Created: 14-4-2008 21:33
Modified: 17-8-2010 14:17
Company: Microsoft Corporation
--------------------
C:\Program Files\Java\jre6\bin\jqs.exe
153376 bytes
Created: 13-9-2010 11:44
Modified: 13-9-2010 11:44
Company: Sun Microsystems, Inc.
--------------------
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe - file already scanned
--------------------
C:\WINDOWS\system32\slserv.exe - file already scanned
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\wscntfy.exe
13824 bytes
Created: 14-4-2008 21:33
Modified: 14-4-2008 21:33
Company: Microsoft Corporation
--------------------
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
501480 bytes
Created: 14-5-2010 10:44
Modified: 14-5-2010 10:44
Company: Sun Microsystems, Inc.
--------------------
C:\Program Files\internet explorer\iexplore.exe
634648 bytes
Created: 16-1-2010 19:25
Modified: 25-8-2010 12:30
Company: Microsoft Corporation
--------------------
C:\Documents and Settings\van veen\Application Data\Simply Super Software\Trojan Remover\tmj91.exe
FileSize: 3761072
[This is a Trojan Remover component]
--------------------
************************************************************
15:40:14: Checking HOSTS file
No malicious entries were found in the HOSTS file
************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
Windows programs
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
%SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
Bing
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
MSN | Hotmail | Messenger | Nieuws, sport, entertainment, video, lifestyle, auto en nog veel meer, dat is MSN !
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
Bing
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
Startpagina.nl - alles op een rijtje! (ook op mobiel)
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\WINDOWS\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
Sign In
************************************************************
=== NO CHANGES HAVE BEEN MADE TO YOUR SYSTEM FILES ===
Scan completed at: 15:40:15 01 dec 2010
Total Scan time: 00:00:19
************************************************************
***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.8.2.2597. For information, email
[email protected]
[Unregistered version]
Scan started at: 15:38:46 01 dec 2010
Using Database v7616
Operating System: Windows XP Professional (SP3) [Build: 5.1.2600]
File System: NTFS
UserData directory: C:\Documents and Settings\van veen\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Documents and Settings\All Users\Application Data\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Documents and Settings\van veen\Mijn documenten\Simply Super Software\Trojan Remover Logfiles\
Program directory: C:\Program Files\Trojan Remover\
Running with Administrator privileges
************************************************************
************************************************************
15:38:46: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.
************************************************************
15:38:46: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [Explorer.exe]
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1037312 bytes
Created: 28-11-2010 20:08
Modified: 15-4-2008 14:00
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\WINDOWS\system32\userinit.exe,]
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
26112 bytes
Created: 14-4-2008 21:33
Modified: 14-4-2008 21:33
Company: Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
Key value: [logonui.exe]
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
515072 bytes
Created: 14-4-2008 21:33
Modified: 14-4-2008 21:33
Company: Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: SoundMan
Value Data: SOUNDMAN.EXE
C:\WINDOWS\SOUNDMAN.EXE
-R- 577536 bytes
Created: 16-1-2010 19:55
Modified: 17-11-2006 4:42
Company: Realtek Semiconductor Corp.
--------------------
Value Name: NeroFilterCheck
Value Data: C:\WINDOWS\system32\NeroCheck.exe
C:\WINDOWS\system32\NeroCheck.exe
155648 bytes
Created: 17-1-2010 14:04
Modified: 12-1-2006 15:40
Company: Nero AG
--------------------
Value Name: RemoteControl9
Value Data: "C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe"
C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe
87336 bytes
Created: 27-4-2009 20:41
Modified: 27-4-2009 20:41
Company: CyberLink Corp.
--------------------
Value Name: PDVD9LanguageShortcut
Value Data: "C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe"
C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe
50472 bytes
Created: 27-4-2009 17:50
Modified: 27-4-2009 17:50
Company: CyberLink Corp.
--------------------
Value Name: BDRegion
Value Data: C:\Program Files\Cyberlink\Shared Files\brs.exe
C:\Program Files\Cyberlink\Shared Files\brs.exe
75048 bytes
Created: 17-1-2010 18:29
Modified: 7-5-2009 20:05
Company: cyberlink
--------------------
Value Name: CanonMyPrinter
Value Data: C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
1983816 bytes
Created: 20-1-2010 19:18
Modified: 19-10-2009 2:12
Company: CANON INC.
--------------------
Value Name: SunJavaUpdateSched
Value Data: "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
C:\Program Files\Common Files\Java\Java Update\jusched.exe
248552 bytes
Created: 14-5-2010 10:44
Modified: 14-5-2010 10:44
Company: Sun Microsystems, Inc.
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
35760 bytes
Created: 22-12-2009 0:57
Modified: 22-12-2009 0:57
Company: Adobe Systems Incorporated
--------------------
Value Name: Adobe ARM
Value Data: "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
932288 bytes
Created: 11-12-2009 14:57
Modified: 21-9-2010 19:37
Company: Adobe Systems Incorporated
--------------------
Value Name: avast5
Value Data: "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
C:\Program Files\Alwil Software\Avast5\avastUI.exe
2838912 bytes
Created: 12-11-2010 1:20
Modified: 7-9-2010 17:12
Company: AVAST Software
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
1233856 bytes
Created: 1-12-2010 15:38
Modified: 24-11-2010 15:26
Company: Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: swg
Value Data: "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
39408 bytes
Created: 13-9-2010 11:47
Modified: 13-9-2010 11:47
Company: Google Inc.
--------------------
Value Name: msnmsgr
Value Data: "C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe" /background
C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe
3872080 bytes
Created: 16-4-2010 22:12
Modified: 16-4-2010 22:12
Company: Microsoft Corporation
--------------------
Value Name: ctfmon.exe
Value Data: C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
15360 bytes
Created: 14-4-2008 21:32
Modified: 14-4-2008 21:32
Company: Microsoft Corporation
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
************************************************************
15:38:51: Scanning -----SHELLEXECUTEHOOKS-----
************************************************************
15:38:51: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------
************************************************************
15:38:51: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\WINDOWS\VAILLA~1.SCR
C:\WINDOWS\VAILLA~1.SCR
186368 bytes
Created: 17-1-2010 14:28
Modified: 14-11-2005 10:22
Company: [no info]
--------------------
************************************************************
15:38:51: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
************************************************************
15:38:52: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)
--------------------
Key: srservice
Path: %SystemRoot%\system32\srsvc.dll
C:\WINDOWS\system32\srsvc.dll
171008 bytes
Created: 16-1-2010 19:25
Modified: 14-4-2008 21:32
Company: Microsoft Corporation
--------------------
************************************************************
15:38:54: Scanning ----- SERVICES REGISTRY KEYS -----
Key: atapi
ImagePath: system32\DRIVERS\atapi.sys
C:\WINDOWS\system32\DRIVERS\atapi.sys
96512 bytes
Created: 13-4-2008 23:10
Modified: 14-4-2008 1:10
Company: Microsoft Corporation
----------
Key: avast! Antivirus
ImagePath: "C:\Program Files\Alwil Software\Avast5\AvastSvc.exe"
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
40384 bytes
Created: 12-11-2010 1:20
Modified: 7-9-2010 17:11
Company: AVAST Software
----------
Key: avast! Mail Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast5\AvastSvc.exe"
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
40384 bytes
Created: 12-11-2010 1:20
Modified: 7-9-2010 17:11
Company: AVAST Software
----------
Key: avast! Web Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast5\AvastSvc.exe"
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
40384 bytes
Created: 12-11-2010 1:20
Modified: 7-9-2010 17:11
Company: AVAST Software
----------
Key: Avgfwdx
ImagePath: system32\DRIVERS\avgfwdx.sys
C:\WINDOWS\system32\DRIVERS\avgfwdx.sys
30104 bytes
Created: 16-1-2010 20:37
Modified: 16-1-2010 23:41
Company: AVG Technologies CZ, s.r.o.
----------
Key: Avgfwfd
ImagePath: system32\DRIVERS\avgfwdx.sys
C:\WINDOWS\system32\DRIVERS\avgfwdx.sys
30104 bytes
Created: 16-1-2010 20:37
Modified: 16-1-2010 23:41
Company: AVG Technologies CZ, s.r.o.
----------
Key: AVGIDSErHrxpx
ImagePath: System32\Drivers\AVGIDSxx.sys
C:\WINDOWS\System32\Drivers\AVGIDSxx.sys - [file not found to scan]
----------
Key: catchme
ImagePath: \??\C:\DOCUME~1\VANVEE~1\LOCALS~1\Temp\catchme.sys - this file is globally excluded
----------
Key: fssfltr
ImagePath: system32\DRIVERS\fssfltr_tdi.sys
C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys - [file not found to scan]
----------
Key: ImapiService
ImagePath: %systemroot%\system32\imapi.exe
C:\WINDOWS\system32\imapi.exe
150528 bytes
Created: 14-4-2008 21:33
Modified: 14-4-2008 21:33
Company: Microsoft Corporation
----------
Key: McComponentHostService
ImagePath: "C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe"
C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe - [file not found to scan]
----------
Key: Mtlmnt5
ImagePath: system32\DRIVERS\Mtlmnt5.sys
C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys
126686 bytes
Created: 16-1-2010 20:20
Modified: 14-4-2008 0:53
Company: Smart Link
----------
Key: Mtlstrm
ImagePath: system32\DRIVERS\Mtlstrm.sys
C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys
1309184 bytes
Created: 16-1-2010 20:20
Modified: 14-4-2008 0:53
Company: Smart Link
----------
Key: NtMtlFax
ImagePath: system32\DRIVERS\NtMtlFax.sys
C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys
180360 bytes
Created: 16-1-2010 20:20
Modified: 14-4-2008 0:53
Company: Smart Link
----------
Key: RecAgent
ImagePath: system32\DRIVERS\RecAgent.sys
C:\WINDOWS\system32\DRIVERS\RecAgent.sys
13776 bytes
Created: 16-1-2010 20:20
Modified: 14-4-2008 0:53
Company: Smart Link
----------
Key: SeaPort
ImagePath: "C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe"
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
226656 bytes
Created: 10-11-2010 16:39
Modified: 14-1-2009 17:53
Company: Microsoft Corp.
----------
Key: Slntamr
ImagePath: system32\DRIVERS\slntamr.sys
C:\WINDOWS\system32\DRIVERS\slntamr.sys
404990 bytes
Created: 16-1-2010 20:20
Modified: 14-4-2008 0:53
Company: Smart Link
----------
Key: SlNtHal
ImagePath: system32\DRIVERS\Slnthal.sys
C:\WINDOWS\system32\DRIVERS\Slnthal.sys
95424 bytes
Created: 16-1-2010 20:20
Modified: 14-4-2008 0:53
Company: Smart Link
----------
Key: SLService
ImagePath: slserv.exe
C:\WINDOWS\system32\slserv.exe
73796 bytes
Created: 16-1-2010 20:20
Modified: 14-4-2008 23:33
Company: Smart Link
----------
Key: SlWdmSup
ImagePath: system32\DRIVERS\SlWdmSup.sys
C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys
13240 bytes
Created: 16-1-2010 20:20
Modified: 14-4-2008 0:53
Company: Smart Link
----------
Key: SwPrv
ImagePath: C:\WINDOWS\system32\dllhost.exe /Processid:{86850CE9-3854-4266-B6CD-B5B0868D0030}
C:\WINDOWS\system32\dllhost.exe
5120 bytes
Created: 14-4-2008 21:32
Modified: 14-4-2008 21:32
Company: Microsoft Corporation
----------
Key: WpdUsb
ImagePath: system32\DRIVERS\wpdusb.sys
C:\WINDOWS\system32\DRIVERS\wpdusb.sys
38528 bytes
Created: 5-5-2008 21:31
Modified: 5-5-2008 21:31
Company: Microsoft Corporation
----------
Key: {B154377D-700F-42cc-9474-23858FBDF4BD}
ImagePath: \??\C:\Program Files\CyberLink\PowerDVD9\000.fcl
C:\Program Files\CyberLink\PowerDVD9\000.fcl
87536 bytes
Created: 7-5-2009 21:05
Modified: 7-5-2009 21:05
Company: CyberLink Corp.
----------
************************************************************
15:39:01: Scanning -----VXD ENTRIES-----
************************************************************
15:39:01: Scanning ----- WINLOGON\NOTIFY DLLS -----
************************************************************
15:39:01: Scanning ----- CONTEXTMENUHANDLERS -----
Key: avast
CLSID: {472083B0-C522-11CF-8763-00608CC02F24}
Path: C:\Program Files\Alwil Software\Avast5\ashShell.dll
C:\Program Files\Alwil Software\Avast5\ashShell.dll
81072 bytes
Created: 12-11-2010 1:20
Modified: 7-9-2010 17:13
Company: AVAST Software
----------
Key: AVG9 Shell Extension
CLSID: {9F97547E-4609-42C5-AE0C-81C61FFAEBC3}
File: [CLSID does not appear to reference a file]
----------
Key: ShellExtension
CLSID: [empty]
----------
************************************************************
15:39:01: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key: {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}
File: "C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll"
C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
373248 bytes
Created: 2-7-2009 15:06
Modified: 2-7-2009 15:06
Company: Sun Microsystems, Inc.
----------
************************************************************
15:39:01: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B}
BHO: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
92504 bytes
Created: 14-1-2009 16:49
Modified: 14-1-2009 16:49
Company: Microsoft Corp.
----------
Key: {AA58ED58-01DD-4d91-8333-CF10577473F7}
BHO: C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
297648 bytes
Created: 13-9-2010 11:47
Modified: 25-10-2010 14:32
Company: Google Inc.
----------
Key: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
BHO: C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
843832 bytes
Created: 25-10-2010 14:35
Modified: 25-10-2010 14:35
Company: Google Inc.
----------
************************************************************
15:39:02: Scanning ----- SHELLSERVICEOBJECTS -----
Key: SysTray
CLSID: {35CEC8A3-2BE6-11D2-8773-92E220524153}
Path: %systemroot%\system32\stobject.dll
C:\WINDOWS\system32\stobject.dll
122368 bytes
Created: 14-4-2008 21:32
Modified: 14-4-2008 21:32
Company: Microsoft Corporation
----------
************************************************************
15:39:02: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----
************************************************************
15:39:02: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.
************************************************************
15:39:02: Scanning ----- APPINIT_DLLS -----
No APPINIT_DLLS value found to check
************************************************************
15:39:02: Scanning ----- SECURITY PROVIDER DLLS -----
************************************************************
15:39:02: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\desktop.ini
-HS- 84 bytes
Created: 16-1-2010 20:19
Modified: 16-1-2010 19:28
Company: [no info]
--------------------
************************************************************
No User Startup Groups were located to check
************************************************************
15:39:03: Scanning ----- SCHEDULED TASKS -----
Taskname: GoogleUpdateTaskMachineCore
File: C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
135664 bytes
Created: 17-4-2010 16:55
Modified: 17-4-2010 16:54
Company: Google Inc.
Parameters: /c
Schedule: Multiple schedule times
Next Run Time: 2-12-2010 0:26:00
Status: Ready
Creator: SYSTEM
Comments: Zorgt ervoor dat u altijd beschikt over de nieuwste Google-software. Als deze taak wordt uitgeschakeld of afgebroken, wordt uw Google-software niet bijgewerkt. Hierdoor kunnen beveiligingsrisico's mogelijk niet worden verholpen of kunnen bepaalde functies niet functioneren. Deze taak verwijdert zichzelf wanneer er geen Google-software is die er gebruik van maakt.
----------
Taskname: GoogleUpdateTaskMachineUA
File: C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
135664 bytes
Created: 17-4-2010 16:55
Modified: 17-4-2010 16:54
Company: Google Inc.
Parameters: /ua /installsource scheduler
Schedule: elke 1 uur, vanaf 0:26 uur, gedurende 24 uur elke dag, te beginnen op 14-10-2010
Next Run Time: 1-12-2010 16:26:00
Status: Ready
Creator: SYSTEM
Comments: Zorgt ervoor dat u altijd beschikt over de nieuwste Google-software. Als deze taak wordt uitgeschakeld of afgebroken, wordt uw Google-software niet bijgewerkt. Hierdoor kunnen beveiligingsrisico's mogelijk niet worden verholpen of kunnen bepaalde functies niet functioneren. Deze taak verwijdert zichzelf wanneer er geen Google-software is die er gebruik van maakt.
----------
Taskname: Scheduled Update for Ask Toolbar
File: C:\Program Files\Ask.com\UpdateTask.exe
C:\Program Files\Ask.com\UpdateTask.exe
96136 bytes
Created: 28-9-2010 22:44
Modified: 28-9-2010 22:44
Company: [no info]
Schedule: elke 1 uur, vanaf 1:01 uur, gedurende 24 uur elke dag, te beginnen op 1-1-2008
Next Run Time: 1-12-2010 16:01:00
Status: Ready
Creator: van veen
Comments:
----------
************************************************************
15:39:03: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----
************************************************************
15:39:03: Scanning ----- DEVICE DRIVER ENTRIES -----
Value: VIDC.YV12
File: yv12vfw.dll
C:\WINDOWS\system32\yv12vfw.dll
217088 bytes
Created: 17-1-2010 14:13
Modified: 25-1-2004 17:18
Company:
www.helixcommunity.org
----------
Value: msacm.ac3acm
File: ac3acm.acm
C:\WINDOWS\system32\ac3acm.acm
118784 bytes
Created: 17-1-2010 14:13
Modified: 21-9-2007 1:52
Company: fccHandler
----------
Value: msacm.lameacm
File: lameACM.acm
C:\WINDOWS\system32\lameACM.acm
839680 bytes
Created: 17-1-2010 14:13
Modified: 24-9-2008 19:41
Company:
www
----------
Value: VIDC.FFDS
File: ff_vfw.dll
C:\WINDOWS\system32\ff_vfw.dll
85504 bytes
Created: 17-1-2010 14:13
Modified: 13-10-2009 19:00
Company: [no info]
----------
************************************************************
15:39:05: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Documents and Settings\van veen\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\van veen\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
23970870 bytes
Created: 20-1-2010 20:45
Modified: 25-10-2010 20:32
Company: [no info]
----------
Web Desktop Wallpaper: %USERPROFILE%\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\van veen\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
23970870 bytes
Created: 20-1-2010 20:45
Modified: 25-10-2010 20:32
Company: [no info]
----------
Checks for rogue DNS NameServers completed
----------
Additional checks completed
************************************************************
15:39:16: Scanning ----- RUNNING PROCESSES -----
C:\WINDOWS\System32\smss.exe
50688 bytes
Created: 14-4-2008 21:33
Modified: 14-4-2008 21:33
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\winlogon.exe
510464 bytes
Created: 14-4-2008 21:33
Modified: 14-4-2008 21:33
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\services.exe
111104 bytes
Created: 14-4-2008 21:33
Modified: 9-2-2009 12:27
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\lsass.exe
13312 bytes
Created: 14-4-2008 21:33
Modified: 14-4-2008 21:33
Company: Microsoft Corporation
--------------------
C:\WINDOWS\system32\svchost.exe
14336 bytes
Created: 14-4-2008 21:33
Modified: 14-4-2008 21:33
Company: Microsoft Corporation
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe - file already scanned
--------------------
C:\WINDOWS\Explorer.EXE - file already scanned
--------------------
C:\WINDOWS\SOUNDMAN.EXE - file already scanned
--------------------
C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe - file already scanned
--------------------
C:\Program Files\Cyberlink\Shared Files\brs.exe - file already scanned
--------------------
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe - file already scanned
--------------------
C:\Program Files\Common Files\Java\Java Update\jusched.exe - file already scanned
--------------------
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe - file already scanned
--------------------
C:\Program Files\Alwil Software\Avast5\avastUI.exe - file already scanned
--------------------
C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe - file already scanned
--------------------
C:\WINDOWS\system32\ctfmon.exe - file already scanned
--------------------
C:\WINDOWS\system32\spoolsv.exe
58880 bytes
Created: 14-4-2008 21:33
Modified: 17-8-2010 14:17
Company: Microsoft Corporation
--------------------
C:\Program Files\Java\jre6\bin\jqs.exe
153376 bytes
Created: 13-9-2010 11:44
Modified: 13-9-2010 11:44
Company: Sun Microsystems, Inc.
--------------------
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe - file already scanned
--------------------
C:\WINDOWS\system32\slserv.exe - file already scanned
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\wscntfy.exe
13824 bytes
Created: 14-4-2008 21:33
Modified: 14-4-2008 21:33
Company: Microsoft Corporation
--------------------
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
501480 bytes
Created: 14-5-2010 10:44
Modified: 14-5-2010 10:44
Company: Sun Microsystems, Inc.
--------------------
C:\Program Files\internet explorer\iexplore.exe
634648 bytes
Created: 16-1-2010 19:25
Modified: 25-8-2010 12:30
Company: Microsoft Corporation
--------------------
C:\Documents and Settings\van veen\Application Data\Simply Super Software\Trojan Remover\jjd8F.exe
FileSize: 3761072
[This is a Trojan Remover component]
--------------------
************************************************************
15:39:20: Checking HOSTS file
No malicious entries were found in the HOSTS file
************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
Windows programs
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
%SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
Bing
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
MSN | Hotmail | Messenger | Nieuws, sport, entertainment, video, lifestyle, auto en nog veel meer, dat is MSN !
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
Bing
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
Startpagina.nl - alles op een rijtje! (ook op mobiel)
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\WINDOWS\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
Sign In
************************************************************
=== NO CHANGES HAVE BEEN MADE TO YOUR SYSTEM FILES ===
Scan completed at: 15:39:20 01 dec 2010
Total Scan time: 00:00:33
************************************************************
hallo als het goed is is dit wat je bedoeld. het kon niet in 1 bericht dus staat het in 2