Hijackthis Matty_de_vis

[Anoniem2]

Malwarebytes\' Anti-Malware 1.45\r\n[url]www.malwarebytes.org[/url]\r\n\r\nDatabaseversie: 3970\r\n\r\nWindows 5.1.2600 Service Pack 3\r\nInternet Explorer 7.0.5730.13\r\n\r\n8/04/2010 23:43:00\r\nmbam-log-2010-04-08 (23-43-00).txt\r\n\r\nScantype: Snelle scan\r\nObjecten gescand: 121898\r\nVerstreken tijd: 20 minuut/minuten, 40 seconde(n)\r\n\r\nGeheugenprocessen geïnfecteerd: 1\r\nGeheugenmodulen geïnfecteerd: 3\r\nRegistersleutels geïnfecteerd: 7\r\nRegisterwaarden geïnfecteerd: 3\r\nRegisterdata geïnfecteerd: 4\r\nMappen geïnfecteerd: 0\r\nBestanden geïnfecteerd: 23\r\n\r\nGeheugenprocessen geïnfecteerd:\r\nC:\\WINDOWS\\Apicea.exe (Trojan.Fraudpack) -> No action taken.\r\n\r\nGeheugenmodulen geïnfecteerd:\r\nC:\\WINDOWS\\system32\\app_dll.dll (Spyware.Passwords) -> No action taken.\r\nc:\\WINDOWS\\system32\\sshnas21.dll (Trojan.Downloader) -> No action taken.\r\nC:\\Documents and Settings\\All Users\\Documenten\\Settings\\cbss.dll (Trojan.Agent) -> No action taken.\r\n\r\nRegistersleutels geïnfecteerd:\r\nHKEY_CURRENT_USER\\Software\\YVIBBBHA8C (Trojan.Agent) -> No action taken.\r\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\sshnas (Trojan.Downloader) -> No action taken.\r\nHKEY_CURRENT_USER\\SOFTWARE\\XML (Trojan.FakeAlert) -> No action taken.\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\AGprotect (Malware.Trace) -> No action taken.\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\cbssreg (Trojan.Agent) -> No action taken.\r\nHKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Handle (Malware.Trace) -> No action taken.\r\nHKEY_CURRENT_USER\\Software\\WEK9EMDHI9 (Trojan.Agent) -> No action taken.\r\n\r\nRegisterwaarden geïnfecteerd:\r\nHKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\yvibbbha8c (Trojan.Fraudpack) -> No action taken.\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellServiceObjectDelayLoad\\gootkitsso (Trojan.GootKit) -> No action taken.\r\nHKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\reader_s (Malware.Trace) -> No action taken.\r\n\r\nRegisterdata geïnfecteerd:\r\nHKEY_CLASSES_ROOT\\regfile\\shell\\open\\command\\(default) (Broken.OpenCommand) -> Bad: (\"regedit.exe\" \"%1\") Good: (regedit.exe \"%1\") -> No action taken.\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Security Center\\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.\r\nHKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken.\r\n\r\nMappen geïnfecteerd:\r\n(Geen kwaadaardige objecten gedetecteerd)\r\n\r\nBestanden geïnfecteerd:\r\nC:\\WINDOWS\\system32\\app_dll.dll (Spyware.Passwords) -> No action taken.\r\nC:\\WINDOWS\\Apicea.exe (Trojan.Fraudpack) -> No action taken.\r\nc:\\Documents and Settings\\Matthias\\Local Settings\\Temp\\awl .exe (Trojan.Fraudpack) -> No action taken.\r\nC:\\RECYCLER\\S-1-5-21-9123580703-9850725048-644794991-2363\\mgrls32.exe (Worm.Autorun.B) -> No action taken.\r\nC:\\Documents and Settings\\Matthias\\Menu Start\\Programma\'s\\Opstarten\\ihaupd32.exe (Trojan.Downloader) -> No action taken.\r\nC:\\WINDOWS\\Temp\\ctv3944 .exe (Trojan.Downloader) -> No action taken.\r\nC:\\Program Files\\Internet Explorer\\js.mui (Trojan.Downloader) -> No action taken.\r\nC:\\WINDOWS\\system32\\sshnas21.dll (Trojan.Downloader) -> No action taken.\r\nC:\\WINDOWS\\Tasks\\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> No action taken.\r\nC:\\Documents and Settings\\Matthias\\Application Data\\wiaservg.log (Malware.Trace) -> No action taken.\r\nC:\\Documents and Settings\\gebruiker\\Favorieten\\Error Cleaner.url (Rogue.Link) -> No action taken.\r\nC:\\Documents and Settings\\Matthias\\Favorieten\\Error Cleaner.url (Rogue.Link) -> No action taken.\r\nC:\\Documents and Settings\\gebruiker\\Favorieten\\Privacy Protector.url (Rogue.Link) -> No action taken.\r\nC:\\Documents and Settings\\Matthias\\Favorieten\\Privacy Protector.url (Rogue.Link) -> No action taken.\r\nC:\\Documents and Settings\\gebruiker\\Favorieten\\Spyware&Malware Protection.url (Rogue.Link) -> No action taken.\r\nC:\\Documents and Settings\\Matthias\\Favorieten\\Spyware&Malware Protection.url (Rogue.Link) -> No action taken.\r\nC:\\WINDOWS\\f49f4daa.dat (Worm.Koobface) -> No action taken.\r\nC:\\WINDOWS\\fmark2.dat (Malware.Trace) -> No action taken.\r\nC:\\WINDOWS\\t55ft7575f44.dat (Worm.KoobFace) -> No action taken.\r\nC:\\WINDOWS\\Tasks\\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> No action taken.\r\nC:\\Documents and Settings\\All Users\\Documenten\\Settings\\cbss.dll (Trojan.Agent) -> No action taken.\r\nC:\\Documents and Settings\\Matthias\\Application Data\\avdrn.dat (Malware.Trace) -> No action taken.\r\nC:\\WINDOWS\\system32\\winsvncs.txt (Malware.Trace) -> No action taken.\r\n\r\n______________________________________________-\r\n\r\nIk heb last van het virus artemis..., \r\nik werk met virusscan mcafee, maar die zet alles in quarantaine maar ik krijg het niet weg.

[Anoniem2]

Logfile of Trend Micro HijackThis v2.0.3 (BETA)\nScan saved at 23:59:59, on 8/04/2010\nPlatform: Windows XP SP3 (WinNT 5.01.2600)\nMSIE: Internet Explorer v7.00 (7.00.6000.16850)\nBoot mode: Normal\n\nRunning processes:\nC:\\WINDOWS\\System32\\smss.exe\nC:\\WINDOWS\\system32\\winlogon.exe\nC:\\WINDOWS\\system32\\services.exe\nC:\\WINDOWS\\system32\\lsass.exe\nC:\\WINDOWS\\system32\\svchost.exe\nC:\\WINDOWS\\System32\\svchost.exe\nC:\\WINDOWS\\system32\\svchost.exe\nC:\\WINDOWS\\system32\\spoolsv.exe\nC:\\WINDOWS\\Explorer.EXE\nC:\\WINDOWS\\system32\\RUNDLL32.EXE\nC:\\WINDOWS\\system32\\ctfmon.exe\nC:\\Program Files\\Windows Live\\Messenger\\MsnMsgr.Exe\nC:\\Program Files\\Messenger\\msmsgs.exe\nC:\\Program Files\\Windows Desktop Search\\WindowsSearch.exe\nC:\\Documents and Settings\\Matthias\\Application Data\\Dropbox\\bin\\Dropbox.exe\nC:\\Program Files\\MagicDisc\\MagicDisc.exe\nC:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe\nC:\\Program Files\\Bonjour\\mDNSResponder.exe\nC:\\WINDOWS\\system32\\CTsvcCDA.exe\nC:\\Program Files\\Java\\jre6\\bin\\jqs.exe\nC:\\Program Files\\McAfee\\SiteAdvisor\\McSACore.exe\nC:\\PROGRA~1\\McAfee\\MSC\\mcmscsvc.exe\nc:\\program files\\common files\\mcafee\\mna\\mcnasvc.exe\nc:\\PROGRA~1\\COMMON~1\\mcafee\\mcproxy\\mcproxy.exe\nC:\\PROGRA~1\\McAfee\\VIRUSS~1\\mcshield.exe\nC:\\Program Files\\Common Files\\Microsoft Shared\\VS7DEBUG\\MDM.EXE\nC:\\Program Files\\McAfee\\MPF\\MPFSrv.exe\n\nDE hijjackfile ofzo

[Anoniem2]

R1 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]\nR0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = [url]http://nl.netlog.com/[/url]\nR1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]\nR1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Search_URL = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]\nR1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]\nR0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]\nR1 - HKCU\\Software\\Microsoft\\Internet Connection Wizard,ShellNext = [url]http://go.microsoft.com/fwlink/?LinkId=74005[/url]\nR1 - HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,ProxyOverride = *.local\nR0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar,LinksFolderName = Koppelingen\nO2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll\nO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll\nO2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\\PROGRA~1\\mcafee\\msk\\mskapbho.dll\nO2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)\nO2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\\Program Files\\Microsoft\\Search Enhancement Pack\\Search Helper\\SEPsearchhelperie.dll\nO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\\Program Files\\McAfee\\VirusScan\\scriptsn.dll\nO2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\\Program Files\\Common Files\\Microsoft Shared\\Windows Live\\WindowsLiveLogin.dll\nO2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\\PROGRA~1\\mcafee\\SITEAD~1\\mcieplg.dll\nO2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\\Program Files\\Java\\jre6\\bin\\jp2ssv.dll\nO2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\\Program Files\\Windows Live\\Toolbar\\wltcore.dll\nO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\\Program Files\\Java\\jre6\\lib\\deploy\\jqs\\ie\\jqs_plugin.dll\nO3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\\Program Files\\BS.Player ControlBar\\BSToolbar.dll\nO3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\\Program Files\\Windows Live\\Toolbar\\wltcore.dll\nO3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\\PROGRA~1\\mcafee\\SITEAD~1\\mcieplg.dll\nO4 - HKLM\\..\\Run: [NvCplDaemon] RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup\nO4 - HKLM\\..\\Run: [NvMediaCenter] RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit\nO4 - HKLM\\..\\Run: [QuickTime Task] \"C:\\program files\\quicktime\\qttask .exe\" -atboottime\nO4 - HKCU\\..\\Run: [ctfmon.exe] C:\\WINDOWS\\system32\\ctfmon.exe\nO4 - HKCU\\..\\Run: [Google Update] \"C:\\Documents and Settings\\Matthias\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe\" /c\nO4 - HKCU\\..\\Run: [MsnMsgr] \"C:\\Program Files\\Windows Live\\Messenger\\MsnMsgr.Exe\" /background\nO4 - HKCU\\..\\Run: [CTSyncU.exe] \"C:\\Program Files\\Creative\\Sync Manager Unicode\\CTSyncU.exe\"\nO4 - HKCU\\..\\Run: [Netlog Music Tool] \"C:\\Program Files\\Netlog Music Tool\\NetlogMusicTool.exe\"\nO4 - HKCU\\..\\Run: [DLD.EXE] C:\\Program Files\\Download Direct\\DLD.exe\nO4 - HKCU\\..\\Run: [LGMobileSyncLauncher] C:\\Program Files\\LG PC Suite II\\LG_MobileSync_Launcher.exe\nO4 - HKCU\\..\\Run: [DAEMON Tools] \"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033\nO4 - HKCU\\..\\Run: [MSMSGS] \"C:\\Program Files\\Messenger\\msmsgs.exe\" /background\nO4 - Startup: Dropbox.lnk = C:\\Documents and Settings\\Matthias\\Application Data\\Dropbox\\bin\\Dropbox.exe\nO4 - Startup: MagicDisc.lnk = C:\\Program Files\\MagicDisc\\MagicDisc.exe\nO4 - Global Startup: Windows Search.lnk = C:\\Program Files\\Windows Desktop Search\\WindowsSearch.exe\nO8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\\WINDOWS\\system32\\GPhotos.scr/200\nO8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\\PROGRA~1\\MICROS~2\\OFFICE11\\EXCEL.EXE/3000\nO9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\\Program Files\\Windows Live\\Writer\\WriterBrowserExtension.dll\nO9 - Extra \'Tools\' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\\Program Files\\Windows Live\\Writer\\WriterBrowserExtension.dll\nO9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\\PROGRA~1\\MICROS~2\\OFFICE11\\REFIEBAR.DLL\nO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe\nO9 - Extra \'Tools\' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe\nO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe\nO9 - Extra \'Tools\' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe\nO15 - Trusted Zone: [url]http://*.mcafee.com[/url]\nO16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - [url]http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab[/url]\nO16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - [url]http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab[/url]\nO18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\\PROGRA~1\\mcafee\\SITEAD~1\\mcieplg.dll\nO20 - AppInit_DLLs: app_dll.dll\nO22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\\WINDOWS\\system32\\browseui.dll\nO22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\\WINDOWS\\system32\\browseui.dll\nO23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe\nO23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\\Program Files\\Bonjour\\mDNSResponder.exe\nO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\\WINDOWS\\system32\\CTsvcCDA.exe\nO23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\\Program Files\\MAGIX\\Common\\Database\\bin\\fbserver.exe\nO23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\\Program Files\\Common Files\\Macrovision Shared\\FLEXnet Publisher\\FNPLicensingService.exe\nO23 - Service: Google Updater Service (gusvc) - Google - C:\\Program Files\\Google\\Common\\Google Updater\\GoogleUpdaterService.exe\nO23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\\Program Files\\iPod\\bin\\iPodService.exe\nO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\\Program Files\\Java\\jre6\\bin\\jqs.exe\nO23 - Service: MBackMonitor - McAfee - C:\\Program Files\\McAfee\\MBK\\MBackMonitor.exe\nO23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\\Program Files\\McAfee\\SiteAdvisor\\McSACore.exe\nO23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\\PROGRA~1\\McAfee\\MSC\\mcmscsvc.exe\nO23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\\program files\\common files\\mcafee\\mna\\mcnasvc.exe\nO23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\\PROGRA~1\\McAfee\\VIRUSS~1\\mcods.exe\nO23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\\PROGRA~1\\COMMON~1\\mcafee\\mcproxy\\mcproxy.exe\nO23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\\PROGRA~1\\McAfee\\VIRUSS~1\\mcshield.exe\nO23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\\PROGRA~1\\McAfee\\VIRUSS~1\\mcsysmon.exe\nO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\\Program Files\\McAfee\\MPF\\MPFSrv.exe\nO23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\\Program Files\\McAfee\\MSK\\MskSrver.exe\nO23 - Service: NBService - Nero AG - C:\\Program Files\\Nero\\Nero 7\\Nero BackItUp\\NBService.exe\nO23 - Service: NMIndexingService - Nero AG - C:\\Program Files\\Common Files\\Ahead\\Lib\\NMIndexingService.exe\nO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\\WINDOWS\\system32\\nvsvc32.exe\nO23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\\Program Files\\CyberLink\\Shared files\\RichVideo.exe\n\n--\nEnd of file - 10658 bytes\n\n____________________________________________________________________________________\nKeb nu ook met malware gescant en verwijderd, maar hij gaf een kadertje dat ik niet bevoegd ben om de bestanden te verwijderen

[Anoniem2]

Het enige wat opvalt in de hijackthis is de volgende regel:\r\n\r\nO2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)\r\n\r\nEen browser helper object zonder naam of file (is dus al verwijderd)\r\nRest ziet er schoon uit, geen gekke dingen die opstarten of opgestart zijn.\r\n\r\nhet lijkt er dan ook op dat er geen executables geladen worden of draaien.\r\n\r\nMcAfee moet een optie hebben om alles in quarantaine \'de viruskluis\' te verwijderen.\r\nVerder moet er ook een optie zijn die je de keus geeft welke actie te ondernemen bij het vinden van een virus of dergelijke (quarantine, delete, move, fix)\r\n\r\nOver artemis. lees [url]http://community.mcafee.com/thread/2016[/url] \r\nIk denk dat je deze vorm van \'artemis\' hebt, er is een (gedateerd) virus Generic!Artemis maar dat zie ik nergens terug.\r\n\r\nEr zijn nog wel besmette bestanden aanwezig MBAM heeft deze gevonden (geen zorgen, ze doen geen kwaad zolang ze niet geopend worden)\r\nWel gek dat er overal vermeld wordt \'no action taken\'.\r\nDit kan een instelling van MBAM zijn, maar het kan ook McAfee zijn die het blokkeerd of mogelijk een gebruikersfoutje.\r\nProbeer McAfee eens volledig uit te schakelen en doe dan nog een MBAM scan.\r\n\r\nOp de scanresultaten pagina vink alle gevonden punten aan en klik op delete\r\n\r\nEn post nogmaals een MBAM logje.\r\n\r\nIn de huidige log zie ik \r\n\r\n[quote]Geheugenprocessen geïnfecteerd:\r\nC:\\WINDOWS\\Apicea.exe (Trojan.Fraudpack) -> No action taken.[/quote]\r\n\r\nmaar dit zie ik weer niet terug in hijackthis (dus kan McAfee/MBAM hem verwijderd hebben).

[Anoniem2]

tuin, die 020 entry is fout, denk dat je die over het hoofd hebt gezien.