Archief - windows vraagt comcat.tcl te downloaden

Telkens als ik pc opstart en kom in windows xp dan vraagt die om comcat.tcl te download. Voor wat dient da bestand en waarom vraagt da steeds?

op google slechts 1 thread dus vermoedlijk spyware ... scan spyware, rtfs, post hijackthis in juiste forum

Ik denk ni da het spyware is... Volgens mij is het iets van windows, voor zover ik die thread begrijp.

thread spreekt over egister en plaaten waar de file staat, ok, maar dat wil niet zeggen dat da van windows is, dan zouden veeeeeel meer threads op google bestaan
post hijackthis dan zijn we zeker wat die melding veroorzaakt.

Ik krijg ook steeds blauw scherm, pc kan maar even opstaan of ik heb al blauw scherm.

Logfile of HijackThis v1.99.1
Scan saved at 14:32:39, on 14/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\LEXBCES.EXE
F:\WINDOWS\system32\LEXPPS.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\System32\drivers\CDAC11BA.EXE
F:\WINDOWS\System32\ezNTSvc.exe
C:\Gryx\server\xampp\FileZillaFTP\FileZilla Server.exe
F:\WINDOWS\system32\MrobeService.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\wuauclt.exe
F:\Program Files\Common Files\Stardock\SDMCP.exe
F:\WINDOWS\Explorer.exe
F:\WINDOWS\system\vmm32\msvbnet.tcl
F:\PROGRA~1\MICROS~4\WCESCOMM.EXE
F:\PROGRA~1\ISPMON~1\isp.exe
F:\PROGRA~1\MESSEN~3\MsgPlus.exe
F:\PROGRA~1\LEXMAR~1\lxbabmgr.exe
F:\PROGRA~1\MESSEN~1\msmsgs.exe
F:\WINDOWS\system32\wscntfy.exe
F:\PROGRA~1\KASPER~1\AVP6\avp.exe
F:\PROGRA~1\LEXMAR~1\lxbabmon.exe
F:\Program Files\Kaspersky Lab\AVP6\avp.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\FlashGet\flashget.exe
F:\WINDOWS\system\vmm32\msvbnet.tcl
F:\DOCUME~1\Familie\LOCALS~1\Temp\TEMPOR~1.ZIP\HIJACK~1.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=:0
R3 - URLSearchHook: AdsManager Class - {D1C8F9CE-563E-11D8-813C-005022E14DE2} - F:\PROGRA~1\LOOKNM~1\AddAPI.dll
F2 - REGystem.ini: Shell=Explorer.exe F:\WINDOWS\system\vmm32\comcat.tcl
F2 - REGystem.ini: UserInit=F:\WINDOWS\system32\userinit.exe,F:\WINDOWS\System32\ezShellStart.exe
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - F:\Program Files\MySearch\bar\2.bin\S4BAR.DLL (file missing)
O2 - BHO: CIEObject Object - {5D647E9C-6B37-4636-9A78-DADB1EB93BDF} - F:\WINDOWS\ctxpopup.dll (file missing)
O2 - BHO: (no name) - {78364D99-A640-4ddf-B91A-67EFF8373045} - F:\WINDOWS\system32\appwiz.dll (file missing)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - F:\Program Files\FlashGet\jccatch.dll
O2 - BHO: System - {D1C8F9CE-563E-11D8-813C-005022E14DE2} - F:\PROGRA~1\LOOKNM~1\AddAPI.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - F:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O4 - HKLM\..\Run: [MessengerPlus3] "F:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Lexmark X5100 Series] "F:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [MessengerPlus3] "F:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ISPMonitor] F:\PROGRA~1\ISPMON~1\isp.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "F:\PROGRA~1\MICROS~4\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Shortcut to avp.exe.lnk = F:\Program Files\Kaspersky Lab\AVP6\avp.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Download All by FlashGet - F:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - F:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: Script Checker - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - F:\Program Files\Kaspersky Lab\AVP6\scieplugin.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - F:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - F:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - F:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: InvulFormulieren - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - F:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: InvulFormulieren &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - F:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Opslaan - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - F:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Formulieren &^ opslaan - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - F:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: LookNMeet - {5D602A21-B929-11d7-A5D3-005022E14DE3} - http://www.looknmeet.be/ (file missing)
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - F:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: RoboForm Werkbalk &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - F:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Pop-Up Blocker - {84536FE2-ABCD-3586-DCAB-40E286323737} - F:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Pop-Up Blocker - {84536FE2-ABCD-3586-DCAB-40E286323737} - F:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\Program Files\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\Program Files\FlashGet\flashget.exe
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - F:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - F:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Microsoft AntiSpyware helper - {E4FFA025-9028-4946-A71F-F182D50E34AA} - F:\WINDOWS\System32\wldr.dll (file missing)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {E4FFA025-9028-4946-A71F-F182D50E34AA} - F:\WINDOWS\System32\wldr.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft AntiSpyware helper - {E4FFA025-9028-4946-A71F-F182D50E34AA} - F:\WINDOWS\System32\wldr.dll (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {E4FFA025-9028-4946-A71F-F182D50E34AA} - F:\WINDOWS\System32\wldr.dll (file missing) (HKCU)
O15 - Trusted Zone: www.archiviosex.net
O15 - Trusted Zone: www.redfunny.com
O15 - Trusted Zone: www.skymasters.biz
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 67.19.185.246
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab28578.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {344EAC3F-1760-11D8-828F-000992003A28} (Matrix1.Matrix1Ctrl) - http://www.wiskundeonline.nl/ActiveX/Matrices/Package/Matrix1Ctrl.CAB
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121444585250
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
O16 - DPF: {6D3C60A1-F35D-11D7-828F-000992003A28} (DocCfrAdm.DocCijferAdm) - http://www.wiskundeonline.nl/popups/DOCCFR.CAB
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - http://webcam.pcextreme.nl/activex/AMC.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab30149.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712...com/downloads/player/Install2.5/Installer.exe
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697517} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_aac.cab
O16 - DPF: {C9A703E2-3145-11D8-813C-005022E14DE2} (Installer Class) - http://www.looknmeet.be:8080/lnm_v4/agent/LNMAgentInstaller.cab
O16 - DPF: {CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} -
O16 - DPF: {D18B7EC3-EECA-11D3-8E71-0000E82C6C0D} - http://www.slotchbar.com/ist/softwares/remove/ist_remove.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://asp04.photoprintit.de/microsite/1287/defaults/activex/XUpload.ocx
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} - http://216.65.38.226/crack.CAB
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab28578.cab
O20 - Winlogon Notify: draw32 - draw32.dll (file missing)
O20 - Winlogon Notify: klogon - F:\WINDOWS\System32\klogon.dll
O20 - Winlogon Notify: MCPClient - F:\Program Files\Common Files\Stardock\mcpstub.dll
O23 - Service: Adobe LM Service - Adobe Systems - F:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVP - Kaspersky Lab - F:\Program Files\Kaspersky Lab\AVP6\avp.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - F:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: EasyBits Magic Desktop Services for Windows NT (ezntsvc) - EasyBits Software Corp. - F:\WINDOWS\System32\ezNTSvc.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - Unknown owner - C:\Gryx\server\xampp\FileZillaFTP\FileZilla Server.exe
O23 - Service: iPod-service (iPodService) - Apple Computer, Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - F:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MrobeService - OLYMPUS IMAGING CORP. - F:\WINDOWS\system32\MrobeService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe

F:\WINDOWS\System32\ezNTSvc.exe (tenzij gekend)
F:\WINDOWS\system32\MrobeService.exe (tenzij gekend) (wrs olympus digicam ...)
F:\WINDOWS\system\vmm32\msvbnet.tcl
F:\WINDOWS\system\vmm32\msvbnet.tcl

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = http=:0
F2 - REGystem.ini: Shell=Explorer.exe F:\WINDOWS\system\vmm32\comcat.tcl
F2 - REGystem.ini: UserInit=F:\WINDOWS\system32\userinit.exe,F:\WINDO WS\System32\ezShellStart.exe
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - F:\Program Files\MySearch\bar\2.bin\S4BAR.DLL (file missing)
O2 - BHO: CIEObject Object - {5D647E9C-6B37-4636-9A78-DADB1EB93BDF} - F:\WINDOWS\ctxpopup.dll (file missing)
O2 - BHO: (no name) - {78364D99-A640-4ddf-B91A-67EFF8373045} - F:\WINDOWS\system32\appwiz.dll (file missing)
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O9 - Extra button: Microsoft AntiSpyware helper - {E4FFA025-9028-4946-A71F-F182D50E34AA} - F:\WINDOWS\System32\wldr.dll (file missing)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {E4FFA025-9028-4946-A71F-F182D50E34AA} - F:\WINDOWS\System32\wldr.dll (file missing)
O9 - Extra button: Microsoft AntiSpyware helper - {E4FFA025-9028-4946-A71F-F182D50E34AA} - F:\WINDOWS\System32\wldr.dll (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {E4FFA025-9028-4946-A71F-F182D50E34AA} - F:\WINDOWS\System32\wldr.dll (file missing) (HKCU)
O15 - Trusted Zone: www.archiviosex.net
O15 - Trusted Zone: www.redfunny.com
O15 - Trusted Zone: www.skymasters.biz
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 67.19.185.246
O16 - DPF: {CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} -
O16 - DPF: {D18B7EC3-EECA-11D3-8E71-0000E82C6C0D} - http://www.slotchbar.com/ist/softwa.../ist_remove.cab
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} - http://216.65.38.226/crack.CAB
O20 - Winlogon Notify: draw32 - draw32.dll (file missing)
O20 - Winlogon Notify: klogon - F:\WINDOWS\System32\klogon.dll
O23 - Service: EasyBits Magic Desktop Services for Windows NT (ezntsvc) - EasyBits Software Corp. - F:\WINDOWS\System32\ezNTSvc.exe (indien gekend, laten staan)

Kheb het nog niet kunnen doen want ik kan veel exe bestanden niet meer openen, dan krijg ik steeds het "Openen met" venster.

http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip
http://www.dougknox.com/xp/file_assoc.htm

moderator noot:
Beste, je titel is erg vaag of nietszeggend. Een duidelijke titel helpt de mensen niet alleen om sneller te weten wat jouw probleem is, maar maakt het forum ook overzichtelijker. Jouw titel bevat echter geen goede omschrijving van je probleem en daarom werd je titel aangepast.Gelieve er in het vervolg op te letten.