Ga naar inhoud

Run DLL32 host proces werkt niet meer ?


vicky_i

Aanbevolen berichten

  • Reacties 23
  • Aangemaakt
  • Laatste reactie

Beste reacties in dit topic

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Folder::

c:\program files\KGB

Registry::

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

[-HKEY_CLASSES_ROOT\clsid\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]

[-HKEY_CLASSES_ROOT\agcutils.AGSearchHook.1]

[-HKEY_CLASSES_ROOT\TypeLib\{647B16D8-AD7B-4983-82D7-82A270FC9E6D}]

[-HKEY_CLASSES_ROOT\agcutils.AGSearchHook]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0BC6E3FA-78EF-4886-842C-5A1258C4455A}]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht samen met een nieuw logje van HijackThis.

Link naar reactie
Delen op andere sites

logje van HijackThis :

Logfile of Trend Micro HijackThis v2.0.3 (BETA)

Scan saved at 21:04:40, on 19/12/2009

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18865)

Boot mode: Normal

Running processes:

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = mijnAOL | HP

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sysMon] C:\Windows\system32\rundll32.exe "C:\ProgramData\SysMon\SysMon.dll" rdl

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe

O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

--

End of file - 8011 bytes

en een logje van die combofix of kittyfix :

ComboFix 09-12-18.03 - vicky iliaens 19/12/2009 20:18:58.2.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.1918.990 [GMT 1:00]

Gestart vanuit: c:\users\vicky iliaens\Downloads\KittyFix.exe

gebruikte Opdracht switches :: c:\users\vicky iliaens\Desktop\CFScript.txt

AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

SP: Kaspersky Internet Security *enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\KGB

c:\program files\KGB\German.lng

c:\program files\KGB\Help\English\alarms.htm

c:\program files\KGB\Help\English\clipboard.htm

c:\program files\KGB\Help\English\computer.htm

c:\program files\KGB\Help\English\delivery.htm

c:\program files\KGB\Help\English\filters.htm

c:\program files\KGB\Help\English\Help.chm

c:\program files\KGB\Help\English\internet.htm

c:\program files\KGB\Help\English\invisible.htm

c:\program files\KGB\Help\English\keyboard.htm

c:\program files\KGB\Help\English\log_size.htm

c:\program files\KGB\Help\English\logging.htm

c:\program files\KGB\Help\English\password.htm

c:\program files\KGB\Help\English\programs.htm

c:\program files\KGB\Help\English\screenshot.htm

c:\program files\KGB\Help\English\settings_node.htm

c:\program files\KGB\Help\English\update.htm

c:\program files\KGB\Help\English\users_node.htm

c:\program files\KGB\Help\German\Help.chm

c:\program files\KGB\Help\German\update.htm

c:\program files\KGB\Help\Russian\alarms.htm

c:\program files\KGB\Help\Russian\clipboard.htm

c:\program files\KGB\Help\Russian\computer.htm

c:\program files\KGB\Help\Russian\delivery.htm

c:\program files\KGB\Help\Russian\filters.htm

c:\program files\KGB\Help\Russian\Help.chm

c:\program files\KGB\Help\Russian\internet.htm

c:\program files\KGB\Help\Russian\invisible.htm

c:\program files\KGB\Help\Russian\keyboard.htm

c:\program files\KGB\Help\Russian\log_size.htm

c:\program files\KGB\Help\Russian\logging.htm

c:\program files\KGB\Help\Russian\password.htm

c:\program files\KGB\Help\Russian\programs.htm

c:\program files\KGB\Help\Russian\screenshot.htm

c:\program files\KGB\Help\Russian\settings_node.htm

c:\program files\KGB\Help\Russian\update.htm

c:\program files\KGB\Help\Russian\users_node.htm

c:\program files\KGB\Help\Spanish\alarms.htm

c:\program files\KGB\Help\Spanish\clipboard.htm

c:\program files\KGB\Help\Spanish\computer.htm

c:\program files\KGB\Help\Spanish\delivery.htm

c:\program files\KGB\Help\Spanish\filters.htm

c:\program files\KGB\Help\Spanish\Help.chm

c:\program files\KGB\Help\Spanish\internet.htm

c:\program files\KGB\Help\Spanish\invisible.htm

c:\program files\KGB\Help\Spanish\keyboard.htm

c:\program files\KGB\Help\Spanish\log_size.htm

c:\program files\KGB\Help\Spanish\logging.htm

c:\program files\KGB\Help\Spanish\password.htm

c:\program files\KGB\Help\Spanish\programs.htm

c:\program files\KGB\Help\Spanish\screenshot.htm

c:\program files\KGB\Help\Spanish\settings_node.htm

c:\program files\KGB\Help\Spanish\update.htm

c:\program files\KGB\Help\Spanish\users_node.htm

c:\program files\KGB\Images\english.gif

c:\program files\KGB\Images\german.gif

c:\program files\KGB\Images\russian.gif

c:\program files\KGB\key.bin

c:\program files\KGB\libeay32.dll

c:\program files\KGB\logstart.vbs

c:\program files\KGB\loguninstall.vbs

c:\program files\KGB\Mpk.dll

c:\program files\KGB\MPK.exe

c:\program files\KGB\Mpk64.dll

c:\program files\KGB\MPK64.exe

c:\program files\KGB\MPKView.exe

c:\program files\KGB\Romanian.lng

c:\program files\KGB\Russian.lng

c:\program files\KGB\self_copy.vbs

c:\program files\KGB\Spanish.lng

c:\program files\KGB\sqlite3.dll

c:\program files\KGB\ssleay32.dll

c:\program files\KGB\unins000.dat

c:\program files\KGB\unins000.exe

c:\windows\TEMP\logishrd\LVPrcInj01.dll

.

(((((((((((((((((((( Bestanden Gemaakt van 2009-11-19 to 2009-12-19 ))))))))))))))))))))))))))))))

.

2009-12-19 19:31 . 2009-12-19 19:37 -------- d-----w- c:\users\vicky iliaens\AppData\Local\temp

2009-12-19 19:31 . 2009-12-19 19:31 -------- d-----w- c:\users\Public\AppData\Local\temp

2009-12-19 19:31 . 2009-12-19 19:31 -------- d-----w- c:\users\Gast\AppData\Local\temp

2009-12-19 19:31 . 2009-12-19 19:31 -------- d-----w- c:\users\Default\AppData\Local\temp

2009-12-19 19:31 . 2009-12-19 19:31 -------- d-----w- c:\users\Bruno\AppData\Local\temp

2009-12-16 14:12 . 2009-12-16 14:12 388096 ----a-r- c:\users\vicky iliaens\AppData\Roaming\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe

2009-12-16 14:12 . 2009-12-16 14:12 -------- d-----w- c:\program files\TrendMicro

2009-12-14 04:33 . 2009-12-14 04:33 249856 ------w- c:\windows\Setup1.exe

2009-12-14 04:33 . 2009-12-14 04:33 73216 ----a-w- c:\windows\ST6UNST.EXE

2009-12-14 03:44 . 2009-12-14 03:44 -------- d-----w- c:\program files\Recuva

2009-12-13 16:06 . 2009-12-13 16:06 658696 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2009-12-13 05:25 . 2009-12-13 05:25 -------- d-----w- c:\program files\Windows Portable Devices

2009-12-13 02:06 . 2009-12-14 03:14 -------- d-----w- c:\program files\PowerDataRecovery

2009-12-13 02:05 . 2009-09-10 02:00 92672 ----a-w- c:\windows\system32\UIAnimation.dll

2009-12-13 02:05 . 2009-09-10 02:01 3023360 ----a-w- c:\windows\system32\UIRibbon.dll

2009-12-13 02:05 . 2009-09-10 02:00 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll

2009-12-13 02:03 . 2009-10-01 01:01 60928 ----a-w- c:\windows\system32\PortableDeviceConnectApi.dll

2009-12-13 02:03 . 2009-10-01 01:01 33280 ----a-w- c:\windows\system32\WpdConns.dll

2009-12-13 02:03 . 2009-10-01 01:02 2537472 ----a-w- c:\windows\system32\wpdshext.dll

2009-12-13 02:03 . 2009-10-01 01:02 334848 ----a-w- c:\windows\system32\PortableDeviceApi.dll

2009-12-13 02:03 . 2009-10-01 01:02 87552 ----a-w- c:\windows\system32\WPDShServiceObj.dll

2009-12-13 02:03 . 2009-10-01 01:01 546816 ----a-w- c:\windows\system32\wpd_ci.dll

2009-12-13 02:03 . 2009-10-01 01:01 160256 ----a-w- c:\windows\system32\PortableDeviceTypes.dll

2009-12-13 02:03 . 2009-10-01 01:01 350208 ----a-w- c:\windows\system32\WPDSp.dll

2009-12-13 02:03 . 2009-10-01 01:01 196608 ----a-w- c:\windows\system32\PortableDeviceWMDRM.dll

2009-12-13 02:03 . 2009-10-01 01:01 100864 ----a-w- c:\windows\system32\PortableDeviceClassExtension.dll

2009-12-13 02:03 . 2009-10-01 01:01 40448 ----a-w- c:\windows\system32\drivers\WpdUsb.sys

2009-12-13 02:03 . 2009-10-01 01:01 226816 ----a-w- c:\windows\system32\WpdMtp.dll

2009-12-13 02:03 . 2009-10-01 01:01 61952 ----a-w- c:\windows\system32\WpdMtpUS.dll

2009-12-13 02:01 . 2009-10-08 21:07 4096 ----a-w- c:\windows\system32\oleaccrc.dll

2009-12-13 02:01 . 2009-10-08 21:08 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll

2009-12-13 02:01 . 2009-10-08 21:08 234496 ----a-w- c:\windows\system32\oleacc.dll

2009-12-12 23:08 . 2009-12-17 01:46 -------- d-----w- c:\users\vicky iliaens\AppData\Roaming\skypePM

2009-12-12 20:47 . 2009-12-12 20:47 -------- d-----w- c:\windows\system32\ca-ES

2009-12-12 20:47 . 2009-12-12 20:47 -------- d-----w- c:\windows\system32\eu-ES

2009-12-12 20:47 . 2009-12-12 20:47 -------- d-----w- c:\windows\system32\vi-VN

2009-12-12 20:04 . 2009-04-11 06:28 83968 ----a-w- c:\windows\system32\wbem\wmiutils.dll

2009-12-12 20:04 . 2009-04-11 06:28 744448 ----a-w- c:\windows\system32\wbem\wbemcore.dll

2009-12-12 20:04 . 2009-04-11 06:28 30208 ----a-w- c:\windows\system32\wbem\wbemprox.dll

2009-12-12 20:04 . 2009-04-11 06:28 218624 ----a-w- c:\windows\system32\wdscore.dll

2009-12-12 20:04 . 2009-04-11 06:28 705536 ----a-w- c:\windows\system32\SmiEngine.dll

2009-12-12 20:04 . 2009-04-11 06:28 265728 ----a-w- c:\windows\system32\wbem\repdrvfs.dll

2009-12-12 20:04 . 2009-04-11 06:28 189440 ----a-w- c:\windows\system32\wbem\mofd.dll

2009-12-12 20:04 . 2009-04-11 06:28 614912 ----a-w- c:\windows\system32\wbem\fastprox.dll

2009-12-12 20:04 . 2009-04-11 06:28 265728 ----a-w- c:\windows\system32\wbem\esscli.dll

2009-12-12 20:04 . 2009-04-11 06:28 247808 ----a-w- c:\windows\system32\drvstore.dll

2009-12-12 20:04 . 2009-04-11 06:27 130560 ----a-w- c:\windows\system32\PkgMgr.exe

2009-12-12 19:41 . 2009-04-11 06:32 43496 ----a-w- c:\windows\system32\drivers\pciidex.sys

2009-12-12 19:40 . 2009-04-11 06:28 286720 ----a-w- c:\windows\system32\rasapi32.dll

2009-12-12 19:39 . 2009-04-11 06:28 677376 ----a-w- c:\windows\system32\imapi2fs.dll

2009-12-12 19:07 . 2009-12-12 19:07 -------- d-----w- c:\windows\system32\EventProviders

2009-12-12 15:27 . 2009-12-12 15:27 -------- d-----w- c:\program files\Common Files\Skype

2009-12-12 15:27 . 2009-12-12 15:27 -------- d-----r- c:\program files\Skype

2009-12-12 12:22 . 2009-12-12 22:52 -------- d-----w- c:\programdata\hostsvr

2009-12-10 02:07 . 2009-11-09 12:31 24064 ----a-w- c:\windows\system32\nshhttp.dll

2009-12-10 02:07 . 2009-11-09 10:36 411648 ----a-w- c:\windows\system32\drivers\http.sys

2009-12-10 02:07 . 2009-11-09 12:30 30720 ----a-w- c:\windows\system32\httpapi.dll

2009-12-09 16:20 . 2009-10-07 11:36 243712 ----a-w- c:\windows\system32\rastls.dll

2009-11-26 02:02 . 2009-10-29 09:17 2048 ----a-w- c:\windows\system32\tzres.dll

2009-11-25 07:08 . 2009-08-11 16:44 1401856 ----a-w- c:\windows\system32\msxml6.dll

2009-11-25 07:08 . 2009-08-11 16:44 1248768 ----a-w- c:\windows\system32\msxml3.dll

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-19 19:33 . 2008-03-02 02:01 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs

2009-12-19 19:32 . 2009-01-22 23:48 8365088 --sha-w- c:\windows\system32\drivers\fidbox.dat

2009-12-19 19:32 . 2009-01-22 23:48 68528 --sha-w- c:\windows\system32\drivers\fidbox.idx

2009-12-19 19:32 . 2009-01-22 23:48 6216 --sha-w- c:\windows\system32\drivers\fidbox2.idx

2009-12-19 19:32 . 2009-01-22 23:48 1196064 --sha-w- c:\windows\system32\drivers\fidbox2.dat

2009-12-19 19:28 . 2009-06-16 23:33 -------- d-sh--w- c:\programdata\MPK

2009-12-19 19:08 . 2008-11-27 20:24 -------- d-----w- c:\programdata\Kaspersky Lab

2009-12-19 18:32 . 2007-09-14 12:47 667114 ----a-w- c:\windows\system32\perfh013.dat

2009-12-19 18:32 . 2007-09-14 12:47 126648 ----a-w- c:\windows\system32\perfc013.dat

2009-12-17 06:49 . 2008-03-12 02:49 -------- d-----w- c:\users\vicky iliaens\AppData\Roaming\Skype

2009-12-13 05:25 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat

2009-12-13 05:25 . 2009-12-13 05:25 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf

2009-12-13 05:24 . 2009-12-13 05:24 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf

2009-12-12 23:08 . 2009-12-12 23:08 56 ---ha-w- c:\programdata\ezsidmv.dat

2009-12-12 22:53 . 2009-08-07 22:15 -------- d-----w- c:\program files\Unlocker

2009-12-12 20:47 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar

2009-12-12 20:47 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar

2009-12-12 20:47 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal

2009-12-12 20:47 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration

2009-12-12 20:47 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail

2009-12-12 20:47 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery

2009-12-12 20:47 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender

2009-12-12 15:27 . 2008-03-12 02:47 -------- d-----w- c:\programdata\Skype

2009-12-12 13:11 . 2008-07-21 05:29 -------- d-----w- c:\program files\Samsung

2009-12-09 01:30 . 2007-09-14 03:42 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-12-05 04:30 . 2009-02-08 20:29 -------- d-----w- c:\users\vicky iliaens\AppData\Roaming\Audacity

2009-12-04 00:33 . 2008-06-15 10:26 5288 ----a-w- c:\users\vicky iliaens\AppData\Roaming\wklnhst.dat

2009-11-21 06:40 . 2009-12-09 16:21 916480 ----a-w- c:\windows\system32\wininet.dll

2009-11-21 06:34 . 2009-12-09 16:21 71680 ----a-w- c:\windows\system32\iesetup.dll

2009-11-21 06:34 . 2009-12-09 16:21 109056 ----a-w- c:\windows\system32\iesysprep.dll

2009-11-21 04:59 . 2009-12-09 16:21 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2009-11-19 11:10 . 2008-11-27 19:58 680 ----a-w- c:\users\vicky iliaens\AppData\Local\d3d9caps.dat

2009-11-02 19:42 . 2009-10-02 22:34 195456 ------w- c:\windows\system32\MpSigStub.exe

2009-10-14 13:11 . 2008-11-27 20:24 95259 ----a-w- c:\windows\system32\drivers\klick.dat

2009-10-14 13:11 . 2008-11-27 20:24 108059 ----a-w- c:\windows\system32\drivers\klin.dat

2009-10-01 01:02 . 2009-12-13 02:04 30208 ----a-w- c:\windows\system32\WPDShextAutoplay.exe

2009-10-01 01:02 . 2009-12-13 02:04 31232 ----a-w- c:\windows\system32\BthMtpContextHandler.dll

2009-10-01 01:01 . 2009-12-13 02:04 81920 ----a-w- c:\windows\system32\wpdbusenum.dll

2009-09-25 02:10 . 2009-12-13 02:04 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll

2009-09-25 02:07 . 2009-12-13 02:04 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll

2009-09-25 02:04 . 2009-12-13 02:04 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll

2009-09-25 01:49 . 2009-12-13 02:04 1554432 ----a-w- c:\windows\system32\xpsservices.dll

2009-09-25 01:48 . 2009-12-13 02:04 351232 ----a-w- c:\windows\system32\XpsPrint.dll

2009-09-25 01:38 . 2009-12-13 02:04 847360 ----a-w- c:\windows\system32\OpcServices.dll

2009-09-25 01:36 . 2009-12-13 02:04 280064 ----a-w- c:\windows\system32\XpsGdiConverter.dll

2009-09-25 01:35 . 2009-12-13 02:04 135680 ----a-w- c:\windows\system32\XpsRasterService.dll

2009-09-25 01:33 . 2009-12-13 02:04 195584 ----a-w- c:\windows\system32\dxdiagn.dll

2009-09-25 01:33 . 2009-12-13 02:04 829440 ----a-w- c:\windows\system32\d3d10warp.dll

2009-09-25 01:33 . 2009-12-13 02:04 369664 ----a-w- c:\windows\system32\WMPhoto.dll

2009-09-25 01:32 . 2009-12-13 02:04 252928 ----a-w- c:\windows\system32\dxdiag.exe

2009-09-25 01:31 . 2009-12-13 02:04 519680 ----a-w- c:\windows\system32\d3d11.dll

2009-09-25 01:31 . 2009-12-13 02:04 486912 ----a-w- c:\windows\system32\d3d10level9.dll

2009-09-25 01:31 . 2009-12-13 02:04 161280 ----a-w- c:\windows\system32\d3d10_1.dll

2009-09-25 01:31 . 2009-12-13 02:04 218112 ----a-w- c:\windows\system32\d3d10_1core.dll

2009-09-25 01:31 . 2009-12-13 02:04 1030144 ----a-w- c:\windows\system32\d3d10.dll

2009-09-25 01:31 . 2009-12-13 02:04 828928 ----a-w- c:\windows\system32\d2d1.dll

2009-09-25 01:30 . 2009-12-13 02:04 481792 ----a-w- c:\windows\system32\dxgi.dll

2009-09-25 01:30 . 2009-12-13 02:04 190464 ----a-w- c:\windows\system32\d3d10core.dll

2009-09-25 01:27 . 2009-12-13 02:04 634880 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2009-09-25 01:27 . 2009-12-13 02:04 37888 ----a-w- c:\windows\system32\cdd.dll

2009-09-25 01:27 . 2009-12-13 02:04 793088 ----a-w- c:\windows\system32\FntCache.dll

2009-09-25 01:27 . 2009-12-13 02:04 1064448 ----a-w- c:\windows\system32\DWrite.dll

2009-09-24 22:54 . 2009-12-13 02:04 258048 ----a-w- c:\windows\system32\winspool.drv

2009-09-24 22:54 . 2009-12-13 02:04 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe

2009-09-24 22:54 . 2009-12-13 02:04 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll

2007-09-14 13:09 . 2007-09-14 12:51 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]

"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]

"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-05 201992]

"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]

"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"SysMon"="c:\programdata\SysMon\SysMon.dll" [2008-01-24 626688]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Launcher"="c:\windows\SMINST\launcher.exe" [2007-04-03 44168]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup

backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2008-10-15 00:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]

2007-05-24 11:13 71176 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2009-07-13 12:03 292128 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]

2006-12-08 16:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

2008-05-22 12:49 13539872 ----a-w- c:\windows\System32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

2008-05-22 12:49 92704 ----a-w- c:\windows\System32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OsdMaestro]

2007-02-15 11:59 118784 ----a-w- c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2009-05-26 15:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

2009-10-09 12:11 25623336 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateReg]

2007-04-07 00:56 54936 ----a-w- c:\windows\System32\jureg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WPCUMI]

2006-11-02 12:35 176128 ----a-w- c:\windows\System32\wpcumi.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

"VistaSp2"=hex(B):99,31,99,d3,6d,7b,ca,01

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [29/01/2008 18:29 33808]

R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [13/03/2008 19:02 26640]

S2 AGWinService;AG Windows Service;c:\program files\AGI\common\win32\pythonservice.exe [1/10/2008 23:18 10240]

S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [26/06/2008 13:21 21504]

S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [6/08/2009 0:35 54632]

S3 fsssvc;De service Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [5/08/2009 21:48 704864]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

------- Bijkomende Scan -------

.

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=NL_BE&c=74&bd=Pavilion&pf=desktop

uInternet Settings,ProxyOverride = *.local

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

LSP: c:\windows\system32\wpclsp.dll

DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab

FF - ProfilePath - c:\users\vicky iliaens\AppData\Roaming\Mozilla\Firefox\Profiles\mf6vci4g.default\

FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157

FF - prefs.js: keyword.URL - hxxp://kwtb.search.imgag.com/?c=GNKIW29193&sbs=1&sc=2&f=web&vernum=1.0&uid=&did=f8d4a70c-98e2-4081-901d-01bf93043ede&q=

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2009-12-19 20:37

Windows 6.0.6002 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:00000000

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'Explorer.exe'(9164)

c:\windows\TEMP\logishrd\LVPrcInj01.dll

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\windows\system32\rundll32.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\system32\WUDFHost.exe

c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe

c:\windows\servicing\TrustedInstaller.exe

c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

c:\program files\Windows Media Player\wmpnetwk.exe

.

**************************************************************************

.

Voltooingstijd: 2009-12-19 20:44:25 - machine werd herstart

ComboFix-quarantined-files.txt 2009-12-19 19:44

ComboFix2.txt 2009-12-19 17:53

Pre-Run: 160.390.119.424 bytes beschikbaar

Post-Run: 160.125.366.272 bytes beschikbaar

Current=1 Default=1 Failed=0 LastKnownGood=51 Sets=1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,

20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,

40,41,42,43,44,45,46,47,48,49,50,51

- - End Of File - - DF1A87CD65DE0BDE89586E608247504F

aangepast door kape
Link naar reactie
Delen op andere sites

dat krijg ik niet meer ,

maar het was wel meer dan dat ,

her en der begon ik meldingen te krijgen dat dat programma niet meer werkte , dan was het windows verkenner dat niet meer werkte etc ,

nu heb ik geen probs , behalve men virusscanner die ik niet meer kan opstarten , tips ?

Link naar reactie
Delen op andere sites

dat krijg ik niet meer ,

maar het was wel meer dan dat , her en der begon ik meldingen te krijgen dat dat programma niet meer werkte , dan was het windows verkenner dat niet meer werkte etc

Er was inderdaad flink meer aan de hand ... een serieuze besmetting zelfs :sad
nu heb ik geen probs , behalve men virusscanner die ik niet meer kan opstarten , tips ?
Die Kaspersky ? Heb je daar een installatie-CD van of is die gedownload ? Mogelijk brengt een verse installatie ervan de oplossing.

Ondertussen mag je ook nog het volgende doen om de resten van de besmetting op te ruimen :

Verwijder Combofix: Start -> Uitvoeren en typ: ComboFix /Uninstall

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Verwijder volgende vetgedrukte map met Windows Verkenner : C:\Qoobox (indien nog aanwezig).

Download CCleaner. Klik op deze pagina op één van de mirrorsites van MajorGeeks en dan start de download van CCleaner automatisch en gratis op.

Installeer het en start CCleaner op. Klik in de linkse kolom op “Cleaner”. Klik achtereenvolgens op ‘Analyseren’ en 'Schoonmaken'. Soms is 1 analyse niet voldoende. Deze procedure mag je herhalen tot de analyse geen fouten meer aangeeft. Klik vervolgens in de linkse kolom op “Register” en klik op ‘Scan naar problemen”. Als er fouten gevonden worden klik je op ”Herstel geselecteerde problemen” en ”OK”. Dan krijg je de vraag om een back-up te maken. Klik op “JA”. Kies dan “Herstel alle geselecteerde fouten”. Sluit hierna CCleaner terug af.

Link naar reactie
Delen op andere sites

heb dat gedaan nu en ik heb toch niet meteen nog meldingen , maar ik ben wel mijn virusscaner zoek geraakt ,

die stond niet op cd , is via het net , maar wel een met licentie natuurlijk , wat moet ik nu doen ?

hij zegt dat er iets van ontbreekt ofzo

Groetjes

mijnevirusscanner.jpg

aangepast door vicky_i
bijlage
Link naar reactie
Delen op andere sites


×
×
  • Nieuwe aanmaken...

Belangrijke informatie

We hebben cookies geplaatst op je toestel om deze website voor jou beter te kunnen maken. Je kunt de cookie instellingen aanpassen, anders gaan we er van uit dat het goed is om verder te gaan.