Ga naar inhoud

[OPGELOST] Ik zoek hulp voor computer herstart virus!

lufraki
 Delen

Aanbevolen berichten

kape Grootmeester

kape

Geplaatst:
Geplaatst:

Volgende stap :-)

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::

c:\windows\system32\TDSSoiqh.dll

C:\found.000

c:\windows\system32\tmpF2EF8.FOT

c:\windows\system32\tmpD7EF8.FOT

c:\windows\system32\tmp7DCF8.FOT

c:\windows\system32\tmp54DF8.FOT

c:\windows\system32\tmp39DF8.FOT

c:\windows\system32\tmp1EDF8.FOT

Folder::

C:\NormanVundoBackup

Driver::

tdssserv.sys

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht

Download CCleaner.

Installeer het en start CCleaner op. Klik in de linkse kolom op “Cleaner”. Klik achtereenvolgens op ‘Analyseren’ en 'Opschonen'. Klik vervolgens in de linkse kolom op “Register” en klik op ‘Scan naar problemen”. Als er fouten gevonden worden klik je op ”Herstel geselecteerde problemen” en ”OK”. Dan krijg je de vraag om een back-up te maken. Klik op “JA”. Kies dan “Herstel alle geselecteerde fouten”. Sluit hierna CCleaner terug af.

Start hierna de computer opnieuw op en kijk eens wat Norman nu te vertellen heeft ?

En kan je mij misschien vertellen of je deze vetgedrukte mappen kent en zo ja, wat ze precies inhouden of uitvoeren ?

C:\windows\system32\m3V02

c:\windows\system32\LNR

lufraki Enthousiasteling

lufraki

Geplaatst:
  • Auteur
Geplaatst:

Hallo kape, Norman was deze keer rustig en er gebeurde niets,

hier is het ComboFix logje:

ComboFix 09-01-11.04 - Eigenaar 2009-01-13 15:49:53.3 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.511.164 [GMT 1:00]

Gestart vanuit: c:\documents and settings\Eigenaar\Bureaublad\Norman\ComboFix.exe

gebruikte Opdracht switches :: c:\documents and settings\Eigenaar\Bureaublad\CFScript.txt

AV: Norman Virus Control ver. 5.99 *On-access scanning enabled* (Updated)

AV: PC Tools AntiVirus 5.0.1.1 *On-access scanning enabled* (Updated)

* Nieuw herstelpunt werd aangemaakt

* Resident AV is active

FILE ::

C:\found.000

c:\windows\system32\TDSSoiqh.dll

c:\windows\system32\tmp1EDF8.FOT

c:\windows\system32\tmp39DF8.FOT

c:\windows\system32\tmp54DF8.FOT

c:\windows\system32\tmp7DCF8.FOT

c:\windows\system32\tmpD7EF8.FOT

c:\windows\system32\tmpF2EF8.FOT

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\NormanVundoBackup

c:\windows\system32\TDSSoiqh.dll

c:\windows\system32\tmp1EDF8.FOT

c:\windows\system32\tmp39DF8.FOT

c:\windows\system32\tmp54DF8.FOT

c:\windows\system32\tmp7DCF8.FOT

c:\windows\system32\tmpD7EF8.FOT

c:\windows\system32\tmpF2EF8.FOT

.

(((((((((((((((((((( Bestanden Gemaakt van 2008-12-13 to 2009-01-13 ))))))))))))))))))))))))))))))

.

2009-01-13 15:17 . 2009-01-13 15:22 <DIR> d-------- c:\documents and settings\Eigenaar\.housecall6.6

2009-01-13 14:05 . 2009-01-13 14:05 <DIR> d--hs---- C:\found.000

2009-01-13 07:58 . 2009-01-13 07:58 544 --a------ c:\windows\system32\MRT.INI

2009-01-13 07:52 . 2009-01-13 07:59 1,374 --a------ c:\windows\imsins.BAK

2009-01-12 18:15 . 2008-08-14 14:27 2,193,536 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe

2009-01-12 18:15 . 2008-08-14 14:27 2,149,888 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe

2009-01-12 18:15 . 2008-08-14 14:27 2,070,400 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe

2009-01-12 18:15 . 2008-08-14 14:27 2,028,544 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe

2009-01-12 17:56 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuapi.dll.mui

2009-01-12 16:59 . 2009-01-12 16:59 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-01-12 16:59 . 2009-01-12 16:59 <DIR> d-------- c:\documents and settings\Eigenaar\Application Data\Malwarebytes

2009-01-12 16:59 . 2009-01-12 16:59 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-01-12 16:59 . 2009-01-04 18:38 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-01-12 16:59 . 2009-01-04 18:38 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-01-12 16:36 . 2009-01-12 16:36 <DIR> d-------- c:\program files\Common Files\PC Tools

2009-01-12 16:36 . 2009-01-12 16:36 <DIR> d-------- c:\documents and settings\Eigenaar\Application Data\PC Tools

2009-01-12 16:35 . 2009-01-12 16:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\PC Tools

2009-01-12 16:14 . 2009-01-12 16:14 <DIR> d-------- c:\program files\Trend Micro

2009-01-12 10:59 . 2009-01-12 10:59 4,128 --a------ C:\INFCACHE.1

2009-01-11 19:36 . 2009-01-12 10:42 4,206 --a------ C:\WINSYS.DLL

2009-01-11 10:48 . 2004-03-09 09:30 662,288 --a------ c:\windows\system32\MSCOMCT2.OCX

2009-01-11 10:48 . 2000-05-22 10:30 608,448 --a------ c:\windows\system32\COMCTL32.OCX

2009-01-11 10:48 . 1998-06-24 00:00 164,144 --a------ c:\windows\system32\COMCT232.OCX

2009-01-11 10:48 . 2000-05-22 15:58 83,144 --a------ c:\windows\system32\PICCLP32.OCX

2009-01-11 10:37 . 2009-01-11 10:37 <DIR> d-------- c:\program files\Recuva

2009-01-11 10:36 . 2009-01-13 15:47 <DIR> dr-h----- c:\documents and settings\Eigenaar\Onlangs geopend

2009-01-11 10:24 . 2009-01-11 10:24 176 --a------ c:\windows\wininit.ini

2009-01-10 19:35 . 2009-01-10 19:35 214 --a------ c:\windows\HP_48BitScanUpdatePatch.ini

2009-01-10 19:34 . 2009-01-10 19:34 <DIR> d-------- c:\documents and settings\All Users\Application Data\HP Product Assistant

2009-01-10 19:28 . 2009-01-10 19:28 234 --a------ c:\windows\PrnHlpLogConfig.ini

2009-01-10 19:27 . 2009-01-10 19:27 217 --a------ c:\windows\HP_IZClosingDiscErrorPatch.ini

2009-01-10 19:27 . 2009-01-10 19:27 214 --a------ c:\windows\HP_InstantSHareJPG.ini

2009-01-10 19:25 . 2009-01-10 19:25 221 --a------ c:\windows\HP_RedboxHprblog_HPSU.ini

2009-01-10 18:33 . 2009-01-10 18:33 <DIR> d-------- c:\documents and settings\Gaming Account\Application Data\Netscape

2009-01-10 16:51 . 2009-01-12 17:09 <DIR> d-------- c:\documents and settings\Gaming Account\Application Data\Twain

2009-01-10 16:39 . 2009-01-11 09:14 <DIR> d-------- c:\documents and settings\Gaming Account\Application Data\cogad

2009-01-10 15:35 . 2009-01-10 15:35 <DIR> d-------- c:\documents and settings\Eigenaar\Application Data\cogad

2009-01-10 14:07 . 2009-01-10 14:07 <DIR> d-------- c:\program files\Netscape

2009-01-10 14:07 . 2009-01-10 14:07 <DIR> d-------- c:\documents and settings\Eigenaar\Application Data\Netscape

2009-01-10 13:21 . 2009-01-10 13:21 <DIR> d-------- c:\documents and settings\Eigenaar\Application Data\Thunderbird

2009-01-10 09:11 . 2009-01-10 09:11 <DIR> d-------- c:\documents and settings\Eigenaar\Application Data\SecondLife

2009-01-09 17:41 . 2009-01-11 10:24 <DIR> d-------- c:\program files\Mozilla Thunderbird

2009-01-09 17:41 . 2009-01-09 17:41 <DIR> d-------- c:\documents and settings\School - Werk\Application Data\Thunderbird

2009-01-09 17:41 . 2009-01-09 17:41 <DIR> d-------- c:\documents and settings\School - Werk\Application Data\Talkback

2009-01-09 17:41 . 2009-01-09 17:41 3,473 --a------ c:\windows\mozver.dat

2009-01-09 17:41 . 2009-01-09 17:41 0 --a------ c:\windows\nsreg.dat

2009-01-09 17:38 . 2009-01-09 18:28 <DIR> d-------- c:\program files\Spybot - Search & Destroy

2009-01-09 17:38 . 2009-01-09 18:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-01-09 17:01 . 2009-01-09 17:01 <DIR> d-------- c:\program files\Common Files\AVSMedia

2009-01-09 17:01 . 2009-01-09 17:03 <DIR> d-------- c:\program files\AVSMedia

2009-01-09 17:01 . 2003-05-22 13:26 638,976 --a------ c:\windows\system32\divx.dll

2009-01-09 17:01 . 2004-07-03 21:59 524,288 --a------ c:\windows\system32\xvidcore.dll

2009-01-09 17:01 . 2003-05-22 00:50 261,632 --a------ c:\windows\system32\mcdvd_32.dll

2009-01-09 17:01 . 2003-05-22 13:26 221,215 --a------ c:\windows\system32\divxdec.ax

2009-01-09 17:01 . 2003-05-22 00:50 156,910 --a------ c:\windows\WMSysPr8.prx

2009-01-09 17:01 . 2004-07-03 22:08 139,264 --a------ c:\windows\system32\xvidvfw.dll

2009-01-09 17:01 . 2003-05-22 00:50 82,944 --a------ c:\windows\system32\vct3216.acm

2009-01-09 17:01 . 2004-02-04 22:11 81,920 --a------ c:\windows\system32\AC3ACM.acm

2009-01-09 17:01 . 2004-09-06 17:06 53,248 --a------ c:\windows\system32\xvid.ax

2009-01-09 17:01 . 2003-05-22 00:50 38,912 --a------ c:\windows\system32\alf2cd.acm

2009-01-09 17:01 . 2000-03-14 21:55 13,239 --a------ c:\windows\system32\Scg726.acm

2009-01-08 17:06 . 2009-01-08 17:06 <DIR> d-------- c:\program files\software

2009-01-08 16:58 . 2009-01-08 16:58 <DIR> dr-h----- c:\documents and settings\Gaming Account\Onlangs geopend

2009-01-07 17:57 . 2009-01-07 17:57 65,536 --a------ c:\windows\IFinst27.exe

2009-01-06 17:18 . 2009-01-09 19:17 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Enigma Browser

2009-01-06 17:17 . 2008-08-09 15:05 <DIR> d--h----- c:\documents and settings\Administrator\Sjablonen

2009-01-06 17:17 . 2008-08-09 16:54 <DIR> d--h----- c:\documents and settings\Administrator\Onlangs geopend

2009-01-06 17:17 . 2008-08-09 16:54 <DIR> d--h----- c:\documents and settings\Administrator\Netwerkprinteromgeving

2009-01-06 17:17 . 2009-01-10 18:48 <DIR> d-------- c:\documents and settings\Administrator\Mijn documenten

2009-01-06 17:17 . 2008-08-09 16:54 <DIR> dr------- c:\documents and settings\Administrator\Menu Start

2009-01-06 17:17 . 2008-08-09 16:54 <DIR> d-------- c:\documents and settings\Administrator\Favorieten

2009-01-06 17:17 . 2008-08-09 16:54 <DIR> d-------- c:\documents and settings\Administrator\Bureaublad

2009-01-06 17:17 . 2009-01-06 17:17 <DIR> d-------- c:\documents and settings\Administrator

2009-01-06 17:17 . 2009-01-06 17:18 373,760 --ahs---- c:\windows\system32\38.tmp

2009-01-06 17:10 . 2009-01-06 17:10 59,904 --------- c:\windows\system32\drivers\TDSSmqlt.sys

2009-01-05 16:36 . 2009-01-10 19:49 <DIR> d-------- c:\windows\system32\whSLD02

2009-01-04 10:01 . 2003-07-24 10:24 237,568 --a------ c:\windows\system32\demoover.exe

2009-01-04 10:01 . 2004-05-29 17:52 91,072 --------- c:\windows\system32\RoseCo2.dll

2009-01-04 10:01 . 2004-05-29 17:53 82,896 --------- c:\windows\system32\KickCom2.dll

2009-01-04 10:00 . 2009-01-04 10:44 <DIR> d-------- C:\moove

2009-01-04 10:00 . 2001-10-12 15:44 3,310 --------- c:\windows\system32\advanced.ico

2009-01-04 10:00 . 1998-04-24 00:00 1,078 --------- c:\windows\system32\rosewaste.ico

2009-01-03 11:11 . 2009-01-02 21:56 8,094 --a------ c:\windows\NPFFILE.NDF_B

2009-01-02 11:41 . 2009-01-02 11:41 147,456 --a------ c:\windows\system32\vbzip10.dll

2009-01-02 11:37 . 2009-01-02 11:38 <DIR> d-------- c:\windows\system32\R

2009-01-01 20:38 . 2009-01-01 20:38 <DIR> d-------- c:\documents and settings\School - Werk\Application Data\Ahead

2009-01-01 20:32 . 2009-01-01 20:33 <DIR> d-------- c:\documents and settings\School - Werk\Shared

2009-01-01 20:32 . 2009-01-01 20:33 <DIR> d-------- c:\documents and settings\School - Werk\Incomplete

2009-01-01 20:32 . 2009-01-01 20:32 <DIR> d-------- c:\documents and settings\School - Werk\Application Data\Morpheus PRO

2009-01-01 20:17 . 2009-01-09 17:42 <DIR> d-------- c:\documents and settings\School - Werk\Application Data\LimeWire

2009-01-01 10:43 . 2008-06-28 00:43 430,080 --a------ c:\windows\system32\cmcs21.ocx

2009-01-01 10:43 . 2008-06-28 00:43 224,016 --a------ c:\windows\system32\tabctl32.ocx

2009-01-01 10:43 . 2008-06-28 00:43 212,240 --a------ c:\windows\system32\richtx32.ocx

2009-01-01 10:43 . 2008-06-28 00:43 109,248 --a------ c:\windows\system32\mswinsck.ocx

2009-01-01 10:43 . 2008-06-28 00:43 103,744 --a------ c:\windows\system32\mscomm32.ocx

2009-01-01 10:43 . 2008-06-28 00:43 53,248 --a------ c:\windows\system32\zlib.dll

2008-12-31 14:00 . 2008-12-31 14:00 <DIR> d-------- c:\program files\Burn4Free

2008-12-31 13:53 . 2008-12-31 13:53 <DIR> d-------- c:\program files\DVD Decrypter

2008-12-30 14:36 . 2008-12-30 14:36 0 --------- c:\windows\WB.ini

2008-12-30 11:12 . 2008-04-26 16:14 42,672 --------- c:\windows\system32\wbsys.dll

2008-12-30 10:52 . 2009-01-07 08:04 <DIR> d-------- c:\program files\Common Files\stardock

2008-12-30 09:45 . 2008-12-30 10:16 <DIR> d-------- c:\documents and settings\Gaming Account\Downloads

2008-12-30 09:45 . 2008-12-30 09:45 <DIR> d-------- c:\documents and settings\Gaming Account\Application Data\NewsLeecher

2008-12-27 13:45 . 2008-12-27 13:45 <DIR> d-------- c:\program files\Norman

2008-12-27 13:45 . 2009-01-03 11:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\NPF

2008-12-27 11:16 . 2008-12-27 11:16 <DIR> d-------- c:\documents and settings\LocalService\Menu Start

2008-12-27 11:14 . 2008-09-02 12:48 19,512 --a------ c:\windows\system32\drivers\nvcw32mf.sys

2008-12-27 11:08 . 2009-01-13 14:15 <DIR> d-------- C:\Norman

2008-12-22 10:33 . 2009-01-05 18:42 26,056 --a------ c:\windows\system32\drivers\hamachi.sys

2008-12-22 10:28 . 2008-12-22 10:28 <DIR> d-------- c:\program files\MoparScape

2008-12-22 10:25 . 2008-12-22 10:27 <DIR> d-------- c:\windows\.mpr_file_store_32

2008-12-21 12:12 . 2008-12-21 12:12 230 --a------ c:\windows\system32\spupdsvc.inf

2008-12-18 17:23 . 2008-12-18 17:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\Blizzard

2008-12-14 13:34 . 2008-12-14 13:34 <DIR> d-------- c:\program files\QuickTime

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-13 14:40 --------- d-----w c:\documents and settings\Eigenaar\Application Data\Enigma Browser

2009-01-13 14:26 --------- d-----w c:\program files\Hitman Pro

2009-01-13 13:49 --------- d-----w c:\documents and settings\Eigenaar\Application Data\OpenOffice.org2

2009-01-13 13:39 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP

2009-01-13 13:23 17,408 ----a-w c:\windows\system32\drivers\USBCRFT.SYS

2009-01-13 13:23 --------- d-----w c:\program files\PC Tools Antivirus

2009-01-13 06:47 14,336 ----a-w c:\windows\system32\svchost.exe

2009-01-12 18:42 --------- d-----w c:\program files\Enigma Browser

2009-01-12 17:38 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help

2009-01-11 08:19 --------- d-----w c:\documents and settings\Gaming Account\Application Data\Enigma Browser

2009-01-10 18:38 --------- d-----w c:\program files\HP

2009-01-10 13:30 --------- d-----w c:\program files\Microsoft Visual Studio 9.0

2009-01-10 08:39 --------- d-----w c:\program files\NCSoft

2009-01-09 17:28 --------- d-----w c:\program files\ESET

2009-01-09 17:19 --------- d-----w c:\documents and settings\School - Werk\Application Data\Enigma Browser

2009-01-07 16:52 --------- d-----w c:\program files\Common Files\Adobe

2009-01-07 16:48 --------- d-----w c:\program files\Microsoft Games

2009-01-04 09:00 --------- d--h--w c:\program files\InstallShield Installation Information

2009-01-02 10:50 717,296 ----a-w c:\windows\system32\drivers\sptd.sys

2008-12-27 12:53 --------- d-----w c:\program files\CCleaner

2008-12-22 09:04 --------- d-----w c:\program files\World of Warcraft

2008-12-18 16:13 --------- d-----w c:\program files\Common Files\Blizzard Entertainment

2008-12-16 16:25 --------- d-----w c:\program files\GameSpy Arcade

2008-12-12 14:24 --------- d-----w c:\program files\Eidos

2008-12-11 15:10 --------- d-----w c:\program files\Sierra

2008-12-07 11:49 --------- d-----w c:\program files\AVIConverter

2008-12-03 07:20 --------- d-----w c:\documents and settings\School - Werk\Application Data\Lavasoft

2008-11-30 07:25 --------- d-----w c:\documents and settings\Eigenaar\Application Data\GetRightToGo

2008-11-29 17:18 --------- d-----w c:\documents and settings\School - Werk\Application Data\Xfire

2008-11-29 17:17 --------- d-----w c:\program files\CyberLink

2008-11-29 17:17 --------- d-----w c:\documents and settings\LocalService\Application Data\Xfire

2008-11-29 17:17 --------- d-----w c:\documents and settings\Gaming Account\Application Data\Xfire

2008-11-29 17:16 --------- d-----w c:\program files\Windows Live

2008-11-29 17:15 --------- d-----w c:\program files\Adobe(2)

2008-11-29 17:12 --------- d-----w c:\program files\Microsoft Works

2008-11-29 14:01 --------- d-----w c:\documents and settings\Bente\Application Data\Webroot

2008-11-25 14:28 223,128 ----a-w c:\windows\system32\drivers\vaxscsi.sys

2008-11-25 14:28 --------- d-----w c:\program files\Alcohol Soft

2008-11-25 14:24 96,384 ----a-w c:\windows\system32\drivers\sptd3117.sys

2008-11-24 15:53 --------- d-----w c:\documents and settings\Gaming Account\Application Data\Gearbox Software

2008-11-23 08:37 --------- d-----w c:\program files\The Creative Assembly

2008-11-10 17:24 107,888 ----a-w c:\windows\system32\CmdLineExt.dll

2008-10-23 12:43 286,720 ----a-w c:\windows\system32\gdi32.dll

2008-10-22 15:34 66,872 ----a-w c:\windows\system32\PnkBstrA.exe

2008-10-22 15:34 182,928 ----a-w c:\windows\system32\PnkBstrB.exe

2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll

2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll

2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll

2008-10-16 13:12 202,776 ----a-w c:\windows\system32\wuweb.dll

2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll

2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe

2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll

2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll

2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll

2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll

2008-10-16 01:02 669,184 ----a-w c:\windows\system32\wininet.dll

2008-08-13 07:11 24 ----a-w c:\documents and settings\Eigenaar\jagex_runescape_preferences.dat

2008-09-15 13:05 56 --sh--r c:\windows\system32\60AF2ED151.sys

2008-10-07 15:44 1,890 --sha-w c:\windows\system32\KGyGaAvL.sys

.

((((((((((((((((((((((((((((( snapshot@2009-01-13_ 8.49.05.96 )))))))))))))))))))))))))))))))))))))))))

.

+ 2008-12-24 14:38:24 386,048 ----a-w c:\windows\Downloaded Program Files\Housecall_ActiveX.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PlayNC Launcher"="c:\program files\NCSoft\Launcher\NCLauncher.exe" [2008-06-09 38128]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-12-14 413696]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

"norman zanda"="c:\norman\Npm\bin\ZLH.EXE" [2008-06-02 273520]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"Hitman Pro Expiration Helper"="c:\program files\Hitman Pro\xphelper.exe" [2007-01-30 596760]

"PCTAVApp"="c:\program files\PC Tools AntiVirus\PCTAV.exe" [2008-12-04 1370000]

"nwiz"="nwiz.exe" [2006-10-22 c:\windows\system32\nwiz.exe]

"Dit"="Dit.exe" [2004-07-20 c:\windows\Dit.exe]

"Cmaudio"="cmicnfg.cpl" [bU]

"AGRSMMSG"="AGRSMMSG.exe" [2005-03-08 c:\windows\AGRSMMSG.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\Eigenaar\Menu Start\Programma's\Opstarten\

OpenOffice.org 2.4 .lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]

Ralink Wireless Utility.lnk - c:\program files\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500.exe [2008-08-09 638976]

Snelstart HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-11 73728]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\World of Warcraft\\WoW-2.4.2-enGB-downloader.exe"=

"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=

"c:\\Program Files\\Ubisoft\\Gearbox Software\\BrothersInArmsEiB\\System\\EiB.exe"=

"c:\\Program Files\\Sierra\\FEARCombat\\fpupdate.exe"=

"c:\\Program Files\\Sierra\\FEARCombat\\FEARServer.exe"=

"c:\\Program Files\\Sierra\\FEAR\\fpupdate.exe"=

"c:\\Program Files\\Sierra\\FEAR\\FEARServer.exe"=

"c:\\Program Files\\Sierra\\FEARCombat\\FEARMP.exe"=

"c:\\Program Files\\Sierra\\FEAR\\FEARXP\\FEARXP.exe"=

"c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=

"c:\\Program Files\\Sierra\\FEAR\\FEARMP.exe"=

"c:\\Program Files\\Java\\jre1.6.0_07\\bin\\javaw.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"6112:TCP"= 6112:TCP:Wow downloader

"6881:TCP"= 6881:TCP:Wow

"6999:TCP"= 6999:TCP:download wow

"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

"24800:TCP"= 24800:TCP:*:Disabled:SolidNetworkManager

"24800:UDP"= 24800:UDP:*:Disabled:SolidNetworkManager

"61655:TCP"= 61655:TCP:*:Disabled:SolidNetworkManager

"61655:UDP"= 61655:UDP:*:Disabled:SolidNetworkManager

R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [2008-05-07 1287296]

R3 nsesvc;Norman Scanner Engine Service;c:\norman\Nse\Bin\Nsesvc.exe [2008-12-27 322616]

R3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [2008-12-27 19512]

R3 nvcoas;Norman Virus Control on-access component;c:\norman\NVC\Bin\Nvcoas.exe [2008-12-27 183352]

R3 NVCScheduler;Norman Virus Control Scheduler;c:\norman\NVC\Bin\Nvcsched.exe [2008-12-27 146488]

R3 wbscr;Winbond Smartcard Reader for I/O;c:\windows\system32\drivers\wbscr.sys [2008-08-09 19928]

R4 Ndiskio;Ndiskio;c:\norman\Nse\Bin\Ndiskio.sys [2008-12-27 20448]

S0 gsbidin;gsbidin;c:\windows\system32\drivers\ttcek.sys --> c:\windows\system32\drivers\ttcek.sys [?]

S0 rseb;rseb; [x]

S1 34884e3f;34884e3f;c:\windows\system32\drivers\34884e3f.sys --> c:\windows\system32\drivers\34884e3f.sys [?]

S1 839e9b08;839e9b08;c:\windows\system32\drivers\839e9b08.sys --> c:\windows\system32\drivers\839e9b08.sys [?]

S1 a68ba1c9;a68ba1c9;c:\windows\system32\drivers\a68ba1c9.sys --> c:\windows\system32\drivers\a68ba1c9.sys [?]

S3 CardReaderFilter;Card Reader Filter;c:\windows\system32\drivers\USBCRFT.SYS [2008-08-09 17408]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-01-12 38496]

--- Andere Services/Drivers In Geheugen ---

*Deregistered* - mchInjDrv

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae1a1cf8-e08f-11dd-8d02-00110951a57e}]

\shell\autorun\command - M:\PPTVIEW.EXE /L "playlist.txt"

\shell\startwdh\command - M:\PPTVIEW.EXE /L "playlist.txt"

.

Inhoud van de 'Gedeelde Taken' map

2009-01-12 c:\windows\Tasks\HPpromotions journeysoftware.job

- c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 16:36]

.

.

------- Bijkomende Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-13 15:55:15

Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_USERS\S-1-5-21-839522115-920026266-1417001333-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:81,57,4d,21,a6,76,47,ee,8a,6c,cb,1a,e9,e6,89,e1,10,ff,98,66,c0,e0,ec,

db,e2,07,d2,cb,11,84,b4,47,11,5d,8d,ca,2a,23,bd,4b,83,ff,de,dd,0a,6d,ae,eb,\

"??"=hex:7f,2a,d1,18,fd,cd,d1,9e,1a,a9,e5,a4,81,4a,bd,2b

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'winlogon.exe'(680)

c:\program files\PC Tools AntiVirus\PCTAVHook.dll

- - - - - - - > 'lsass.exe'(736)

c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll

c:\program files\PC Tools AntiVirus\PCTAVHook.dll

- - - - - - - > 'explorer.exe'(3664)

c:\program files\PC Tools AntiVirus\PCTAVHook.dll

c:\norman\nvc\bin\Niphk.dll

- - - - - - - > 'csrss.exe'(656)

c:\program files\PC Tools AntiVirus\PCTAVHook.dll

.

Voltooingstijd: 2009-01-13 15:59:01

ComboFix-quarantined-files.txt 2009-01-13 14:58:55

ComboFix2.txt 2009-01-13 13:51:54

Pre-Run: 42.804.346.880 bytes beschikbaar

Post-Run: 42,956,304,384 bytes beschikbaar

Current=1 Default=1 Failed=4 LastKnownGood=5 Sets=1,2,3,4,5

346 --- E O F --- 2009-01-13 06:59:38

lufraki Enthousiasteling

lufraki

Geplaatst:
  • Auteur
Geplaatst:

Die bestandjes waren leeg, 0 kb gewoon dus die heb ik verwijderd. De PC werkt weer goed en hier is dat logje:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:01:53, on 13-1-2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Norman\Npm\bin\ELOGSVC.EXE

C:\Norman\Npm\Bin\Zanda.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\SCardSvr.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

C:\Norman\Npm\bin\NJEEVES.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\alg.exe

C:\Norman\nse\bin\NSESVC.EXE

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Norman\Nvc\BIN\NVCSCHED.EXE

C:\Norman\Npm\bin\ZLH.EXE

C:\Norman\Nvc\bin\nvcoas.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\Dit.exe

C:\WINDOWS\system32\RunDll32.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Norman\Nvc\BIN\NIP.EXE

C:\Program Files\NCSoft\Launcher\NCLauncher.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Norman\Nvc\bin\cclaw.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500.exe

C:\Program Files\OpenOffice.org 2.4\program\soffice.exe

C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN

C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Norman\Nvc\BIN\nvcod.exe

C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

C:\Program Files\Enigma Browser\Enigma.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [norman zanda] "C:\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [Hitman Pro Expiration Helper] "C:\Program Files\Hitman Pro\xphelper.exe"

O4 - HKLM\..\Run: [Dit] Dit.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKCU\..\Run: [PlayNC Launcher] C:\Program Files\NCSoft\Launcher\NCLauncher.exe /Minimized

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: OpenOffice.org 2.4 .lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500.exe

O4 - Global Startup: Snelstart HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1231779294921

O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Norman\Npm\bin\ELOGSVC.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Norman NJeeves - Norman ASA - C:\Norman\Npm\bin\NJEEVES.EXE

O23 - Service: Norman ZANDA - Norman ASA - C:\Norman\Npm\Bin\Zanda.exe

O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Norman\nse\bin\NSESVC.EXE

O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe

O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Norman\Nvc\BIN\NVCSCHED.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)

O23 - Service: Pml Driver HPZ12 (pml driver hpz12) - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe

O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Unknown owner - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe (file missing)

--

End of file - 6476 bytes

Ik denk dat het nu klaar is?

kape Grootmeester

kape

Geplaatst:
Geplaatst:

Problemen van de baan, dan is het tijd voor de “grote schoonmaak” : verwijderen van gebruikte programma’s, een cleaning en het verwijderen van de besmette herstelpunten. En je JAVA kan een update gebruiken.

Verwijder Combofix: Start -> Uitvoeren en typ: combofix /u

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Download CCleaner.

Installeer het en start CCleaner op. Klik in de linkse kolom op “Cleaner”. Klik achtereenvolgens op ‘Analyseren’ en 'Opschonen'. Klik vervolgens in de linkse kolom op “Register” en klik op ‘Scan naar problemen”. Als er fouten gevonden worden klik je op ”Herstel geselecteerde problemen” en ”OK”. Dan krijg je de vraag om een back-up te maken. Klik op “JA”. Kies dan “Herstel alle geselecteerde fouten”. Sluit hierna CCleaner terug af.

Het is aangewezen om de bestaande herstelpunten te verwijderen (daar zitten besmette herstelpunten tussen die je eventueel zou kunnen terugzetten) door systeemherstel tijdelijk uit te schakelen. Doe dit via Start -> Configuratiescherm -> Systeem -> Systeemherstel -> "Systeemherstel op alle stations uitschakelen" aanvinken. Toepassen en OK. PC herstarten en het vinkje terug weg halen.

Je Java software is verouderd.

Oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem.

Download Java Runtime Environment (JRE) 6u11 naar je Bureaublad

Sluit alle programma's die eventueel open zijn - Zeker je web browser!

  • Ga dan naar Start> Configuratiescherm> Softwareen verwijder alle oudere versies van Java uit de Softwarelijst.
  • Vink alles aan met Java Runtime Environment (JRE of J2SE) in de naam.
  • Klik dan op Verwijderenof op de Wijzig/Verwijderknop.
  • Herhaal dit tot alle oudere versies verdwenen zijn.
  • Na het verwijderen van alle oudere versies, herstart je pc.
  • Dubbelklik vervolgens op jre-6u11-windows-i586-p.s.exeop je Bureaublad om de nieuwste versie van Java te installeren.

That’s it !

kape Grootmeester

kape

Geplaatst:
Geplaatst:
Het is gelukt, bedankt maar ehh... Kan deze hele procedure de meeste soorten virussen van de pc afhalen???
Geen garantie ... hangt van de soort besmetting af hoe deze behandeld moet worden.
Gast
Dit topic is nu gesloten voor nieuwe reacties.
 Delen
Ga naar topic overzicht
Logo

OVER ONS

PC Helpforum helpt GRATIS computergebruikers sinds juli 2006. Ons team geeft via het forum professioneel antwoord op uw vragen en probeert uw pc problemen zo snel mogelijk op te lossen. Word lid vandaag, plaats je vraag online en het PC Helpforum-team helpt u graag verder!

SITEMAP

×
×
  • Nieuwe aanmaken...

Belangrijke informatie

We hebben cookies geplaatst op je toestel om deze website voor jou beter te kunnen maken. Je kunt de cookie instellingen aanpassen, anders gaan we er van uit dat het goed is om verder te gaan.