pc is erg traag

Diana1965 · 10 mei 2011

nog een vraag,

is het normaal als ik iets met Speccy heb gedaan de pc de melding geeft dat Speccy.exe niet kan beeindigen en vervolgens de pc vast loopt?

Dit heb ik nu al meerdere keren gehad.

gr.diana

clarkie · 10 mei 2011

nog een vraag,
is het normaal als ik iets met Speccy heb gedaan de pc de melding geeft dat Speccy.exe niet kan beeindigen en vervolgens de pc vast loopt?

Dit heb ik nu al meerdere keren gehad.

gr.diana

Dat is niet normaal.

Misschien voor alle zekerheid toch nog eens een logje met hijackthis maken om zeker te zijn dat malware niet de oorzaak is.

Heb je het programma nog op je PC?

Als je niet meer weet hoe het moet , laat het dan maar weten.

Diana1965 · 10 mei 2011

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 21:02:31, on 10-5-2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\AVAST Software\Avast\afwServ.exe

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\System32\PAStiSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\AVAST Software\Avast\avastUI.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\WINDOWS\system32\ctfmon.exe

C:\HP\KBD\KBD.EXE

c:\windows\system\hpsysdrv.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Yahoo! Zoeken - zoeken op het web

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Startpagina.nl - Alles op een rijtje! (ook op mobiel)

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Yahoo! Zoeken - zoeken op het web

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/go/mypcchoice

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - S-1-5-18 Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'SYSTEM')

O4 - S-1-5-18 Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')

O4 - .DEFAULT Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')

O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')

O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')

O4 - Global Startup: ReSchedHPSU.lnk = C:\hp\bin\CLOAKER.EXE

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra 'Tools' menuitem: Verbindingshelp - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/nl/uno1/GAME_UNO1.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\AVAST Software\Avast\afwServ.exe

O23 - Service: Intel® Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--

End of file - 9092 bytes

hier is mijn hijackthis logje

gr.Diana

10 mei 2011 aangepast door kape
dubbel log verwijderd

clarkie · 10 mei 2011

Ik zal een expert vragen je logje na te kijken.

Wacht tot je geholpen wordt.

Diana1965 · 10 mei 2011

oke, alvast bedankt.x

kape · 10 mei 2011

Malware mag je in dit logje uitsluiten !

Even verder kijken :

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:

Klik hier

Als het je niet lukt om ze uit te schakelen, ga dan gewoon door naar de volgende stap.

2. Dubbelklik op ComboFix.exe en volg de meldingen op het scherm.

3. ComboFix zal controleren of dat de Microsoft Windows Recovery Console reeds is geïnstalleerd.

**Let op: Als de Microsoft Windows Recovery Console al is geïnstalleerd, dan krijg je de volgende schermen niet te zien en zal ComboFix automatisch verder gaan met het scannen naar malware.

4. Volg de meldingen op het scherm om ComboFix de Microsoft Windows Recovery Console te laten downloaden en installeren.

Je krijgt de volgende melding te zien wanneer ComboFix de Microsoft Windows Recovery Console succesvol heeft geïnstalleerd:

Klik op Ja om verder te gaan met het scannen naar malware.

5. Wanneer ComboFix klaar is, zal het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

kweezie wabbit · 11 mei 2011

nog een vraag,
is het normaal als ik iets met Speccy heb gedaan de pc de melding geeft dat Speccy.exe niet kan beeindigen en vervolgens de pc vast loopt?

Dit heb ik nu al meerdere keren gehad.

gr.diana

Speccy eens verwijderen, het register opruimen met CCleaner en Speccy opnieuw installeren

Diana1965 · 11 mei 2011

ComboFix 11-05-10.01 - HP_Administrator 11-05-2011 10:59:52.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.1022.541 [GMT 2:00]

Gestart vanuit: c:\documents and settings\HP_Administrator\Mijn documenten\ComboFix.exe

AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-04-11 to 2011-05-11 ))))))))))))))))))))))))))))))

.

2011-05-11 08:33 . 2011-05-11 08:33 -------- d--h--r- c:\documents and settings\HP_Administrator\Onlangs geopend

2011-05-08 13:34 . 2011-04-18 17:18 102232 ----a-w- c:\windows\system32\drivers\aswFW.sys

2011-05-08 13:34 . 2011-04-18 17:17 192984 ----a-w- c:\windows\system32\drivers\aswNdis2.sys

2011-05-08 13:34 . 2011-04-18 16:49 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys

2011-05-01 09:20 . 2011-04-18 17:17 307288 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-05-01 09:20 . 2011-04-18 17:12 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2011-05-01 09:20 . 2011-04-18 17:16 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-05-01 09:20 . 2011-04-18 17:13 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-05-01 09:20 . 2011-04-18 17:17 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-05-01 09:20 . 2011-04-18 17:16 102488 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2011-05-01 09:20 . 2011-04-18 17:16 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys

2011-05-01 09:20 . 2011-04-18 17:13 30680 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2011-05-01 09:20 . 2011-04-18 17:25 40112 ----a-w- c:\windows\avastSS.scr

2011-05-01 09:20 . 2011-04-18 17:25 199304 ----a-w- c:\windows\system32\aswBoot.exe

2011-05-01 09:20 . 2011-05-01 09:20 -------- d-----w- c:\program files\AVAST Software

2011-05-01 09:20 . 2011-05-01 09:20 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software

2011-04-28 18:32 . 2011-04-28 18:32 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google

2011-04-28 18:27 . 2011-04-28 18:27 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Temp

2011-04-28 18:27 . 2011-04-28 18:27 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Google

2011-04-19 07:49 . 2011-04-19 07:49 388096 ----a-r- c:\documents and settings\HP_Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-04-18 08:59 . 2011-04-18 08:59 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit

2011-04-18 08:59 . 2011-04-18 08:59 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\DVDVideoSoftTB

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-07 05:33 . 2004-09-02 04:00 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-03-04 06:36 . 2004-09-02 04:00 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-03-03 13:53 . 2004-09-02 04:00 1858048 ----a-w- c:\windows\system32\win32k.sys

2011-02-22 23:07 . 2004-09-02 04:00 916480 ----a-w- c:\windows\system32\wininet.dll

2011-02-22 23:07 . 2004-09-02 04:00 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-02-22 23:07 . 2004-09-02 04:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-02-22 11:43 . 2004-09-02 04:00 385024 ----a-w- c:\windows\system32\html.iec

2011-02-17 13:18 . 2004-09-02 04:00 455936 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-02-17 13:18 . 2004-09-02 04:00 357888 ----a-w- c:\windows\system32\drivers\srv.sys

2011-02-17 12:54 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll

2011-02-15 12:56 . 2004-09-02 04:00 290432 ----a-w- c:\windows\system32\atmfd.dll

2011-02-11 14:44 . 2006-09-18 10:33 236544 ----a-w- c:\windows\system32\fxscover.exe

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-04-18 17:25 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2006-11-15 16270848]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-02-21 143360]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-20 7622656]

"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 90112]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-13 663552]

"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968]

"nwiz"="nwiz.exe" [2006-06-20 1519616]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-17 64512]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-18 148888]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-04-18 3460784]

.

c:\documents and settings\Default User\Menu Start\Programma's\Opstarten\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-9-18 27136]

PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-9-18 27136]

.

c:\documents and settings\Gast\Menu Start\Programma's\Opstarten\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-9-18 27136]

PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-9-18 27136]

.

c:\documents and settings\Jaco\Menu Start\Programma's\Opstarten\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-9-18 27136]

PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-9-18 27136]

.

c:\documents and settings\Kimberley\Menu Start\Programma's\Opstarten\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-9-18 27136]

PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-9-18 27136]

.

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

ReSchedHPSU.lnk - c:\hp\bin\CLOAKER.EXE [2006-9-18 27136]

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Kodak EasyShare software.lnk]

path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\Kodak EasyShare software.lnk

backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=

"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

"c:\\Program Files\\EA Games\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\LimeWire Plus\\LimeWire.exe"=

.

R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [8-5-2011 15:34 12112]

R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [8-5-2011 15:34 192984]

R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [8-5-2011 15:34 102232]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1-5-2011 11:20 441176]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1-5-2011 11:20 307288]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1-5-2011 11:20 19544]

R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [18-9-2006 12:29 2829696]

R3 WN5301;LIteon Wireless PCI Network Adapter Service;c:\windows\system32\drivers\wn5301.sys [18-9-2006 12:29 468768]

S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [8-5-2011 15:34 121000]

S2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [28-4-2011 20:27 136176]

S3 cpuz135;cpuz135;\??\c:\docume~1\HP_ADM~1\LOCALS~1\Temp\cpuz135\cpuz135_x32.sys --> c:\docume~1\HP_ADM~1\LOCALS~1\Temp\cpuz135\cpuz135_x32.sys [?]

S3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.sys [24-2-2005 12:29 162176]

.

Inhoud van de 'Gedeelde Taken' map

.

2011-05-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-28 18:27]

.

2011-05-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-28 18:27]

.

2007-04-12 c:\windows\Tasks\HubTask 0 {0E7C166E-2D2F-4269-9034-DE1898BF2B1A} 0~0.job

- c:\program files\Common Files\Sonic Shared\Sonic Central\Main\Mediahub.exe [2005-12-19 00:06]

.

2011-05-11 c:\windows\Tasks\User_Feed_Synchronization-{326B0915-341A-4459-B58D-B91933B8218E}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]

.

2011-05-11 c:\windows\Tasks\User_Feed_Synchronization-{9C80AB28-ED18-4B61-B20F-2A180E985BAA}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]

.

2011-05-11 c:\windows\Tasks\User_Feed_Synchronization-{BFD7279D-9644-4660-B138-2256273FA232}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]

.

2011-05-11 c:\windows\Tasks\User_Feed_Synchronization-{C9CFBB39-834F-42FF-848B-12B9DA89AFD6}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]

.

2011-05-11 c:\windows\Tasks\User_Feed_Synchronization-{FDC95A5D-F72F-4AF9-9011-4E40EE94456D}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.startpagina.nl/

uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=NL_NL&c=64&bd=PAVILION&pf=desktop

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=NL_NL&c=64&bd=PAVILION&pf=desktop

uInternet Connection Wizard,ShellNext = hxxp://www.hp.com/go/mypcchoice

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-05-11 11:16

Windows 5.1.2600 Service Pack 3 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–}|ÿÿÿÿÀ•}|ù•9~*]

"3140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

.

- - - - - - - > 'explorer.exe'(4192)

c:\program files\Logitech\MouseWare\System\LgWndHk.dll

c:\windows\system32\nview.dll

c:\windows\system32\NVWRSNL.DLL

c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll

c:\windows\system32\nvwddi.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Voltooingstijd: 2011-05-11 11:22:03

ComboFix-quarantined-files.txt 2011-05-11 09:21

ComboFix2.txt 2011-04-23 17:17

.

Pre-Run: 126.565.838.848 bytes beschikbaar

Post-Run: 126.896.590.848 bytes beschikbaar

.

WindowsXP-KB310994-SP2-Pro-BootDisk-NLD.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

.

- - End Of File - - 96A16A432267F6CB75A34A103F027183

dit is nu mijn combofix logje.

tegen het eind gaf de pc steeds de melding verkenner te moeten afsluiten voor de veiligheid.

ik heb hiervoor (voor ik het logje maakte) eerst Speccy verwijderd en ccleaner laten doen.

gr.Diana

kape · 12 mei 2011

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Folder::

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit

Driver::

cpuz135

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht.

Diana1965 · 13 mei 2011

ComboFix 11-05-12.02 - HP_Administrator 13-05-2011 13:03:31.3.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.31.1043.18.1022.597 [GMT 2:00]

Gestart vanuit: c:\documents and settings\HP_Administrator\Bureaublad\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\HP_Administrator\Bureaublad\CFScript.txt

AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\alertapi.js

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\AppNotification.js

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\close.png

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\like.png

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next.png

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next_hover.png

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\powered-by.png

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev.png

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev_hover.png

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\settings.png

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Thumbs.db

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\initialNotification.html

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\main.html

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\NotificationDialogStyle.css

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\NotificationDialogStyleIE9.css

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\AppNotificationDialog\sampleNotification.html

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\DialogsAPI.js

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\PIE.htc

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\settings.js

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Dialogs\version.txt

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_666138_661999_NL.xml

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_909619_905414_NL.xml

c:\documents and settings\HP_Administrator\Local Settings\Application Data\Conduit\Community Alerts\LanguagePacks\en.xml

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_CPUZ135

-------\Service_cpuz135

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-04-13 to 2011-05-13 ))))))))))))))))))))))))))))))

.

2011-05-11 08:33 . 2011-05-13 10:39 -------- d--h--r- c:\documents and settings\HP_Administrator\Onlangs geopend