {77bf5300-1474-4ec7-9980-d32b190e9b07} - c:\windows\system32\shdocvw.dll
o9 - extra button: onderzoek - {92780b25-18cc-41c8-b9be-3c9c571a8263} - c:\progra~1\micros~2\office11\refiebar.dll
o9 - extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra 'tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra button: messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o9 - extra 'tools' menuitem: windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o16 - dpf: {1e54d648-b804-468d-bc78-4affed8e262f} (system requirements lab) - http://www.nvidia.com/content/driverdownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
o16 - dpf: {20a60f0d-9afa-4515-a0fd-83bd84642501} (checkers class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
o16 - dpf: {40f576ad-8680-4f9e-9490-99d069cd665f} (system requirements lab class) - http://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
o16 - dpf: {5c051655-fcd5-4969-9182-770ea5aa5565} (solitaire showdown class) - http://messenger.zone.msn.com/binary/solitaireshowdown.cab56986.cab
o16 - dpf: {5d6f45b3-9043-443d-a792-115447494d24} (unoctrl class) - http://messenger.zone.msn.com/messengergamescontent/gamecontent/nl/uno1/game_uno1.cab
o16 - dpf: {67dabfbf-d0ab-41fa-9c46-cc0f21721616} (divxbrowserplugin object) - http://download.divx.com/player/divxbrowserplugin.cab
o16 - dpf: {c3f79a2b-b9b4-4a66-b012-3ee46475b072} (messengerstatsclient class) - http://messenger.zone.msn.com/binary/messengerstatspaclient.cab56907.cab
o16 - dpf: {c9a2cbf3-b7f9-463e-a690-82cc077dcfc6} (zemidetecthardware control) - http://www.4story.com/active_x/zemidetecthardware.cab
o16 - dpf: {e2883e8f-472f-4fb0-9522-ac9bf37916a7} - http://platformdl.adobe.com/nos/getplusplus/1.6/gp.cab
o16 - dpf: {f5a7706b-b9c0-4c89-a715-7a0c6b05dd48} (minesweeper flags class) - http://messenger.zone.msn.com/binary/minesweeper.cab56986.cab
o23 - service: avira antivir scheduler (antivirschedulerservice) - avira gmbh - c:\program files\avira\antivir desktop\sched.exe
o23 - service: avira antivir guard (antivirservice) - avira gmbh - c:\program files\avira\antivir desktop\avguard.exe
o23 - service: avira upgrade service (antivirupgradeservice) - unknown owner - c:\docume~1\jasper\locals~1\temp\avsetup_4ae47998\ basic\avupgsvc.exe (file missing)
o23 - service: bonjour-service (bonjour service) - apple inc. - c:\program files\bonjour\mdnsresponder.exe
o23 - service: google updateservice (gupdate) (gupdate) - google inc. - c:\program files\google\update\googleupdate.exe
o23 - service: installdriver table manager (idrivert) - macrovision corporation - c:\program files\common files\installshield\driver\1050\intel 32\idrivert.exe
o23 - service: iviregmgr - intervideo - c:\program files\common files\intervideo\regmgr\iviregmgr.exe
o23 - service: java quick starter (javaquickstarterservice) - sun microsystems, inc. - c:\program files\java\jre6\bin\jqs.exe
o23 - service: nbservice - nero ag - c:\program files\nero\nero 7\nero backitup\nbservice.exe
o23 - service: protexis licensing v2 (psi_svc_2) - protexis inc. - c:\program files\common files\protexis\license service\psiservice_2.exe
--
end of file - 7714 bytes

D Drmmr's HJT kleurcodering; gemaakt voor het NCF (www.nationaalcomputerforum.nl)

µTorrent
3DVIA player 5.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3 - Nederlands
Adobe Shockwave Player 11.5
Apple Application Support
Avira AntiVir Personal - Free Antivirus
Bonjour
Compatibility Pack for the 2007 Office system
Easy DVD Player 2.0
Fable - The Lost Chapters
Fontlist
GoGear SA19xx Device Manager
Google Earth
Google Update Helper
GrabIt 1.7.2 Beta 4 (build 997)
Guild Wars
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Java(TM) 6 Update 16
LimeWire 5.4.8
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Editie 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.5.5)
MSN
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 7 Ultra Edition
OGA Notifier 2.0.0048.0
Pando Media Booster
QuickPar 0.9
QuickTime
Realtek High Definition Audio Driver
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
Segoe UI
Skype web features
Smarty Uninstaller Pro 2006
Spybot - Search & Destroy
System Requirements Lab
System Requirements Lab
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB973874)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB973687)
Ventrilo Client
VentriloMIX
Victory media converter
Visual C++ 8.0 MFC (x86) WinSXS MSM
Visual C++ 8.0 MFC.Policy (x86) WinSXS MSM
VLC media player 1.0.5
Windows Internet Explorer 8
Windows Live - Hulpprogramma voor uploaden
Windows Live aanmeldhulp
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
WinRAR archiver
World of Warcraft
YouTube Downloader 2.5.3



MBAM LOG
malwarebytes' anti-malware 1.44
database versie: 3864
windows 5.1.2600 service pack 3
internet explorer 8.0.6001.18702
13-3-2010 21:13:12
mbam-log-2010-03-13 (21-13-12).txt
scan type: snelle scan
objecten gescand: 119212
verstreken tijd: 6 minute(s), 44 second(s)
geheugenprocessen geïnfecteerd: 0
geheugenmodulen geïnfecteerd: 0
registersleutels geïnfecteerd: 0
registerwaarden geïnfecteerd: 0
registerdata bestanden geïnfecteerd: 0
mappen geïnfecteerd: 0
bestanden geïnfecteerd: 0
geheugenprocessen geïnfecteerd:
(geen kwaadaardige items gevonden)
geheugenmodulen geïnfecteerd:
(geen kwaadaardige items gevonden)
registersleutels geïnfecteerd:
(geen kwaadaardige items gevonden)
registerwaarden geïnfecteerd:
(geen kwaadaardige items gevonden)
registerdata bestanden geïnfecteerd:
(geen kwaadaardige items gevonden)
mappen geïnfecteerd:
(geen kwaadaardige items gevonden)
bestanden geïnfecteerd:
(geen kwaadaardige items gevonden)

[Abraham54]

Hallo Jasper, probeer, of de herinstallatie van ServicePack 3 je fontsprobleem kan oplossen!

http://www.microsoft.com/downloads/d...DisplayLang=nl

[jasper936]

Service pack 3 installeren heeft geholpen alles is weer normaal,
hardstikke bedankt
Mvg Jasper

[Abraham54]

Geweldig dat jouw Windows weer normaal doet!
Veel plezier weer.