Wijnen

Afgelopen week heb ik m'n pc weggebracht. Zodra ik even bezig was, liep m'n pc vast. Nu bracht die jongen m'n pc gisteren terug. Er was niets aan de hand, zei hij. Ik zit een half uur te computeren en hij liep vast. Toen is die jongen bij ons geweest. Vermoedelijke oorzaak: Ik heb de pc een een vrijwel afgesloten kastje staan. De warme lucht wordt uitgeblazen en vrijwel direct opgezogen door de ingaande ventilator. Nu de pc ouder wordt, draaien de ventilators vermoedelijk niet meer optimaal en wordt alles te warm. Ik heb m'n pc een andere plaats gegeven buiten de kast. Tot nu toe doet hij het goed. Laten we hopen dat het probleem daarmee verholpen is. Bedankt voor je tijd en adviezen.

De PC loopt constant vast en dan duurt het enkele uren voordat hij weer opstart, maar ik blijf het proberen.

Combofix starte meteen vanzelf op voordat ik het kladblok in combofix had kunnen slepen. Is dat erg? Ik kreeg vanzelf onderstaand log: ComboFix 10-03-08.01 - Bas 09-03-2010 9:20.2.2 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1023.494 [GMT 1:00] Gestart vanuit: c:\documents and settings\Bas\Mijn documenten\ComboFix.exe AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} * Nieuw herstelpunt werd aangemaakt . (((((((((((((((((((( Bestanden Gemaakt van 2010-02-09 to 2010-03-09 )))))))))))))))))))))))))))))) . 2010-03-07 21:06 . 2010-03-09 08:15 -------- d--h--r- c:\documents and settings\Bas\Onlangs geopend 2010-03-05 22:26 . 2010-03-05 22:26 -------- d-----w- c:\documents and settings\Bas\Application Data\Malwarebytes 2010-03-05 22:26 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-03-05 22:26 . 2010-03-05 22:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-03-05 22:26 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-03-05 22:26 . 2010-03-05 22:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-03-05 18:59 . 2010-03-05 18:59 388096 ----a-r- c:\documents and settings\Bas\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe 2010-03-05 18:59 . 2010-03-05 18:59 -------- d-----w- c:\program files\TrendMicro 2010-03-05 14:08 . 2010-03-05 14:15 18499623 ----a-w- C:\vlc-1.0.5-win32.exe 2010-02-10 12:11 . 2009-12-14 07:10 33280 -c----w- c:\windows\system32\dllcache\csrsrv.dll 2010-02-10 12:11 . 2009-12-08 09:25 474624 -c----w- c:\windows\system32\dllcache\shlwapi.dll 2010-02-10 12:11 . 2009-11-27 17:14 17920 -c----w- c:\windows\system32\dllcache\msyuv.dll 2010-02-10 12:11 . 2009-11-27 16:10 48128 -c----w- c:\windows\system32\dllcache\iyuv_32.dll 2010-02-10 12:11 . 2009-11-27 16:10 11264 -c----w- c:\windows\system32\dllcache\msrle32.dll 2010-02-10 12:11 . 2009-12-17 07:42 345600 -c----w- c:\windows\system32\dllcache\mspaint.exe 2010-02-09 08:10 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll 2010-02-09 08:06 . 2010-02-09 08:06 -------- d-----w- c:\windows\system32\wbem\Repository . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-09 08:20 . 2009-06-27 10:13 17408 ----a-w- c:\windows\system32\drivers\USBCRFT.SYS 2010-03-07 21:08 . 2009-10-08 09:24 -------- d-----w- c:\documents and settings\Bas\Application Data\vlc 2010-03-05 19:43 . 2009-06-29 18:14 -------- d-----w- c:\program files\CCleaner 2010-03-05 18:54 . 2009-11-14 20:48 -------- d-----w- c:\documents and settings\Bas\Application Data\Vso 2010-02-27 20:42 . 2009-08-04 21:42 -------- d-----w- c:\documents and settings\Bas\Application Data\Azureus 2010-02-09 08:05 . 2010-01-23 20:10 -------- d-----w- c:\program files\FTDv3.8 2010-02-09 08:05 . 2009-08-13 19:04 -------- d-----w- c:\documents and settings\Bas\Application Data\dvdcss 2010-01-08 23:28 . 2010-01-08 23:27 18030130 ----a-w- C:\vlc-1.0.3-win32.exe 2010-01-05 09:49 . 2008-02-24 12:35 841216 ------w- c:\windows\system32\wininet.dll 2010-01-05 09:49 . 2008-02-24 12:35 268288 ----a-w- c:\windows\system32\iertutil(2).dll 2010-01-05 09:49 . 2008-02-24 12:35 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-01-05 09:49 . 2004-08-04 12:00 17408 ----a-w- c:\windows\system32\corpol.dll 2009-12-31 16:50 . 2008-02-24 12:34 353792 ----a-w- c:\windows\system32\drivers\srv.sys 2009-12-17 07:42 . 2009-06-27 09:03 345600 ----a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:10 . 2004-08-04 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll 2009-12-10 13:05 . 2004-08-04 12:00 91922 ----a-w- c:\windows\system32\perfc013.dat 2009-12-10 13:05 . 2004-08-04 12:00 511840 ----a-w- c:\windows\system32\perfh013.dat 2009-12-09 10:11 . 2008-02-24 12:33 2149888 ------w- c:\windows\system32\ntoskrnl.exe 2009-12-09 10:11 . 2007-10-23 19:26 2028544 ------w- c:\windows\system32\ntkrnlpa.exe . ((((((((((((((((((((((((((((( SnapShot@2010-03-06_10.07.15 ))))))))))))))))))))))))))))))))))))))))) . + 2010-03-09 08:07 . 2010-03-09 08:07 16384 c:\windows\Temp\Perflib_Perfdata_79c.dat + 2009-07-19 12:09 . 2010-03-06 14:30 87716 c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe - 2009-06-04 12:15 . 2009-06-04 12:15 94208 c:\windows\system32\Adobe\Shockwave 11\SwMenu.dll + 2010-01-12 06:26 . 2010-01-12 06:26 94208 c:\windows\system32\Adobe\Shockwave 11\SwMenu.dll + 2010-01-12 05:54 . 2010-01-12 05:54 79488 c:\windows\system32\Adobe\Shockwave 11\gtapi.dll - 2009-06-04 11:45 . 2009-06-04 11:45 79488 c:\windows\system32\Adobe\Shockwave 11\gtapi.dll + 2010-01-12 06:41 . 2010-01-12 06:41 65816 c:\windows\system32\Adobe\Director\SWDNLD.EXE + 2010-01-12 06:28 . 2010-01-12 06:28 9216 c:\windows\system32\Adobe\Shockwave 11\DynaPlayer.dll - 2009-06-04 12:17 . 2009-06-04 12:17 9216 c:\windows\system32\Adobe\Shockwave 11\DynaPlayer.dll + 2010-01-12 05:54 . 2010-01-12 05:54 136568 c:\windows\system32\Adobe\Shockwave 11\SYMCCHECKER.DLL - 2009-06-04 12:15 . 2009-06-04 12:15 114688 c:\windows\system32\Adobe\Shockwave 11\SwInit.exe + 2010-01-12 06:26 . 2010-01-12 06:26 114688 c:\windows\system32\Adobe\Shockwave 11\SwInit.exe + 2010-01-12 06:39 . 2010-01-12 06:39 459032 c:\windows\system32\Adobe\Shockwave 11\SwHelper_1156606.exe - 2009-06-04 12:17 . 2009-06-04 12:17 446464 c:\windows\system32\Adobe\Shockwave 11\Proj.dll + 2010-01-12 06:29 . 2010-01-12 06:29 446464 c:\windows\system32\Adobe\Shockwave 11\Proj.dll + 2010-01-12 06:27 . 2010-01-12 06:27 372736 c:\windows\system32\Adobe\Shockwave 11\Plugin.dll - 2009-06-04 12:16 . 2009-06-04 12:16 372736 c:\windows\system32\Adobe\Shockwave 11\Plugin.dll + 2010-01-12 05:54 . 2010-01-12 05:54 753152 c:\windows\system32\Adobe\Shockwave 11\gi.dll + 2010-01-12 06:26 . 2010-01-12 06:26 503808 c:\windows\system32\Adobe\Shockwave 11\Control.dll + 2010-01-12 06:40 . 2010-01-12 06:40 213272 c:\windows\system32\Adobe\Director\SwDir.dll + 2010-01-12 06:28 . 2010-01-12 06:28 135168 c:\windows\system32\Adobe\Director\np32dsw.dll - 2009-06-04 11:51 . 2009-06-04 11:51 1011712 c:\windows\system32\Adobe\Shockwave 11\iml32.dll + 2010-01-12 06:01 . 2010-01-12 06:01 1011712 c:\windows\system32\Adobe\Shockwave 11\iml32.dll + 2010-01-12 05:54 . 2010-01-12 05:54 1975408 c:\windows\system32\Adobe\Shockwave 11\gt.exe - 2009-06-04 11:55 . 2009-06-04 11:55 1798144 c:\windows\system32\Adobe\Shockwave 11\dirapi.dll + 2010-01-12 06:05 . 2010-01-12 06:05 1798144 c:\windows\system32\Adobe\Shockwave 11\dirapi.dll . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Snelkoppeling naar eigenschappenvenster voor High Definition Audio"="HDAShCut.exe" [2008-02-24 61952] "Dit"="Dit.exe" [2004-07-20 90112] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-27 148888] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2005-6-15 1208320] Ralink Wireless Utility.lnk - c:\program files\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500.exe [2009-6-27 638976] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Vuze\\Azureus.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [20-2-2008 10:11 33800] R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [20-2-2008 10:08 472320] R3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\drivers\3xHybrid.sys [27-6-2009 11:31 882688] R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [12-5-2005 13:39 1287296] S0 rseb;rseb; [x] S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [4-8-2004 13:00 3584] S3 CardReaderFilter;Card Reader Filter;c:\windows\system32\drivers\USBCRFT.SYS [27-6-2009 11:13 17408] . . ------- Bijkomende Scan ------- . uStart Page = www.google.nl IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2010-03-09 09:23 Windows 5.1.2600 Service Pack 3 NTFS scannen van verborgen processen ... scannen van verborgen autostart items ... scannen van verborgen bestanden ... Scan succesvol afgerond verborgen bestanden: 0 ************************************************************************** . --------------------- DLLs Geladen Onder Lopende Processen --------------------- - - - - - - - > 'winlogon.exe'(764) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(1332) c:\program files\Windows Media Player\wmpband.dll c:\windows\system32\wpdshserviceobj.dll c:\windows\system32\portabledevicetypes.dll c:\windows\system32\portabledeviceapi.dll . Voltooingstijd: 2010-03-09 09:24:54 ComboFix-quarantined-files.txt 2010-03-09 08:24 ComboFix2.txt 2010-03-06 10:08 Pre-Run: 143.259.516.928 bytes beschikbaar Post-Run: 143.231.963.136 bytes beschikbaar - - End Of File - - 7E9321D75DBD1F5726A7CACF224CE5D0 Ik heb nu de externe harde schijf bij staan.

Aj, hij loopt weer vast. Gisterenmiddag deed hij het redelijk goed. Nadat ik mijn externe harde schijf bijgezet had, liep hij weer vast. Nu heb ik de externe harde schijf verwijderd en nu loopt hij geregeld weer vast.

In eerste instantie gaf hij aan dat Eset Nod32 Antivirus3.0 de zaak blokte. Deze heb ik uitgeschakeld zoals je zei. Hierna ging alles precies zoals je zei, dus hier het log: ComboFix 10-03-05.03 - Bas 06-03-2010 11:04:22.1.2 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1023.530 [GMT 1:00] Gestart vanuit: c:\documents and settings\Bas\Mijn documenten\Wijn73.exe AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Bas\Application Data\inst.exe . (((((((((((((((((((( Bestanden Gemaakt van 2010-02-06 to 2010-03-06 )))))))))))))))))))))))))))))) . 2010-03-05 22:26 . 2010-03-05 22:26 -------- d-----w- c:\documents and settings\Bas\Application Data\Malwarebytes 2010-03-05 22:26 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-03-05 22:26 . 2010-03-05 22:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-03-05 22:26 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-03-05 22:26 . 2010-03-05 22:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-03-05 19:43 . 2010-03-05 19:48 -------- d--h--r- c:\documents and settings\Bas\Onlangs geopend 2010-03-05 18:59 . 2010-03-05 18:59 388096 ----a-r- c:\documents and settings\Bas\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe 2010-03-05 18:59 . 2010-03-05 18:59 -------- d-----w- c:\program files\TrendMicro 2010-03-05 14:08 . 2010-03-05 14:15 18499623 ----a-w- C:\vlc-1.0.5-win32.exe 2010-02-10 12:11 . 2009-12-14 07:10 33280 -c----w- c:\windows\system32\dllcache\csrsrv.dll 2010-02-10 12:11 . 2009-12-08 09:25 474624 -c----w- c:\windows\system32\dllcache\shlwapi.dll 2010-02-10 12:11 . 2009-11-27 17:14 17920 -c----w- c:\windows\system32\dllcache\msyuv.dll 2010-02-10 12:11 . 2009-11-27 16:10 48128 -c----w- c:\windows\system32\dllcache\iyuv_32.dll 2010-02-10 12:11 . 2009-11-27 16:10 11264 -c----w- c:\windows\system32\dllcache\msrle32.dll 2010-02-10 12:11 . 2009-12-17 07:42 345600 -c----w- c:\windows\system32\dllcache\mspaint.exe 2010-02-09 08:10 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll 2010-02-09 08:06 . 2010-02-09 08:06 -------- d-----w- c:\windows\system32\wbem\Repository . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-06 09:49 . 2009-06-27 10:13 17408 ----a-w- c:\windows\system32\drivers\USBCRFT.SYS 2010-03-05 19:43 . 2009-06-29 18:14 -------- d-----w- c:\program files\CCleaner 2010-03-05 18:54 . 2009-11-14 20:48 -------- d-----w- c:\documents and settings\Bas\Application Data\Vso 2010-03-05 14:23 . 2009-10-08 09:24 -------- d-----w- c:\documents and settings\Bas\Application Data\vlc 2010-02-27 20:42 . 2009-08-04 21:42 -------- d-----w- c:\documents and settings\Bas\Application Data\Azureus 2010-02-09 08:05 . 2010-01-23 20:10 -------- d-----w- c:\program files\FTDv3.8 2010-02-09 08:05 . 2009-08-13 19:04 -------- d-----w- c:\documents and settings\Bas\Application Data\dvdcss 2010-01-08 23:28 . 2010-01-08 23:27 18030130 ----a-w- C:\vlc-1.0.3-win32.exe 2010-01-05 09:49 . 2008-02-24 12:35 841216 ----a-w- c:\windows\system32\wininet.dll 2010-01-05 09:49 . 2008-02-24 12:35 268288 ----a-w- c:\windows\system32\iertutil(2).dll 2010-01-05 09:49 . 2008-02-24 12:35 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-01-05 09:49 . 2004-08-04 12:00 17408 ----a-w- c:\windows\system32\corpol.dll 2009-12-31 16:50 . 2008-02-24 12:34 353792 ----a-w- c:\windows\system32\drivers\srv.sys 2009-12-17 07:42 . 2009-06-27 09:03 345600 ----a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:10 . 2004-08-04 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll 2009-12-10 13:05 . 2004-08-04 12:00 91922 ----a-w- c:\windows\system32\perfc013.dat 2009-12-10 13:05 . 2004-08-04 12:00 511840 ----a-w- c:\windows\system32\perfh013.dat 2009-12-09 10:11 . 2008-02-24 12:33 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe 2009-12-09 10:11 . 2007-10-23 19:26 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Snelkoppeling naar eigenschappenvenster voor High Definition Audio"="HDAShCut.exe" [2008-02-24 61952] "Dit"="Dit.exe" [2004-07-20 90112] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-27 148888] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2005-6-15 1208320] Ralink Wireless Utility.lnk - c:\program files\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500.exe [2009-6-27 638976] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Vuze\\Azureus.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [20-2-2008 10:11 33800] R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [20-2-2008 10:08 472320] R3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\drivers\3xHybrid.sys [27-6-2009 11:31 882688] R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [12-5-2005 13:39 1287296] S0 rseb;rseb; [x] S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [4-8-2004 13:00 3584] S3 CardReaderFilter;Card Reader Filter;c:\windows\system32\drivers\USBCRFT.SYS [27-6-2009 11:13 17408] . . ------- Bijkomende Scan ------- . uStart Page = www.google.nl IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 . - - - - ORPHANS VERWIJDERD - - - - HKLM-Run-Cmaudio - cmicnfg.cpl AddRemove-Agere Systems Soft Modem - c:\windows\agrsmdel ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2010-03-06 11:07 Windows 5.1.2600 Service Pack 3 NTFS scannen van verborgen processen ... scannen van verborgen autostart items ... scannen van verborgen bestanden ... Scan succesvol afgerond verborgen bestanden: 0 ************************************************************************** . --------------------- DLLs Geladen Onder Lopende Processen --------------------- - - - - - - - > 'winlogon.exe'(756) c:\windows\system32\Ati2evxx.dll . Voltooingstijd: 2010-03-06 11:08:28 ComboFix-quarantined-files.txt 2010-03-06 10:08 Pre-Run: 143.771.480.064 bytes beschikbaar Post-Run: 143.793.041.408 bytes beschikbaar WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect - - End Of File - - 260CEE95FAD129AB72149F5B81A89CD4

Het duurde even...wanneer de PC vastloopt, duurt het even voordat ik 'm weer kan opstarten. Het is net of hij af moet koelen of zo. Hier het resultaat logje: Malwarebytes' Anti-Malware 1.44 Database versie: 3827 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 5-3-2010 23:31:47 mbam-log-2010-03-05 (23-31-47).txt Scan type: Snelle Scan Objecten gescand: 115333 Verstreken tijd: 4 minute(s), 10 second(s) Geheugenprocessen geïnfecteerd: 0 Geheugenmodulen geïnfecteerd: 0 Registersleutels geïnfecteerd: 0 Registerwaarden geïnfecteerd: 0 Registerdata bestanden geïnfecteerd: 0 Mappen geïnfecteerd: 0 Bestanden geïnfecteerd: 0 Geheugenprocessen geïnfecteerd: (Geen kwaadaardige items gevonden) Geheugenmodulen geïnfecteerd: (Geen kwaadaardige items gevonden) Registersleutels geïnfecteerd: (Geen kwaadaardige items gevonden) Registerwaarden geïnfecteerd: (Geen kwaadaardige items gevonden) Registerdata bestanden geïnfecteerd: (Geen kwaadaardige items gevonden) Mappen geïnfecteerd: (Geen kwaadaardige items gevonden) Bestanden geïnfecteerd: (Geen kwaadaardige items gevonden) Alvast bedankt voor je hulp. ---------- Post toegevoegd om 23:41 ---------- Vorige post was om 23:36 ---------- Hier vroeg je ook nog om, zag ik later: Het nieuwe log resultaat: Logfile of Trend Micro HijackThis v2.0.3 (BETA) Scan saved at 23:40:11, on 5-3-2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.21183) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\LSI SoftModem\agrsmsvc.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\Dit.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe C:\Program Files\Java\jre6\bin\jucheck.exe C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [snelkoppeling naar eigenschappenvenster voor High Definition Audio] HDAShCut.exe O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Registration-Studio 8 SE.lnk = C:\Program Files\Pinnacle\Studio 8\Register\RegTool.exe O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500.exe O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1246099429187 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Program Files\LSI SoftModem\agrsmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe -- End of file - 7378 bytes

Bedankt!

Mijn PC is traag en loopt regelmatig vast. Volgens mij moet ik dit log posten, wil iemand mij kunnen helpen: Logfile of Trend Micro HijackThis v2.0.3 (BETA) Scan saved at 20:00:38, on 5-3-2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.21183) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\Dit.exe C:\WINDOWS\system32\RunDll32.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500.exe C:\Program Files\LSI SoftModem\agrsmsvc.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Java\jre6\bin\jucheck.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.nl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [snelkoppeling naar eigenschappenvenster voor High Definition Audio] HDAShCut.exe O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\RunOnce: [shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 1.1.4322; InfoPath.2; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"Boarder XL" O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice') O4 - HKUS\S-1-5-20\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Netwerkservice') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user') O4 - Startup: Registration-Studio 8 SE.lnk = C:\Program Files\Pinnacle\Studio 8\Register\RegTool.exe O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500.exe O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1246099429187 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Program Files\LSI SoftModem\agrsmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe -- Als ik iets verkeerd doe, dan hoor ik het graag.