Archief - cpu is constant aan het draaien

hallo,

mijn cpu is constants aan het draaien. meestal zo iets tussen de 20 en 40 percent. dit vertraagt natuurlijk mijn systeem!! ik zelf ben een matige gebruiker en heb al heel wat progammatjes afgehaald om het te verbeteren maar niks helpt!!

hieronder vind je mijn hijackthis log!!! als er iemand mij kan helpen!!! ben ten einde raad!!!

greetz


Logfile of HijackThis v1.99.1
Scan saved at 14:34:17, on 1/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Medion Info Display\MdionLCM.exe
C:\WINDOWS\CNYHKey.exe
C:\WINDOWS\system32\CmUCReye.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\Lexmark 3300 Series\lxccmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\lxcccoms.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\KEVINA~1\LOCALS~1\Temp\Rar$EX00.094\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REGystem.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O1 - Hosts: 216.239.59.99 www.hbvl.be
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [MedionVFD] "C:\Program Files\Medion Info Display\MdionLCM.exe"
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [CmUCRRun] C:\WINDOWS\system32\CmUCReye.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [InstantOn] "C:\Program Files\CyberLink\PowerCinema Linux\ion_install.exe /c "
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [StatBar] "C:\Program Files\Globe Software\StatBar\StatBar.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - Startup: ~$start.doc
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3E90FFF5-1347-45B9-91F6-DA47926E9697} (PlaNet SysInfo Agent) - http://www.telenet.be/sys/tisp/ocx/PlaNetSysInfo.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1130364442791
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1139130465281
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.kodakimages.com/DesktopModules/SpectorAlbum/ImageUploader3.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game08.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://zone.msn.com/bingame/dash/default/DinerDash.1.0.0.87.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/74914091/activex/IPSUploader.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4841/mcfscan.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\swdsvc.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

En welk proces is daar voor verantwoordelijk?

ja dat is juist het probleem!!! het zijn er meerdere, namelijk :

svhost.exe ->system
taskmgr.exe
svhost.exe -> netwerkservice
system
csrss.exe

ze nemen allemaal niet veel in beslag : tussen 2 en 10% /proces maar alles tesamen kan da wel al tellen!!!

ben ten einde raad!!!

elke hulp is welkom

* Download Dial-a-fix via
http://wiki.djlizard.net/Dial-a-fix#Standard_version

Start Dial-A-Fix en in het hoofd-venster vink je alles aan en klik onderaan op 'Go'
Laat het tooltje zijn werk doen en herstart je pc, kijk of het dan gebeterd is.

ja oef ik dacht dat ik er nooit van af ging komen!!!!


BEDANKT

No problem.

ja sorry dat ik u opnieuw stoor maar het is weer hetzelfde!!! cpu blijft draaien!!! als ik het progammatje dan opnieuw laat lopen dan is het weg maar als ik dan gewoon even surf of een game speel dan herbegint het gewoon!!!!

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

ComboFix 07-08-04.3 - "kevin arents" 2007-08-04 7:57:05.3 [GMT 2:00] - NTFS
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.True
* Created a new restore point


((((((((((((((((((((((((( Files Created from 2007-07-04 to 2007-08-04 )))))))))))))))))))))))))))))))


2007-08-03 11:26 <DIR> d-------- C:\DOCUME~1\KEVINA~1\DoctorWeb
2007-08-03 11:12 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2007-08-01 16:18 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-30 11:15 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2007-07-29 20:38 <DIR> d-------- C:\DOCUME~1\KEVINA~1\APPLIC~1\Eyeblaster
2007-07-25 09:31 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Menu Start
2007-07-25 09:09 <DIR> d-------- C:\VIRUSfighter


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2164-01-10 17:34 --------- d-------- C:\Program Files\My Worst Day WW2
2164-01-10 17:07 --------- d-------- C:\Program Files\DVD Shrink
2007-08-03 11:18 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-08-01 14:21 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-01 14:21 --------- d-------- C:\Program Files\Google
2007-08-01 14:19 --------- d-------- C:\Program Files\Ubisoft
2007-08-01 14:09 --------- d-------- C:\Program Files\Attack on Pearl Harbor Demo
2007-07-31 14:00 --------- d-------- C:\Program Files\Zylom Games
2007-07-29 20:36 --------- d-------- C:\DOCUME~1\KEVINA~1\APPLIC~1\Zylom
2007-07-28 15:27 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-28 15:26 --------- d-------- C:\Program Files\AGEIA Technologies
2007-07-14 08:38 --------- d-------- C:\Program Files\Lx_cats
2007-07-11 13:01 554746 --a------ C:\WINDOWS\system32\perfh013.dat
2007-07-11 13:01 108750 --a------ C:\WINDOWS\system32\perfc013.dat
2007-06-22 18:50 --------- d-------- C:\Program Files\Wolfenstein - Enemy Territory
2007-06-22 14:39 --------- d-------- C:\Program Files\VideoLAN
2007-06-12 10:10 --------- d-------- C:\DOCUME~1\KEVINA~1\APPLIC~1\vlc
2007-06-09 16:43 --------- d-------- C:\Program Files\Rapidshare Unlimited
2007-05-22 18:37 60654 --a------ C:\DOCUME~1\KEVINA~1\APPLIC~1\wklnhst.dat
2007-05-21 17:35 221184 --a------ C:\WINDOWS\system32\UAService7.exe
2007-05-16 17:19 86528 --a--c--- C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 17:19 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 17:19 683520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 17:19 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-05-16 17:19 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 17:19 1314816 --a--c--- C:\WINDOWS\system32\dllcache\msoe.dll
2007-05-15 19:06 71208 --a------ C:\WINDOWS\system32\PhysXLoader.dll
2007-05-08 11:01 3583488 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll
2006-11-20 23:22 81920 --a------ C:\DOCUME~1\KEVINA~1\APPLIC~1\ezpinst.exe
2006-11-20 23:22 47360 --a------ C:\DOCUME~1\KEVINA~1\APPLIC~1\pcouffin.sys
2006-05-13 18:12 29626 --a------ C:\Program Files\INSTALL.LOG
2004-12-09 10:49 1139612 --a------ C:\Program Files\english.jpg
2004-12-08 17:30 815104 --a------ C:\Program Files\format5.dll
2004-12-07 11:50 8757293 --a------ C:\Program Files\drs832.dll
2004-11-23 10:41 8336 --a------ C:\Program Files\barcode.tif
2004-11-16 17:57 112177 --a------ C:\Program Files\background.jpg
2004-11-10 09:07 925463 --a------ C:\Program Files\lit.ytr
2004-11-08 09:16 6852 --a------ C:\Program Files\handprinting.tif
2004-11-05 13:57 241664 --a------ C:\Program Files\fbc.dll
2004-11-05 11:53 90112 --a------ C:\Program Files\bcode.dll
2004-11-04 14:18 135218 --a------ C:\Program Files\bcpl1.dll
2004-11-03 11:05 40328 --a------ C:\Program Files\default.bkg
2004-11-03 10:10 879938 --a------ C:\Program Files\colors.jpg
2004-11-03 10:10 1198433 --a------ C:\Program Files\autoformat.jpg
2004-11-02 13:58 811911 --a------ C:\Program Files\iri.ytr
2004-10-28 10:53 1592293 --a------ C:\Program Files\cro.ytr
2004-10-28 08:54 2107646 --a------ C:\Program Files\afr.ytr
2004-10-28 08:22 363659 --a------ C:\Program Files\ltn.ytr
2004-10-27 12:04 337293 --a------ C:\Program Files\brz.ytr
2004-10-27 11:23 861608 --a------ C:\Program Files\far.ytr
2004-10-25 16:45 443725 --a------ C:\Program Files\gal.ytr
2004-10-20 11:24 712059 --a------ C:\Program Files\deskew.jpg
2004-10-15 12:11 40256 --a------ C:\Program Files\alphabets.tif
2004-10-15 10:48 74840 --a------ C:\Program Files\italian.tif
2004-10-15 10:28 78096 --a------ C:\Program Files\greek.tif
2004-10-15 10:17 32982 --a------ C:\Program Files\czech.tif
2004-10-15 09:33 57802 --a------ C:\Program Files\brazilian.tif
2004-10-15 09:13 56402 --a------ C:\Program Files\french.tif
2004-10-14 15:53 623876 --a------ C:\Program Files\dutch.jpg
2004-09-27 18:32 163840 --a------ C:\Program Files\lftif14n.dll
2004-09-27 17:39 61440 --a------ C:\Program Files\lfgif14n.dll
2004-09-27 17:39 57344 --a------ C:\Program Files\lfbmp14n.dll
2004-09-27 17:39 53248 --a------ C:\Program Files\lfpcx14n.dll
2004-09-27 17:39 401408 --a------ C:\Program Files\lfcmp14n.dll
2004-09-27 17:39 262144 --a------ C:\Program Files\lfj2k14n.dll
2004-09-27 17:39 102400 --a------ C:\Program Files\lffax14n.dll
2004-09-27 17:38 950272 --a------ C:\Program Files\ltimg14n.dll
2004-09-27 17:38 282624 --a------ C:\Program Files\ltefx14n.dll
2004-09-27 17:38 167936 --a------ C:\Program Files\ltfil14n.dll
2004-09-21 14:32 495616 --a------ C:\Program Files\ltkrn14n.dll
2004-09-15 14:29 700455 --a------ C:\Program Files\fmtpdf.dll
2004-09-14 10:16 159744 --a------ C:\Program Files\lfpng14n.dll
2004-09-02 14:31 1294379 --a------ C:\Program Files\fmtcp8.dll
2004-08-30 10:00 299008 --a------ C:\Program Files\ltdis14n.dll
2004-08-24 16:26 53248 --a------ C:\Program Files\lfxwd14n.dll
2004-08-19 14:42 731455 --a------ C:\Program Files\cze.ytr
2004-07-20 10:27 335709 --a------ C:\Program Files\azl.ytr
2004-07-08 15:01 61769 --a------ C:\Program Files\ast.ytr
2004-07-02 17:27 80689 --a------ C:\Program Files\afa.ytr
2004-07-02 16:19 22213 --a------ C:\Program Files\lub.ytr
2004-02-22 14:08 1679360 --a------ C:\Program Files\lfdjv14n.dll
2004-01-12 08:59 592257 --a------ C:\Program Files\columns.jpg
2003-11-13 09:49 793552 --a------ C:\Program Files\catalan.jpg
2003-09-10 15:37 154366 --a------ C:\Program Files\digital.jpg
2003-09-10 11:47 861651 --a------ C:\Program Files\german.jpg
2003-08-26 09:54 1408888 --a------ C:\Program Files\dut.ytr
2003-08-26 09:49 1114586 --a------ C:\Program Files\eng.ytr
2003-08-18 09:18 68306 --a------ C:\Program Files\bik.ytr
2003-07-29 17:17 42409 --a------ C:\Program Files\cha.ytr
2003-07-28 15:54 74873 --a------ C:\Program Files\han.ytr
2003-07-14 16:55 442173 --a------ C:\Program Files\esp.ytr
2003-01-29 11:04 1435645 --a------ C:\Program Files\frn.ytr
2002-12-12 10:48 21898 --a------ C:\Program Files\bis.ytr
2002-12-12 10:00 352983 --a------ C:\Program Files\itl.ytr
2002-12-11 17:35 20794 --a------ C:\Program Files\fru.ytr
2002-10-22 11:25 889937 --a------ C:\Program Files\dan.ytr
2002-09-11 15:41 143360 --a------ C:\Program Files\iimages.dll
2002-09-02 10:30 77927 --a------ C:\Program Files\mac.ytr
2002-09-02 07:37 827635 --a------ C:\Program Files\ice.ytr
2002-08-30 17:10 656723 --a------ C:\Program Files\bul.ytr
2005-10-27 00:05:59 8 --sh--r C:\WINDOWS\system32\7767FFB962.sys
2005-10-27 00:05:59 4,704 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2006-10-22 13:22 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-08-18 16:20 C:\WINDOWS\RTHDCPL.EXE]
"Alcmtr"="ALCMTR.EXE" [2005-05-04 03:43 C:\WINDOWS\ALCMTR.EXE]
"MedionVFD"="C:\Program Files\Medion Info Display\MdionLCM.exe" [2005-10-11 18:11]
"ledpointer"="CNYHKey.exe" [2003-07-21 22:28 C:\WINDOWS\CNYHKey.exe]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-10-27 03:41]
"RemoteControl"="C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe" [2004-11-02 20:24]
"PCMService"="C:\Program Files\Home Cinema\PowerCinema\PCMService.exe" [2005-10-28 21:53]
"InstantOn"="C:\Program Files\CyberLink\PowerCinema Linux\ion_install.exe" [2005-09-22 14:19]
"SpeedTouch USB Diagnostics"="C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" [2001-10-03 11:09]
"lxccmon.exe"="C:\Program Files\Lexmark 3300 Series\lxccmon.exe" [2005-07-21 02:16]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2005-07-12 11:36]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-06 13:50]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-05-10 23:31]
"Run StartupMonitor"="StartupMonitor.exe" [2000-05-20 17:23 C:\WINDOWS\StartupMonitor.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-06-02 16:03]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-04 21:58]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"StatBar"="C:\Program Files\Globe Software\StatBar\StatBar.exe" []
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 23:53]

C:\Documents and Settings\kevin arents\Menu Start\Programma's\Opstarten\
~$start.doc [2006-04-18 16:44:25]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Reader Snelle start.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50]
BTTray.lnk - C:\Program Files\Belkin\Bluetooth Software\BTTray.exe [2005-08-24 15:06:54]
Run Google Web Accelerator.lnk - C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe [2007-07-09 22:24:38]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= scecli scecli

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AntivirusRegistration]
"C:\Program Files\CA\Etrust Antivirus\Register.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
mHotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

R0 sfvfs02;StarForce Protection VFS Driver (version 2.x);C:\WINDOWS\system32\drivers\sfvfs02.sys
R1 IKFileFlt;File Filter Driver;C:\WINDOWS\system32\drivers\ikfileflt.sys
R1 IKFileSec;File Security Driver;C:\WINDOWS\system32\drivers\ikfilesec.sys
R1 IkSysFlt;System Filter Driver;C:\WINDOWS\system32\drivers\iksysflt.sys
R1 IKSysSec;System Security Driver;C:\WINDOWS\system32\drivers\iksyssec.sys
R1 PQNTDrv;PQNTDrv;C:\WINDOWS\system32\drivers\PQNTDrv.sys
R2 atksgt;atksgt;C:\WINDOWS\system32\DRIVERS\atksgt.sys
R2 CdaC15BA;CdaC15BA;\??\C:\WINDOWS\system32\drivers\CdaC15BA.SYS
R2 lirsgt;lirsgt;C:\WINDOWS\system32\DRIVERS\lirsgt.sys
R2 SQLBrowser;SQL Server Browser;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe"
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys
R3 CMISTOR;CMIUCR.SYS CM320/CM220 Card Reader Driver;C:\WINDOWS\system32\DRIVERS\cmiucr.SYS
R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\system32\Drivers\pcouffin.sys
R3 XUIF;X10 USB Wireless Transceiver;C:\WINDOWS\system32\Drivers\x10ufx2.sys
S3 alcan5wn;Alcatel SpeedTouch USB ADSL PPP Networking Driver (NDISWAN);C:\WINDOWS\system32\DRIVERS\alcan5wn.sys
S3 idsvc;Windows CardSpace;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
S3 MPE;BDA MPE-filter;C:\WINDOWS\system32\DRIVERS\MPE.sys
S3 RT2500USB;RT2500 USB Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\rt2500usb.sys
S3 TVICHW32;TVICHW32;\??\C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"


**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-04 07:59:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-04 8:00:15
C:\ComboFix-quarantined-files.txt ... 2007-08-04 08:00

--- E O F ---




er is niks verbeterd hopelijk heb je er wat aan!!!!

* Download Dr.Web CureIt naar je bureaublad:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Dubbelklik drweb-cureit.exe en sta het toe om de express scan te starten.
• Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt, klik de Yes to all knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
• Eenmaal de korte scan is beeïndigd, Klik Options > Change Settings
• Kies de "Scan"-tab en verwijder het vinkje bij "Heuristic analyse"
• Terug in het hoofdvenster kan je de drives selecteren die je wilt laten scannen.
• Selecteer hier alle drives. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
• Klik daarna de groene pijl rechts om de scan te starten.
• Klik 'Yes to all' wanneer er gevraagd wordt om cure of move uit te voeren.
• Wanneer de scan gedaan is, kijk of je volgende icoontje kan aanklikken dat staat naast hetgeen gevonden werd:
  
• Indien wel, klik erop en daarna klik op het icoontje er net onder en kies: Move incurable zoals je zal zien in volgende afbeelding:
  
  
  
  Dit zal de bestanden verplaatsen naar volgende map %userprofile%\DoctorWeb\quarantaine-folder indien het niet gedesinfecteerd kan worden. (dit in het geval dat we samples nodig hebben)
• Na bovenstaande te selecteren, in het menu bovenaan van Dr.Web CureIt, klik file en kies save report list. Bewaar de log op je bureaublad.
• Sluit daarna Dr.Web Cureit.
• Herstart je computer!! Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.
• Na het herstarten, Kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post met een nieuw hijackthis logje.

A0069878.exe C:\System Volume Information\_restore{9D95432E-2081-476D-BE74-228FB838901E}\RP472 Tool.Prockill Incurable.Moved.

A0069879.exe C:\System Volume Information\_restore{9D95432E-2081-476D-BE74-228FB838901E}\RP472 Tool.ShutDown.11 Incurable.Moved.

A0069880.dll C:\System Volume Information\_restore{9D95432E-2081-476D-BE74-228FB838901E}\RP472 Adware.Minibug Incurable.Moved.

A0069881.exe C:\System Volume Information\_restore{9D95432E-2081-476D-BE74-228FB838901E}\RP472 Tool.Prockill Incurable.Moved.

Process.#xe C:\WINDOWS\system32 Tool.Prockill
Incurable.Moved.

voorlopig is alles goed:applause: :applause:

thanks

ja het is terug van da!!!!

na een tijdje komt het gewoon terug!!! raar

Ik weet het ook niet meer, start anders een topic in het software forum.