Archief - Check logje

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
X

XyNtAcKz

Legacy Member
Vroeger gehad dat de CPU constant aan 100% zat te draaien.
Dan eens HitmanPRO erop los gelaten, maar vond alleen cookies (ad-aware).

Nu draait de CPU niet meer constant aan 100%, maar gaat toch nog altijd traag volgens mijn gedacht (ik kan verkeerd zijn)

Thanks!



Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16:42:33, on 13-6-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Hijack This\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: CCC.lnk.disabled
O4 - Global Startup: Logitech SetPoint.lnk.disabled
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: www.dell.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181477651909
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - D:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - Unknown owner - D:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 6291 bytes
J

Jurgenv1

Legacy Member
* Deïnstalleer hitmanpro.

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* Voer ook eens een schijfdefragmentatie uit.
X

XyNtAcKz

Legacy Member
Nu draait hij weer constant aan 100%, om een nieuw log te maken duurt het ong 2minuten..

heeft dus niet geholpen, heb gedefragmenteerd & met ATF-cleaner gekuist
Het gaat hier om een Dell Inspiron 8600 Intel Pentium M 1,7GHz, kloksnelheid: 592MHz, 1,00GB

(mssn ter info: Hij vindt soms geen drivers meer voor mijn memory stick & helemaal geen drivers voor mijn G7 logitech muis..)


nieuwe log:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:31:24, on 14-6-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
D:\Program Files\Symantec AntiVirus\DoScan.exe
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Hijack This\hijackthis.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: CCC.lnk.disabled
O4 - Global Startup: Logitech SetPoint.lnk.disabled
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: www.dell.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181477651909
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - D:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - Unknown owner - D:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 6347 bytes
J

Jurgenv1

Legacy Member
Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.
X

XyNtAcKz

Legacy Member
Code: 
2007-06-10 16:20      104    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\Klaus\BUREAU~1\Internet.lnk.vir


Map PATH-lijst
Het volumenummer is 7C53-42BF
C:\QOOBOX
\---Quarantine
    +---C
    |   \---DOCUME~1
    |       \---Klaus
    |           \---BUREAU~1
    |                   Internet.lnk.vir
    |                   
    \---Registry_backups

ComboFix 07-06-13.3 - C:\Documents and Settings\Klaus\Bureaublad\ComboFix.exe
"Klaus" - 2007-06-14 15:54:03 - Service Pack 2 NTFS


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\Klaus\BUREAU~1\internet.lnk


((((((((((((((((((((((((( Files Created from 2007-05-14 to 2007-06-14 )))))))))))))))))))))))))))))))


2007-06-14 15:51 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-13 16:42 <DIR> d-------- C:\Program Files\Hijack This
2007-06-13 06:41 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\Webroot
2007-06-12 17:17 <DIR> d-------- C:\DOCUME~1\Klaus\APPLIC~1\Lavasoft
2007-06-12 16:57 83,024 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-06-12 16:57 57,424 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-06-12 16:57 53,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-06-12 16:57 39,376 --a------ C:\WINDOWS\system32\drivers\ikfileflt.sys
2007-06-12 16:57 29,264 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-06-12 16:54 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-06-12 16:54 <DIR> d-------- C:\DOCUME~1\Klaus\APPLIC~1\PC Tools
2007-06-12 16:53 22,080 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
2007-06-12 16:53 21,056 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys
2007-06-12 16:53 20,544 --a------ C:\WINDOWS\system32\drivers\SSFS0509.sys
2007-06-12 16:53 144,960 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
2007-06-12 16:53 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot
2007-06-12 16:52 <DIR> d-------- C:\DOCUME~1\Klaus\APPLIC~1\Webroot
2007-06-12 16:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Webroot
2007-06-12 16:25 <DIR> d-------- C:\WINDOWS\system32\GroupPolicy
2007-06-11 20:41 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-11 20:34 <DIR> d-------- C:\DOCUME~1\Klaus\APPLIC~1\Logitech
2007-06-11 20:28 69,632 --a------ C:\WINDOWS\system32\KemXML.dll
2007-06-11 20:28 163,840 --a------ C:\WINDOWS\system32\kemutb.dll
2007-06-11 20:28 135,168 --a------ C:\WINDOWS\system32\KemUtil.dll
2007-06-11 20:28 110,592 --a------ C:\WINDOWS\system32\KemWnd.dll
2007-06-11 20:28 10,640 --a------ C:\WINDOWS\system32\drivers\LBeepKE.sys
2007-06-11 20:24 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-06-11 20:23 <DIR> d-------- C:\Program Files\Logitech
2007-06-11 20:23 <DIR> d-------- C:\DOCUME~1\Klaus\APPLIC~1\InstallShield
2007-06-11 19:53 48,768 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-06-11 19:53 110,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-06-11 19:52 <DIR> d-------- C:\Program Files\Symantec
2007-06-11 19:52 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2007-06-11 19:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-06-10 20:45 3,840 --a------ C:\WINDOWS\DellBIOS.Sys
2007-06-10 20:38 <DIR> d-------- C:\Program Files\ATI
2007-06-10 19:55 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-06-10 19:55 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2007-06-10 19:40 <DIR> d-------- C:\Program Files\Microsoft Works
2007-06-10 19:39 <DIR> d-------- C:\Program Files\MSBuild
2007-06-10 19:18 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-06-10 19:17 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
2007-06-10 19:12 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Menu Start
2007-06-10 19:11 <DIR> d-------- C:\WINDOWS\Prefetch
2007-06-10 17:55 9,728 --------- C:\WINDOWS\system32\comsdupd.exe
2007-06-10 17:55 40,832 --------- C:\WINDOWS\system32\drivers\irbus.sys
2007-06-10 17:55 32,768 --------- C:\WINDOWS\system32\asr_pfu.exe
2007-06-10 17:55 12,800 --------- C:\WINDOWS\system32\spiisupd.exe
2007-06-10 17:54 95,424 --------- C:\WINDOWS\system32\drivers\slnthal.sys
2007-06-10 17:54 937,984 --------- C:\WINDOWS\system32\winbrand.dll
2007-06-10 17:54 88,064 --------- C:\WINDOWS\system32\p2pnetsh.dll
2007-06-10 17:54 86,016 --------- C:\WINDOWS\system32\p2pgasvc.dll
2007-06-10 17:54 81,920 --------- C:\WINDOWS\system32\ieencode.dll
2007-06-10 17:54 81,408 --------- C:\WINDOWS\system32\wscsvc.dll
2007-06-10 17:54 8,192 --------- C:\WINDOWS\system32\smbinst.exe
2007-06-10 17:54 78,464 --------- C:\WINDOWS\system32\drivers\usbvideo.sys
2007-06-10 17:54 75,776 --------- C:\WINDOWS\system32\strmfilt.dll
2007-06-10 17:54 73,832 --------- C:\WINDOWS\system32\slcoinst.dll
2007-06-10 17:54 73,796 --------- C:\WINDOWS\system32\slserv.exe
2007-06-10 17:54 73,216 --------- C:\WINDOWS\system32\drivers\atintuxx.sys
2007-06-10 17:54 71,680 --------- C:\WINDOWS\system32\blastcln.exe
2007-06-10 17:54 7,680 --------- C:\WINDOWS\system32\kbdsmsno.dll
2007-06-10 17:54 7,680 --------- C:\WINDOWS\system32\kbdsmsfi.dll
2007-06-10 17:54 7,168 --------- C:\WINDOWS\system32\kbdukx.dll
2007-06-10 17:54 7,168 --------- C:\WINDOWS\system32\kbdno1.dll
2007-06-10 17:54 7,168 --------- C:\WINDOWS\system32\kbdfi1.dll
2007-06-10 17:54 7,168 --------- C:\WINDOWS\system32\hccoin.dll
2007-06-10 17:54 685,056 --------- C:\WINDOWS\system32\drivers\hsfcxts2.sys
2007-06-10 17:54 67,584 --------- C:\WINDOWS\system32\drivers\sdbus.sys
2007-06-10 17:54 63,663 --------- C:\WINDOWS\system32\drivers\ati1rvxx.sys
2007-06-10 17:54 63,488 --------- C:\WINDOWS\system32\drivers\atinxsxx.sys
2007-06-10 17:54 60,416 --------- C:\WINDOWS\system32\fwcfg.dll
2007-06-10 17:54 6,656 --------- C:\WINDOWS\system32\kbdinmal.dll
2007-06-10 17:54 6,656 --------- C:\WINDOWS\system32\kbdinben.dll
2007-06-10 17:54 6,144 --------- C:\WINDOWS\system32\kbdmlt48.dll
2007-06-10 17:54 6,144 --------- C:\WINDOWS\system32\kbdmlt47.dll
2007-06-10 17:54 6,144 --------- C:\WINDOWS\system32\kbdinbe1.dll
2007-06-10 17:54 6,016 --------- C:\WINDOWS\system32\drivers\smbali.sys
2007-06-10 17:54 59,648 --------- C:\WINDOWS\system32\drivers\rfcomm.sys
2007-06-10 17:54 57,856 --------- C:\WINDOWS\system32\drivers\atinbtxx.sys
2007-06-10 17:54 56,623 --------- C:\WINDOWS\system32\drivers\ati1btxx.sys
2007-06-10 17:54 526,848 --------- C:\WINDOWS\system32\p2psvc.dll
2007-06-10 17:54 52,224 --------- C:\WINDOWS\system32\drivers\atinraxx.sys
2007-06-10 17:54 516,768 --------- C:\WINDOWS\system32\ativvaxx.dll
2007-06-10 17:54 50,688 --------- C:\WINDOWS\system32\btpanui.dll
2007-06-10 17:54 50,176 --------- C:\WINDOWS\system32\xmlprovi.dll
2007-06-10 17:54 5,632 --------- C:\WINDOWS\system32\kbdmaori.dll
2007-06-10 17:54 49,152 --------- C:\WINDOWS\system32\powercfg.exe
2007-06-10 17:54 48,640 --------- C:\WINDOWS\system32\pnrpnsp.dll
2007-06-10 17:54 46,464 --------- C:\WINDOWS\system32\drivers\gagp30kx.sys
2007-06-10 17:54 452,736 --------- C:\WINDOWS\system32\drivers\mtxparhm.sys
2007-06-10 17:54 44,928 --------- C:\WINDOWS\system32\drivers\agpcpq.sys
2007-06-10 17:54 44,672 --------- C:\WINDOWS\system32\drivers\uagp35.sys
2007-06-10 17:54 44,032 --------- C:\WINDOWS\system32\twext.dll
2007-06-10 17:54 43,008 --------- C:\WINDOWS\system32\drivers\amdagp.sys
2007-06-10 17:54 42,752 --------- C:\WINDOWS\system32\drivers\alim1541.sys
2007-06-10 17:54 42,368 --------- C:\WINDOWS\system32\drivers\agp440.sys
2007-06-10 17:54 42,240 --------- C:\WINDOWS\system32\drivers\viaagp.sys
2007-06-10 17:54 41,472 --------- C:\WINDOWS\system32\drivers\amdk7.sys
2007-06-10 17:54 41,088 --------- C:\WINDOWS\system32\drivers\sisagp.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-11 18:23:26 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-10 21:33:48 53,850 ----a-w C:\WINDOWS\system32\perfc013.dat
2007-06-10 21:33:48 364,882 ----a-w C:\WINDOWS\system32\perfh013.dat
2007-06-10 21:24:27 -------- d-----w C:\Program Files\Messenger
2007-06-10 17:13:24 -------- d-----w C:\Program Files\MSN Messenger
2007-06-10 15:54:22 -------- d-----w C:\Program Files\Movie Maker
2007-06-10 15:43:03 -------- d-----w C:\Program Files\Windows NT
2007-06-10 12:15:21 -------- d--h--w C:\Program Files\WindowsUpdate
2007-06-10 10:48:20 15,781 ----a-w C:\WINDOWS\system32\drivers\mdc8021x.sys
2007-05-16 15:19:43 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-04-25 14:22:52 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:15:26 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-03-17 13:45:54 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-14 17:51:00 83,704 ----a-w C:\WINDOWS\system32\pds.dll
2007-03-14 17:50:58 91,896 ----a-w C:\WINDOWS\system32\nts.dll
2007-03-14 17:50:56 83,648 ----a-w C:\WINDOWS\system32\loc32vc0.dll
2007-03-14 17:50:56 46,848 ----a-w C:\WINDOWS\system32\msgsys.dll
2007-03-14 17:50:54 34,552 ----a-w C:\WINDOWS\system32\cba.dll
2007-03-14 17:49:14 43,712 ----a-w C:\WINDOWS\system32\NavLogon.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 11:19]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 11:17]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 C:\WINDOWS\KHALMNPR.Exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 17:38]
"vptray"="D:\PROGRA~1\SYMANT~1\VPTray.exe" [2007-03-14 19:49]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"<NO NAME>"=
"StartCCC"=D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATIModeChange"=Ati2mdxx.exe
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
"Logitech Hardware Abstraction Layer"=KHALMNPR.EXE
"WinampAgent"=C:\Program Files\Winamp\winampa.exe

*Newly Created Service* - HTTPFILTER

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-14 16:00:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-14 16:04:25
C:\ComboFix-quarantined-files.txt ... 2007-06-14 16:04

--- E O F ---


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16:09, on 2007-06-14
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
D:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\ComboFix\catchme.cfexe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijack This\hijackthis.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: CCC.lnk.disabled
O4 - Global Startup: Logitech SetPoint.lnk.disabled
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: www.dell.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181477651909
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - D:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - Unknown owner - D:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 6298 bytes


mijnen klok is weg + helpt nog altijdniets
J

Jurgenv1

Legacy Member
Ziet er goed uit hoor, ik stel voor dat je je probleem in het software forum post.
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan