Microsoft Security Essentials Alert

[davege]

Are you getting anymore alerts any other problems with your PC's performance?
=> it all seemed to be working normal. Not particulary slow (it is an older machine), all programs worked fine again.

When you ran RSIT did you have an active internet connection at the time?
=> I did not have an active internet connection at that time (to avoid infecting other things in my lan)

I will run the things you just suggested later today, and this time with an active internet connection.

Is it a problem that windows updates have been installed in the mean time? When I plugged in to the internet, they were downloaded and installed...

[Cypher]

Hi davege.

it all seemed to be working normal. Not particulary slow (it is an older machine), all programs worked fine again.

Good news.

I will run the things you just suggested later today, and this time with an active internet connection.

Please do and post the requested logs when ready.

Is it a problem that windows updates have been installed in the mean time?

No thats fine

[davege]

otm.log


All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriveCleaner Free\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\udc6cw\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uwa7pcw\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAntiVirus Pro 2007\ deleted successfully.
========== FILES ==========
File/Folder C:\Program Files\Common Files\WinAntiVirus Pro 2007 not found.
File/Folder C:\Program Files\WinAntiVirus Pro 2007 not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Eigenaar

User: Fons
->Temp folder emptied: 11202205 bytes
->Temporary Internet Files folder emptied: 35863290 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 6621737 bytes

Total Files Cleaned = 51,00 mb


OTM by OldTimer - Version 3.1.17.1 log created on 10272010_191424

Files moved on Reboot...
File C:\WINDOWS\temp\_avast5_\Webshlock.txt not found!

Registry entries deleted on Reboot...

[davege]

rsit log


Logfile of random's system information tool 1.08 (written by random/random)
Run by Fons at 2010-10-27 19:21:15
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 74 GB (66%) free of 111 GB
Total RAM: 1014 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:21:21, on 27/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Belgacom\bin\sprtcmd.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\MapSource\gStart.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Belgacom\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Fons\Bureaublad\cleanup tools\RSIT.exe
C:\Program Files\trend micro\Fons.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.be/ig/dell?hl=nl&client=dell ... bd=2060909
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.be/ig/dell?hl=nl&client=dell ... bd=2060909
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Belgacom] "C:\Program Files\Belgacom\bin\sprtcmd.exe" /P Belgacom
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [gStart] C:\MapSource\gStart.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: downloadfree.avg.com
O15 - Trusted Zone: guru.avg.com
O15 - Trusted Zone: update.avgfree.com
O15 - Trusted Zone: guru1.grisoft.cz
O15 - Trusted Zone: guru2.grisoft.cz
O15 - Trusted Zone: guru3.grisoft.cz
O16 - DPF: Garmin Communicator Plug-In - https://static.garmincdn.com/gcp/ie/2.9 ... ontrol.CAB
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SupportSoft Sprocket Service (belgacom) (sprtsvc_belgacom) - SupportSoft, Inc. - C:\Program Files\Belgacom\bin\sprtsvc.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\Supportsoft\bin\ssrc.exe

--
End of file - 7333 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\NSSstub.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{F689A790-238B-468C-847D-D12FC3780C88}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
DriveLetterAccess - C:\WINDOWS\System32\DLA\DLASHX_W.DLL [2005-09-08 110652]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2007-01-20 2423872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-10-26 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-10-26 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2007-01-20 2423872]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2005-10-14 94208]
"igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2005-10-14 77824]
"igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2005-10-14 114688]
"DMXLauncher"=C:\Program Files\Dell\Media Experience\DMXLauncher.exe [2005-10-05 94208]
"ISUSPM Startup"=C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe [2005-06-10 249856]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-06-10 81920]
"DLA"=C:\WINDOWS\System32\DLA\DLACTRLW.EXE [2005-09-08 122940]
"Lexmark X1100 Series"=C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe [2003-08-19 57344]
"Belgacom"=C:\Program Files\Belgacom\bin\sprtcmd.exe [2008-05-29 202016]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-09-07 2838912]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-07-20 68856]
"gStart"=C:\MapSource\gStart.exe [2008-08-13 1891416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WA6PM_Check]
C:\Program Files\Common Files\DriveCleaner Free\udcwap.exe []

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-10-14 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-02-22 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SupportSoft RemoteAssist]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\STHIW\stInstall.exe"="E:\STHIW\stInstall.exe:*:Enabled:SpeedTouch Home Install Wizard"
"C:\Program Files\Grisoft\AVG7\avginet.exe"="C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe"
"C:\Program Files\Grisoft\AVG7\avgamsvr.exe"="C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\Program Files\Grisoft\AVG7\avgcc.exe"="C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Disabled:Internet Explorer"
"C:\Program Files\IncrediMail\bin\ImApp.exe"="C:\Program Files\IncrediMail\bin\ImApp.exe:*:Enabled:IncrediMail"
"C:\Program Files\IncrediMail\bin\IncMail.exe"="C:\Program Files\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail"
"C:\Program Files\IncrediMail\bin\ImpCnt.exe"="C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail"
"C:\Program Files\AVG\AVG8\avgcmgr.exe"="C:\Program Files\AVG\AVG8\avgcmgr.exe:*:Enabled:avgcmgr.exe"
"C:\Program Files\AVG\AVG8\avgiproxy.exe"="C:\Program Files\AVG\AVG8\avgiproxy.exe:*:Enabled:avgiproxy.exe"
"C:\Program Files\AVG\AVG8\avgtray.exe"="C:\Program Files\AVG\AVG8\avgtray.exe:*:Enabled:AVG Free Tray Icon"
"C:\Program Files\AVG\AVG8\avgui.exe"="C:\Program Files\AVG\AVG8\avgui.exe:*:Enabled:AVG Free User Interface"
"C:\Program Files\AVG\AVG8\avgwdsvc.exe"="C:\Program Files\AVG\AVG8\avgwdsvc.exe:*:Enabled:avgwdsvc.exe"
"C:\WINDOWS\system32\fxsclnt.exe"="C:\WINDOWS\system32\fxsclnt.exe:*:Disabled:Microsoft Fax Console"
"C:\Program Files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe"="C:\Program Files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe:*:Enabled:WiselinkPro"
"C:\Program Files\Samsung\SAMSUNG PC Share Manager\http_ss_win_pro.exe"="C:\Program Files\Samsung\SAMSUNG PC Share Manager\http_ss_win_pro.exe:*:Enabled:http_ss_win_pro"
"C:\Garmin\MapSource.exe"="C:\Garmin\MapSource.exe:*:Enabled:MapSource"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 3 months======

2010-10-27 19:17:57 ----D---- C:\WINDOWS\LastGood
2010-10-26 23:11:27 ----D---- C:\Documents and Settings\Fons\Application Data\OpenOffice.org
2010-10-26 23:09:25 ----D---- C:\Program Files\OpenOffice.org 3
2010-10-26 23:08:37 ----D---- C:\Documents and Settings\All Users\Application Data\Sun
2010-10-26 23:08:36 ----D---- C:\Program Files\Common Files\Java
2010-10-26 23:08:27 ----A---- C:\WINDOWS\system32\javaws.exe
2010-10-26 23:08:27 ----A---- C:\WINDOWS\system32\javaw.exe
2010-10-26 23:08:27 ----A---- C:\WINDOWS\system32\java.exe
2010-10-26 23:08:27 ----A---- C:\WINDOWS\system32\deployJava1.dll
2010-10-26 23:08:10 ----D---- C:\Program Files\Java
2010-10-26 23:05:41 ----D---- C:\Program Files\Microsoft Office
2010-10-26 23:05:30 ----D---- C:\Program Files\MSECache
2010-10-26 22:48:07 ----D---- C:\WINDOWS\Prefetch
2010-10-26 22:46:13 ----HDC---- C:\WINDOWS\$NtUninstallKB980232$
2010-10-26 22:46:05 ----HDC---- C:\WINDOWS\$NtUninstallKB980218$
2010-10-26 22:45:52 ----HDC---- C:\WINDOWS\$NtUninstallKB979683$
2010-10-26 22:45:42 ----HDC---- C:\WINDOWS\$NtUninstallKB979559$
2010-10-26 22:45:34 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2010-10-26 22:45:25 ----HDC---- C:\WINDOWS\$NtUninstallKB979309$
2010-10-26 22:45:17 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-10-26 22:45:09 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2010-10-26 22:45:00 ----HDC---- C:\WINDOWS\$NtUninstallKB978542$
2010-10-26 22:44:50 ----HDC---- C:\WINDOWS\$NtUninstallKB978338$
2010-10-26 22:44:41 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-10-26 22:44:31 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-10-26 22:44:22 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-10-26 22:44:11 ----HDC---- C:\WINDOWS\$NtUninstallKB977165$
2010-10-26 22:43:58 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-10-26 22:43:50 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$
2010-10-26 22:43:42 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-10-26 22:43:33 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-10-26 22:43:25 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2010-10-26 22:43:17 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2010-10-26 22:43:07 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2010-10-26 22:42:59 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2010-10-26 22:42:50 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2010-10-26 22:42:42 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2010-10-26 22:42:32 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2010-10-26 22:42:24 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2010-10-26 22:42:15 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2010-10-26 22:42:06 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2010-10-26 22:41:57 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2010-10-26 22:41:49 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$
2010-10-26 22:41:38 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-10-26 22:41:30 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2010-10-26 22:41:23 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2010-10-26 22:41:15 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2010-10-26 22:41:05 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2010-10-26 22:40:55 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-10-26 22:40:47 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-10-26 22:40:39 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2010-10-26 22:40:29 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2010-10-26 22:40:21 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2010-10-26 22:40:11 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2010-10-26 22:40:00 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2010-10-26 22:39:52 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2010-10-26 22:39:33 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2010-10-26 22:39:24 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2010-10-26 22:39:16 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2010-10-26 22:39:07 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2010-10-26 22:38:59 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2010-10-26 22:38:50 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2010-10-26 22:38:42 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2010-10-26 22:38:33 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2010-10-26 22:38:26 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2010-10-26 22:38:16 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2010-10-26 22:38:08 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2010-10-26 22:37:55 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2010-10-26 22:37:46 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-10-26 22:37:36 ----HDC---- C:\WINDOWS\$NtUninstallKB973687_1$
2010-10-26 22:37:29 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2010-10-26 22:37:19 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2010-10-26 22:37:11 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2010-10-26 22:37:01 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2010-10-26 22:36:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2010-10-26 22:36:45 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2010-10-26 22:36:37 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2010-10-26 22:36:27 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2010-10-26 22:36:19 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2010-10-26 22:36:11 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2010-10-26 22:36:04 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2010-10-26 22:35:56 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2010-10-26 22:35:48 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2010-10-26 22:35:37 ----HDC---- C:\WINDOWS\$NtUninstallKB2229593$
2010-10-26 22:32:25 ----D---- C:\WINDOWS\l2schemas
2010-10-26 22:32:24 ----D---- C:\WINDOWS\system32\nl
2010-10-26 22:32:24 ----D---- C:\WINDOWS\system32\bits
2010-10-26 22:25:24 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2010-10-26 22:25:22 ----D---- C:\WINDOWS\EHome
2010-10-26 22:04:27 ----D---- C:\Program Files\trend micro
2010-10-26 22:04:26 ----D---- C:\rsit
2010-10-26 21:33:46 ----D---- C:\_OTM
2010-10-26 21:29:31 ----D---- C:\Program Files\ERUNT
2010-10-26 19:33:04 ----D---- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2010-10-13 17:31:08 ----D---- C:\Documents and Settings\Fons\Application Data\Malwarebytes
2010-10-13 17:30:50 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-10-13 17:30:49 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-10-13 17:30:49 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2010-10-13 17:30:49 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2010-10-13 17:30:38 ----A---- C:\mbam-setup.exe
2010-10-09 14:14:00 ----ASH---- C:\hiberfil.sys
2010-10-08 16:09:12 ----A---- C:\WINDOWS\ntbtlog.txt

======List of files/folders modified in the last 3 months======

2010-10-27 19:19:31 ----HD---- C:\WINDOWS\inf
2010-10-27 19:18:54 ----D---- C:\WINDOWS\system32\CatRoot2
2010-10-27 19:18:39 ----HD---- C:\WINDOWS\$hf_mig$
2010-10-27 19:18:39 ----D---- C:\WINDOWS
2010-10-27 19:16:59 ----D---- C:\WINDOWS\Temp
2010-10-27 19:16:35 ----A---- C:\WINDOWS\ModemLog_Standaardmodem met 56000 bps.txt
2010-10-27 19:14:57 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-10-26 23:14:08 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2010-10-26 23:11:12 ----SHD---- C:\WINDOWS\Installer
2010-10-26 23:10:42 ----RSD---- C:\WINDOWS\assembly
2010-10-26 23:09:44 ----RSD---- C:\WINDOWS\Fonts
2010-10-26 23:09:25 ----RD---- C:\Program Files
2010-10-26 23:08:36 ----D---- C:\Program Files\Common Files
2010-10-26 23:08:27 ----D---- C:\WINDOWS\system32
2010-10-26 23:05:49 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-10-26 23:05:48 ----D---- C:\WINDOWS\WinSxS
2010-10-26 22:56:30 ----D---- C:\WINDOWS\system32\CatRoot
2010-10-26 22:49:46 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-10-26 22:48:40 ----A---- C:\WINDOWS\OEWABLog.txt
2010-10-26 22:47:56 ----A---- C:\WINDOWS\setuplog.txt
2010-10-26 22:47:30 ----D---- C:\WINDOWS\system32\Setup
2010-10-26 22:47:30 ----D---- C:\WINDOWS\AppPatch
2010-10-26 22:47:30 ----D---- C:\Program Files\Messenger
2010-10-26 22:47:29 ----D---- C:\WINDOWS\system32\wbem
2010-10-26 22:47:24 ----D---- C:\WINDOWS\system32\drivers
2010-10-26 22:46:15 ----D---- C:\WINDOWS\system32\dllcache
2010-10-26 22:45:02 ----D---- C:\Program Files\Outlook Express
2010-10-26 22:43:44 ----D---- C:\Program Files\Movie Maker
2010-10-26 22:41:21 ----D---- C:\WINDOWS\security
2010-10-26 22:32:34 ----D---- C:\WINDOWS\network diagnostic
2010-10-26 22:32:34 ----D---- C:\WINDOWS\ime
2010-10-26 22:32:34 ----D---- C:\WINDOWS\Help
2010-10-26 22:32:25 ----D---- C:\WINDOWS\system32\usmt
2010-10-26 22:32:25 ----D---- C:\WINDOWS\system32\nl-nl
2010-10-26 22:32:24 ----D---- C:\WINDOWS\PeerNet
2010-10-26 22:30:47 ----D---- C:\WINDOWS\ServicePackFiles
2010-10-26 22:30:42 ----D---- C:\WINDOWS\system32\Restore
2010-10-26 22:30:42 ----D---- C:\WINDOWS\system32\npp
2010-10-26 22:30:41 ----D---- C:\WINDOWS\msagent
2010-10-26 22:30:40 ----D---- C:\WINDOWS\srchasst
2010-10-26 22:30:39 ----D---- C:\Program Files\NetMeeting
2010-10-26 22:30:38 ----D---- C:\WINDOWS\system32\Com
2010-10-26 22:30:36 ----D---- C:\Program Files\Windows NT
2010-10-26 22:30:36 ----D---- C:\Program Files\Windows Media Player
2010-10-26 22:30:33 ----D---- C:\Program Files\Common Files\System
2010-10-26 22:30:22 ----D---- C:\WINDOWS\system32\oobe
2010-10-26 22:30:20 ----D---- C:\WINDOWS\system
2010-10-26 22:27:59 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-10-26 22:19:45 ----A---- C:\WINDOWS\system32\MRT.exe
2010-10-26 20:12:23 ----D---- C:\Program Files\Common Files\Adobe
2010-10-26 20:12:23 ----D---- C:\Program Files\Adobe
2010-10-26 20:12:23 ----D---- C:\Documents and Settings\Fons\Application Data\Adobe
2010-10-16 10:20:40 ----HDC---- C:\WINDOWS\$NtUninstallKB936357$
2010-10-13 18:39:35 ----HDC---- C:\WINDOWS\$NtUninstallKB943460$
2010-10-08 16:09:35 ----D---- C:\Documents and Settings
2010-10-07 19:19:09 ----D---- C:\dell
2010-10-07 18:24:27 ----D---- C:\Program Files\Internet Explorer
2010-10-05 09:03:52 ----A---- C:\WINDOWS\lexstat.ini
2010-09-07 17:11:54 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-08-29 15:09:31 ----D---- C:\Program Files\Lexmark X1100 Series

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 DRVMCDB;DRVMCDB; C:\WINDOWS\System32\Drivers\DRVMCDB.SYS [2005-09-12 89264]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2008-11-20 43872]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-09-07 28880]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2005-08-25 5628]
R1 DLARTL_N;DLARTL_N; C:\WINDOWS\System32\Drivers\DLARTL_N.SYS [2005-08-25 22684]
R1 intelppm;Intel GV3-processorstuurprogramma; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R1 kbdhid;Stuurprogramma voor toetsenbord-HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-05-06 19024]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-09-07 100176]
R2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [2005-09-08 25628]
R2 DLADResN;DLADResN; C:\WINDOWS\System32\DLA\DLADResN.SYS [2005-09-08 2496]
R2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [2005-09-08 86524]
R2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\DLA\DLAOPIOM.SYS [2005-09-08 14684]
R2 DLAPoolM;DLAPoolM; C:\WINDOWS\System32\DLA\DLAPoolM.SYS [2005-09-08 6364]
R2 DLAUDF_M;DLAUDF_M; C:\WINDOWS\System32\DLA\DLAUDF_M.SYS [2005-09-08 87036]
R2 DLAUDFAM;DLAUDFAM; C:\WINDOWS\System32\DLA\DLAUDFAM.SYS [2005-09-08 94332]
R2 DRVNDDM;DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [2005-08-12 40544]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-09-07 23376]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2004-10-14 155648]
R3 HDAudBus;Microsoft UAA-busstuurprogramma voor High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class-stuurprogramma; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-10-14 1302812]
R3 mouhid;Stuurprogramma voor muis-HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-09-06 12288]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2004-08-04 5888]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2006-02-10 1107224]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 grmnusb;Garmin USB Driver; C:\WINDOWS\system32\drivers\grmnusb.sys [2009-04-17 9344]
S3 IMNPF;IMFirewall Packet Filter; C:\WINDOWS\system32\drivers\imnpf.sys []
S3 ltmodem5;LT Modem Driver; C:\WINDOWS\system32\DRIVERS\ltmdmnt.sys [2004-08-04 607132]
S3 MODEMCSA;Unimodem Streaming-filterapparaat; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
S3 Ser2pl;ATEN USB to Serial port driver; C:\WINDOWS\system32\DRIVERS\ser2pl.sys [2003-07-16 43264]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Stuurprogramma voor USB-scanner; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Stuurprogramma voor USB-massaopslag; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]
S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-13 44928]
S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-13 42752]
S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-13 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-13 40960]
S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-13 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-10-26 153376]
R2 LexBceS;LexBce Server; C:\WINDOWS\system32\LEXBCES.EXE [2003-08-18 303104]
R2 sprtsvc_belgacom;SupportSoft Sprocket Service (belgacom); C:\Program Files\Belgacom\bin\sprtsvc.exe [2008-05-29 202016]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 268288]
S2 SupportSoft RemoteAssist;SupportSoft RemoteAssist; C:\Program Files\Common Files\Supportsoft\bin\ssrc.exe [2008-05-29 382320]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-23 138168]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NetSvc;Intel NCS NetService; C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe [2004-11-19 147456]
S3 WMPNetworkSvc;Windows Media Player Network Sharing-service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-02 917504]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[davege]

eset log


ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=7f08d1021e705a4b99797662b0d9fdba
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-10-27 06:24:25
# local_time=2010-10-27 08:24:25 (+0100, Romance (zomertijd))
# country="Belgium"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 244 244 0 0
# compatibility_mode=768 16777215 100 0 10652786 10652786 0 0
# compatibility_mode=8192 67108863 100 0 90 90 0 0
# scanned=66973
# found=1
# cleaned=0
# scan_time=3542
C:\_OTM\MovedFiles\10262010_213346\C_Documents and Settings\Fons\Application Data\hotfix.exe a variant of Win32/TrojanDownloader.FakeAlert.BFI trojan 00000000000000000000000000000000 I

[davege]

computers performance seems ok. Programs open like before the infection, so: ok for me.

[Cypher]

Hi davege.

Do the following then you should be good to go.
Items in the trusted zone are a security risk.

Fix HijackThis entries

Run HijackThis

• If you are on the Main Menu page... Click "Do a system scan only"
• If you are on the "scan & fix stuff" page... Press the Scan...button.
• When the scan finishes...Place a check mark next to the following entries (if they are still present)
• Note: Only check those items listed below.
  

  O15 - Trusted Zone: downloadfree.avg.com
  O15 - Trusted Zone: guru.avg.com
  O15 - Trusted Zone: update.avgfree.com
  O15 - Trusted Zone: guru1.grisoft.cz
  O15 - Trusted Zone: guru2.grisoft.cz
  O15 - Trusted Zone: guru3.grisoft.cz

  
  
• After checking these items... CLOSE ALL open windows except HijackThis.
• Click the Fix Checked ...button...to remove the entries you checked.
• Choose YES...when prompted to fix the selected items.
• Once it has fixed them, close HijackThis and reboot your computer normally.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Clean up with OTM

• Double-click OTM.exe to start the program, This tool will remove all the tools we used to clean your pc.
• Close all other programs apart from OTMoveIt3 as this step will require a reboot
• On the OTM main screen, press the CleanUp! button
• Say Yes to the prompt and then allow the program to reboot your computer.

You can now delete any tools we used if they remain on your Desktop.

Protection Programs
Don't forget to re-enable any protection programs we disabled during your fix.

Now we needed to deal with security vulnerabilities

Windows XP SP2

You need to install XP SP3 now it includes vital security updates for your computer.
Support for Windows XP with Service Pack 2 (SP2) ended on July 13, 2010.


Here are some free programs I recommend that could help you improve your computer's security.

Install SpywareBlaster
Download and install Javacools SpywareBlaster from Here
SpywareBlaster adds a list of ActiveX controls, tracking cookies and sites which will be blocked in either Internet Explorer or Firefox browsers. You need to manually check for updates regularly.

Install SiteAdvisor
SiteAdvisor is a toolbar for Microsoft Internet Explorer and Mozilla Firefox which alerts you if you're about to enter a potentially dangerous website.
You can find more information and download it from Here

Install WinPatrol
As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.
For more information, please visit HERE

MVPS Hosts

Install MVPS Hosts File From Here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
You can Find the Tutorial HERE

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer
You can do that HERE

Read some information HERE On how to prevent Malware

I would be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Safe surfing!

[davege]

Thanks alot Cypher for all your help.

The computer is clean now, and better protected (installed some of the tools you suggested and upgraded to SP3).

The thread can be closed, and one again: thanks!!

[Cypher]

You're most welcome.
Good luck and stay safe.

[Wingman]

As your problems appear to have been resolved, this topic is now closed.
We are pleased we could help you resolve your computer's malware issues.

If you are satisfied with our assistance and wish to donate to help with the costs of this volunteer site, please read :
Donations For Malware Removal