Discussie: [OPGELOST] wie kan me even helpen met deze hijackthis logfile?

Start Hijackthis op. Ben je gebruiker van Vista kies dan voor “Run as administrator" of "Uitvoeren als administrator". Selecteer “Do a system scan only”. Selecteer alleen de items die hieronder zijn genoemd:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "C:\Program Files\Common Files\Wise Installation Wizard\WISB83FC356B7C0441F8A4DD71E088E7974_9_09_0428.MSI" TRANSFORMS="C:\Program Files\Common Files\Wise Installation Wizard\WISB83FC356B7C0441F8A4DD71E088E7974_9_09_0428.MST" WISE_SETUP_EXE_PATH="c:\documents and settings\doelly\bureaublad\nvidia\displaydriver\186.18\international\PhysX_9.09. 0428_SystemSoftware.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Klik op 'Fix checked' om de items te verwijderen.

Download MBAM (Malwarebytes' Anti-Malware).

Dubbelklik op mbam-setup.exe om het programma te installeren.

Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Start Malwarebytes' Anti-Malware, Klik daarna op "Voltooien".
Indien een update gevonden werd, zal die gedownload en geïnstalleerd worden.
Wanneer het programma volledig up to date is, selecteer dan in het tabblad Scanner : "Snelle Scan", daarna klik op Scan.
Het scannen kan een tijdje duren, dus wees geduldig.
Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.
Zorg ervoor dat daar alles aangevinkt is, daarna klik op: Verwijder geselecteerde.
Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie verder). De log wordt automatisch bewaard door MBAM en kan je terugvinden door op de "Logs" tab te klikken in MBAM.

Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken. Daarna zal het vragen om de computeropnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.

Plak de inhoud van het logje in je volgende bericht, samen met een nieuw HijackThis log.

Malwarebytes' Anti-Malware 1.38
Database versie: 2329
Windows 5.1.2600 Service Pack 3
24/06/2009 19:20:40
mbam-log-2009-06-24 (19-20-40).txt
Scan type: Snelle Scan
Objecten gescand: 80476
Verstreken tijd: 10 minute(s), 29 second(s)
Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 0
Registerwaarden geïnfecteerd: 0
Registerdata bestanden geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 0
Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige items gevonden)
Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige items gevonden)
Registersleutels geïnfecteerd:
(Geen kwaadaardige items gevonden)
Registerwaarden geïnfecteerd:
(Geen kwaadaardige items gevonden)
Registerdata bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)
Mappen geïnfecteerd:
(Geen kwaadaardige items gevonden)
Bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)


hij heeft niets gevonden en ook niet gevraagd om herop te starten

---------- Post added at 17:24 ---------- Previous post was at 17:23 ----------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:24:23, on 24/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Goegel
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Toevoegen aan de Banner Ad Blokker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: Statistieken bescherming internetverkeer - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1245432497859
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1245436704625
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - https://www.battlefieldheroes.com/st...r_4.0.17.0.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPE R~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
--
End of file - 5882 bytes

Deze logjes zien er nu netjes uit. Zijn er nog problemen met deze PC ? En zo ja, dewelke ?

ja er zijn veel problemen met dien pc, op momenten als je hem wilt aanzetten krijg je eerst zo'n blauw scherrm waarbij hij dan de beschadigde bestanden nakijkt en als hij dan verder opstart kan je gewoon niets doen, hij loopt dan telkens vast
wij werken hier met 2 computers die via een switch lopen, mijn gedacht is dat het eventueel daar aan kan liggen
scannen met de antivirus karspersky lukt niet , hij loopt elke keer vast op 8 procent
ook krijgen we dikwijls de melding dat als hij is opgestart dat kars is uitgeschakeld en niet kan worden opgestart met weer heel de pc die vastloopt als gevolg
er heeft twee weken geleden wel zware virussen op gestaan , als ik op de naam kom zet ik ze hier ook op en der heeft al eens iemand gezegt dat hij vermoeden heeft dat die virus alles heeft aangetast , de bios is al gereset geweest , ook het geheugen werd genoemd en die kon niet 100 procent zeggen dat er nog een virus zou zitten in de processor ofzoiets en hij kon dat niet nazien.
het is dat vastlopen wat echt wel ergerlijk is , ik dacht eerst aan de virussen maar nu blijkt dat hij clean is ben ik ten einde raad

Neen, clean zijn enkel deze logjes ... maar dat wil nog niet zeggen dat ook de volledige PC clean is. Probeer dit eens even :

Download Combofix naar je Bureaublad.

Lees hier meer over correct gebruik van Combofix.

OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download Combofix opnieuw.
Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

• Dubbelklik op Combofix.exe om het te starten.
  Indien je Combofix al eerder hebt gebruikt, kan je een waarschuwing krijgen dat een update beschikbaar is. Sta toe dat ComboFix wordt geupdate.
  Volg de instructies, aanvaard de disclaimer door op Ja te klikken.
  Indien de Recovery Console niet geïnstalleerd is, wordt je gevraagd om dit alsnog te doen door op JA te klikken in het "Query - Recovery Console" venster (enkel voor XP, niet voor VISTA).
  Klik op OK en Ja om automatisch de Recovery Console te laten installeren.
  Klik na afloop terug op Ja om het scannen op malware te starten.
  Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

Wanneer de fix voltooid is en na herstart, zal de log Combofix.txt openen.

Post dit logje in je volgende antwoord.

hierbij de combofix log

ComboFix 09-06-24.05 - Doelly 25/06/2009 14:02.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.2047.1591 [GMT 2:00]
Gestart vanuit: c:\documents and settings\Doelly\Bureaublad\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: ActiveArmor Firewall *enabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
(((((((((((((((((((( Bestanden Gemaakt van 2009-05-25 to 2009-06-25 ))))))))))))))))))))))))))))))
.
2009-06-24 16:33 . 2009-06-24 16:33 -------- d-----w- c:\documents and settings\Doelly\Application Data\Malwarebytes
2009-06-24 16:32 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-24 16:32 . 2009-06-24 16:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-24 16:32 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-24 16:32 . 2009-06-24 16:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-24 13:44 . 2009-06-24 13:44 -------- d-----w- c:\program files\Trend Micro
2009-06-20 14:04 . 2009-06-20 14:04 -------- d-----w- c:\documents and settings\Doelly\Local Settings\Application Data\PunkBuster
2009-06-20 13:52 . 2009-06-22 21:33 -------- d-----w- c:\documents and settings\Doelly\Contacts
2009-06-20 13:51 . 2009-06-20 13:51 -------- dc----w- c:\windows\system32\DRVSTORE
2009-06-20 13:50 . 2009-06-20 13:51 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller
2009-06-20 13:50 . 2009-06-20 13:52 -------- d-----w- c:\program files\Windows Live
2009-06-20 13:50 . 2009-06-20 13:50 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
2009-06-20 13:47 . 2009-06-20 13:47 -------- d-----w- c:\program files\MessengerPlus! 3
2009-06-20 13:44 . 2009-06-20 13:44 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-06-19 21:11 . 2009-06-19 21:11 -------- d-----w- c:\program files\Common Files\SWF Studio
2009-06-19 20:57 . 2009-06-19 20:57 -------- d--h--r- c:\documents and settings\Doelly\Application Data\SecuROM
2009-06-19 20:57 . 2009-06-19 20:57 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-06-19 20:56 . 2009-06-19 20:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-06-19 20:55 . 2009-06-19 20:55 -------- d-----w- c:\program files\Electronic Arts
2009-06-19 20:55 . 2009-06-19 20:55 -------- d-----w- C:\ProgramData
2009-06-19 20:55 . 2009-06-19 20:55 1522 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2009-06-19 20:54 . 2009-06-19 20:54 -------- d-----w- c:\documents and settings\Doelly\Local Settings\Application Data\Downloaded Installations
2009-06-19 20:32 . 2009-06-23 16:22 138520 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-06-19 20:32 . 2009-06-19 20:32 139152 ----a-w- c:\documents and settings\Doelly\Application Data\PnkBstrK.sys
2009-06-19 20:31 . 2009-06-23 16:21 189640 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-06-19 20:31 . 2009-06-19 20:31 794408 ----a-w- c:\windows\system32\pbsvc.exe
2009-06-19 20:31 . 2009-06-19 20:31 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-19 20:23 . 2009-06-19 20:45 -------- d-----w- c:\program files\EA Games
2009-06-19 19:55 . 2009-06-19 19:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-19 19:55 . 2009-06-19 19:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-19 19:51 . 2009-06-19 19:51 -------- d-----w- c:\program files\OpenOffice.org 3
2009-06-19 19:30 . 2008-04-14 17:02 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-06-19 19:27 . 2009-06-19 19:27 -------- d-----w- c:\program files\MSECache
2009-06-19 19:19 . 2009-06-19 19:19 129 ----a-w- c:\documents and settings\Doelly\Local Settings\Application Data\fusioncache.dat
2009-06-19 19:19 . 2009-06-19 19:19 -------- d-----w- c:\documents and settings\Doelly\Local Settings\Application Data\ApplicationHistory
2009-06-19 19:14 . 2009-06-19 19:14 -------- d-sh--w- c:\documents and settings\Doelly\IECompatCache
2009-06-19 19:14 . 2009-06-19 19:14 -------- d-sh--w- c:\documents and settings\Doelly\PrivacIE
2009-06-19 19:09 . 2008-10-16 12:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-06-19 19:08 . 2009-06-19 19:08 -------- d-sh--w- c:\documents and settings\Doelly\IETldCache
2009-06-19 19:08 . 2009-06-19 19:08 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-06-19 19:05 . 2006-06-29 11:07 14048 ------w- c:\windows\system32\spmsg2.dll
2009-06-19 19:02 . 2009-06-19 19:05 -------- d-----w- c:\windows\system32\XPSViewer
2009-06-19 19:02 . 2009-06-19 19:02 -------- d-----w- c:\program files\MSBuild
2009-06-19 19:02 . 2009-06-19 19:02 -------- d-----w- c:\program files\Reference Assemblies
2009-06-19 19:01 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-06-19 19:01 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-06-19 19:01 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-06-19 19:01 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-06-19 19:01 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-06-19 19:01 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-06-19 19:01 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-06-19 19:01 . 2009-06-19 19:02 -------- d-----w- C:\095356244b46ae2c6858
2009-06-19 19:00 . 2009-04-30 21:18 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-19 19:00 . 2009-04-30 21:17 1985024 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-06-19 19:00 . 2009-04-30 21:17 11064832 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-06-19 19:00 . 2009-04-30 21:17 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-19 19:00 . 2009-06-19 19:00 -------- d-----w- c:\windows\ie8updates
2009-06-19 19:00 . 2009-05-12 05:11 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-19 18:59 . 2009-06-19 19:00 -------- dc-h--w- c:\windows\ie8
2009-06-19 18:58 . 2009-06-20 13:37 -------- d-----w- c:\documents and settings\Doelly\Tracing
2009-06-19 18:53 . 2009-06-19 18:53 -------- d-----w- c:\program files\Common Files\Windows Live
2009-06-19 18:53 . 2009-06-20 13:01 21752 ----a-w- c:\documents and settings\Doelly\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-19 18:53 . 2009-06-19 18:53 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-19 18:52 . 2009-06-19 18:52 -------- d-----w- c:\documents and settings\Doelly\Local Settings\Application Data\Identities
2009-06-19 18:52 . 2009-06-19 18:52 -------- d-----w- c:\documents and settings\Doelly\Application Data\Windows Desktop Search
2009-06-19 18:51 . 2009-06-19 19:20 -------- d-----w- c:\program files\Windows Desktop Search
2009-06-19 18:51 . 2009-06-19 18:51 -------- d-----w- c:\windows\system32\GroupPolicy
2009-06-19 18:51 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2009-06-19 18:51 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2009-06-19 18:51 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2009-06-19 18:51 . 2009-06-19 18:51 -------- d-----w- c:\program files\Windows Media Connect 2
2009-06-19 18:50 . 2009-06-19 18:50 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-06-19 18:49 . 2009-06-19 18:49 -------- d-----w- c:\windows\system32\URTTemp
2009-06-19 18:44 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-06-19 18:44 . 2008-09-04 17:17 1106944 -c----w- c:\windows\system32\dllcache\msxml3.dll
2009-06-19 18:44 . 2008-10-15 16:37 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2009-06-19 18:44 . 2008-05-01 14:37 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2009-06-19 18:44 . 2008-04-11 19:06 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2009-06-19 18:43 . 2008-06-14 17:36 272640 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-06-19 18:43 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2009-06-19 18:33 . 2009-06-19 18:33 -------- d-----w- c:\program files\NVIDIA Corporation
2009-06-19 18:32 . 2006-03-23 17:53 442368 ----a-w- c:\windows\system32\CapabilityTable.exe
2009-06-19 18:32 . 2006-04-14 12:00 208896 ------w- c:\windows\system32\nvuide.exe
2009-06-19 18:32 . 2006-03-23 17:51 208896 ----a-w- c:\windows\system32\nvunrm.exe
2009-06-19 18:32 . 2006-03-22 12:23 109568 ----a-w- c:\windows\system32\drivers\nvtcp.sys
2009-06-19 18:32 . 2006-03-23 18:51 208896 ----a-w- c:\windows\system32\nvusmb.exe
2009-06-19 18:29 . 2009-06-19 18:29 -------- d-----w- c:\windows\system32\Lang
2009-06-19 18:26 . 2008-08-25 08:17 528384 ----a-w- c:\windows\RtlExUpd.dll
2009-06-19 18:26 . 2009-06-19 18:33 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-19 17:56 . 2009-06-19 19:08 -------- d-----w- c:\windows\system32\nl-nl
2009-06-19 17:56 . 2009-06-19 17:56 -------- d-----w- c:\windows\system32\nl
2009-06-19 17:56 . 2009-06-19 17:56 -------- d-----w- c:\windows\l2schemas
2009-06-19 17:56 . 2009-06-19 17:56 -------- d-----w- c:\windows\system32\bits
2009-06-19 17:55 . 2009-06-19 17:57 -------- d-----w- c:\windows\ServicePackFiles
2009-06-19 17:50 . 2009-06-19 17:50 -------- d-----w- c:\windows\EHome
2009-06-19 17:30 . 2009-05-12 13:12 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-06-19 17:28 . 2008-10-16 12:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-06-19 17:28 . 2009-06-19 17:28 -------- d-sh--w- c:\documents and settings\Doelly\UserData
2009-06-19 17:04 . 2009-06-19 17:04 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-19 17:03 . 2009-06-10 16:33 457248 ----a-w- c:\windows\system32\nvudisp.exe
2009-06-19 17:03 . 2009-06-04 14:39 457248 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-06-19 16:38 . 2009-06-24 17:21 -------- d--h--r- c:\documents and settings\Doelly\Onlangs geopend
2009-06-19 16:32 . 2009-06-19 16:32 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-06-19 16:32 . 2009-06-19 16:32 226832 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-06-19 16:32 . 2009-06-19 16:32 206088 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe
2009-06-19 16:28 . 2009-06-19 16:32 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-06-19 16:28 . 2009-06-19 16:32 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-06-19 16:28 . 2009-06-25 12:04 270368 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-06-19 16:28 . 2009-06-25 12:04 1014304 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-19 16:28 . 2009-06-25 11:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-06-19 16:28 . 2009-06-19 16:28 -------- d-----w- c:\program files\Kaspersky Lab
2009-06-19 16:19 . 2005-11-10 10:54 402944 ----a-r- c:\windows\system32\drivers\BLKWGU.sys
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 12:04 . 2009-06-19 16:28 9004 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-25 12:04 . 2009-06-19 16:28 2004 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-06-19 20:55 . 2009-06-19 18:27 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-19 19:18 . 2006-03-02 12:00 533928 ----a-w- c:\windows\system32\perfh013.dat
2009-06-19 19:18 . 2006-03-02 12:00 100060 ----a-w- c:\windows\system32\perfc013.dat
2009-06-19 18:27 . 2009-06-19 18:27 -------- d-----w- c:\program files\Realtek
2009-06-19 17:58 . 2009-06-18 20:45 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-19 16:32 . 2008-01-29 15:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-06-18 20:46 . 2009-06-18 20:46 -------- d-----w- c:\program files\microsoft frontpage
2009-06-18 20:44 . 2009-06-18 20:44 21748 ----a-w- c:\windows\system32\emptyregdb.dat
2009-06-10 16:33 . 2009-06-10 16:33 9998336 ----a-w- c:\windows\system32\nvoglnt.dll
2009-06-10 16:33 . 2009-06-10 16:33 815104 ----a-w- c:\windows\system32\nvapi.dll
2009-06-10 16:33 . 2009-06-10 16:33 8087712 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-06-10 16:33 . 2009-06-10 16:33 671744 ----a-w- c:\windows\system32\nvcuvid.dll
2009-06-10 16:33 . 2009-06-10 16:33 5908608 ----a-w- c:\windows\system32\nv4_disp.dll
2009-06-10 16:33 . 2009-06-10 16:33 1720320 ----a-w- c:\windows\system32\nvcuda.dll
2009-06-10 16:33 . 2009-06-10 16:33 1580550 ----a-w- c:\windows\system32\nvdata.bin
2009-06-10 16:33 . 2009-06-10 16:33 151552 ----a-w- c:\windows\system32\nvcodins.dll
2009-06-10 16:33 . 2009-06-10 16:33 151552 ----a-w- c:\windows\system32\nvcod.dll
2009-06-10 16:33 . 2009-06-10 16:33 1310720 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-06-10 06:28 . 2009-06-10 06:28 3510272 ----a-w- c:\windows\system32\nvgames.dll
2009-06-10 06:28 . 2009-06-10 06:28 5890048 ----a-w- c:\windows\system32\nvdispsr.dll
2009-06-10 06:28 . 2009-06-10 06:28 4022272 ----a-w- c:\windows\system32\nvdisps.dll
2009-06-10 06:28 . 2009-06-10 06:28 86016 ----a-w- c:\windows\system32\nvmctray.dll
2009-06-10 06:28 . 2009-06-10 06:28 168004 ----a-w- c:\windows\system32\nvsvc32.exe
2009-06-10 06:28 . 2009-06-10 06:28 143360 ----a-w- c:\windows\system32\nvcolor.exe
2009-06-10 06:28 . 2009-06-10 06:28 13758464 ----a-w- c:\windows\system32\nvcpl.dll
2009-06-10 06:28 . 2009-06-10 06:28 229376 ----a-w- c:\windows\system32\nvmccs.dll
2009-05-24 22:24 . 2008-05-26 20:18 350208 ------w- c:\windows\system32\mssph.dll
2009-05-13 05:06 . 2006-03-02 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:34 . 2006-03-02 12:00 347136 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:46 . 2009-04-29 04:46 81920 ------w- c:\windows\system32\ieencode.dll
2009-04-19 19:51 . 2006-03-02 12:00 1847296 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:55 . 2006-03-02 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2009-06-20 190024]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-06-10 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13758464]
"MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2009-06-20 190024]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-06-10 1657376]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2009-02-17 17508864]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 17:29 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 18:02 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 17:06 24592]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [19/06/2009 20:27 1684736]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Inhoud van de 'Gedeelde Taken' map
2009-06-25 c:\windows\Tasks\User_Feed_Synchronization-{A4D713B6-4D8F-405A-82FF-7C842D93D9B0}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.goegel.be/
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.17.0.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-06-25 14:06
Windows 5.1.2600 Service Pack 3 NTFS
scannen van verborgen processen ...
scannen van verborgen autostart items ...
scannen van verborgen bestanden ...
Scan succesvol afgerond
verborgen bestanden: 0
**************************************************************************
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
[HKEY_USERS\S-1-5-21-602162358-1897051121-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:31,c7,6b,36,1f,b4,b8,de,5d,14,86,18,dd,3d,33,6f,37,35,00,99,a3,
fe,ac,40,a9,ef,12,86,88,57,1c,3d,56,8a,d1,2e,24,e0,77,f7,4a,7d,4d,c8,08,e8,\
"rkeysecu"=hex:53,6d,de,45,0f,21,4c,93,9c,5a,46,ff,88,3d,e1,97
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------
- - - - - - - > 'lsass.exe'(1160)
c:\windows\system32\nvappfilter.dll
- - - - - - - > 'explorer.exe'(2688)
c:\program files\MessengerPlus! 3\MsgPlusLoader.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Andere Aktieve Processen ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\searchindexer.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\searchfilterhost.exe
.
**************************************************************************
.
Voltooingstijd: 2009-06-25 14:07 - machine werd herstart
ComboFix-quarantined-files.txt 2009-06-25 12:07
Pre-Run: 63.230.169.088 bytes beschikbaar
Post-Run: 63.224.324.096 bytes beschikbaar
WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
263 --- E O F --- 2009-06-24 22:30

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

File::
c:\windows\system32\drivers\klick.dat
c:\windows\system32\drivers\klin.dat

Driver::
klick
klin

Sla dit bestand op je bureaublad op als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe
Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.


Post na herstart de inhoud van de Combofix.txt in je volgende bericht.

ik heb het gedaan en dit is het logje

ComboFix 09-06-24.05 - Doelly 25/06/2009 18:25.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.32.1043.18.2047.1592 [GMT 2:00]
Gestart vanuit: c:\documents and settings\Doelly\Bureaublad\ComboFix.exe
gebruikte Opdracht switches :: c:\documents and settings\Doelly\Bureaublad\CFScript.txt..txt
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: ActiveArmor Firewall *enabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FILE ::
"c:\windows\system32\drivers\klick.dat"
"c:\windows\system32\drivers\klin.dat"
.
(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\klick.dat
c:\windows\system32\drivers\klin.dat
.
(((((((((((((((((((( Bestanden Gemaakt van 2009-05-25 to 2009-06-25 ))))))))))))))))))))))))))))))
.
2009-06-25 12:07 . 2009-06-25 12:07 -------- dc----w- c:\windows\system32\dllcache\cache
2009-06-24 16:33 . 2009-06-24 16:33 -------- d-----w- c:\documents and settings\Doelly\Application Data\Malwarebytes
2009-06-24 16:32 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-24 16:32 . 2009-06-24 16:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-24 16:32 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-24 16:32 . 2009-06-24 16:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-24 13:44 . 2009-06-24 13:44 -------- d-----w- c:\program files\Trend Micro
2009-06-20 14:04 . 2009-06-20 14:04 -------- d-----w- c:\documents and settings\Doelly\Local Settings\Application Data\PunkBuster
2009-06-20 13:52 . 2009-06-22 21:33 -------- d-----w- c:\documents and settings\Doelly\Contacts
2009-06-20 13:51 . 2009-06-20 13:51 -------- dc----w- c:\windows\system32\DRVSTORE
2009-06-20 13:50 . 2009-06-20 13:51 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller
2009-06-20 13:50 . 2009-06-20 13:52 -------- d-----w- c:\program files\Windows Live
2009-06-20 13:50 . 2009-06-20 13:50 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
2009-06-20 13:47 . 2009-06-20 13:47 -------- d-----w- c:\program files\MessengerPlus! 3
2009-06-20 13:44 . 2009-06-20 13:44 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-06-19 21:11 . 2009-06-19 21:11 -------- d-----w- c:\program files\Common Files\SWF Studio
2009-06-19 20:57 . 2009-06-19 20:57 -------- d--h--r- c:\documents and settings\Doelly\Application Data\SecuROM
2009-06-19 20:57 . 2009-06-19 20:57 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-06-19 20:56 . 2009-06-19 20:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-06-19 20:55 . 2009-06-19 20:55 -------- d-----w- c:\program files\Electronic Arts
2009-06-19 20:55 . 2009-06-19 20:55 -------- d-----w- C:\ProgramData
2009-06-19 20:55 . 2009-06-19 20:55 1522 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2009-06-19 20:54 . 2009-06-19 20:54 -------- d-----w- c:\documents and settings\Doelly\Local Settings\Application Data\Downloaded Installations
2009-06-19 20:32 . 2009-06-23 16:22 138520 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-06-19 20:32 . 2009-06-19 20:32 139152 ----a-w- c:\documents and settings\Doelly\Application Data\PnkBstrK.sys
2009-06-19 20:31 . 2009-06-23 16:21 189640 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-06-19 20:31 . 2009-06-19 20:31 794408 ----a-w- c:\windows\system32\pbsvc.exe
2009-06-19 20:31 . 2009-06-19 20:31 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-19 20:23 . 2009-06-19 20:45 -------- d-----w- c:\program files\EA Games
2009-06-19 19:55 . 2009-06-19 19:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-19 19:55 . 2009-06-19 19:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-19 19:51 . 2009-06-19 19:51 -------- d-----w- c:\program files\OpenOffice.org 3
2009-06-19 19:30 . 2008-04-14 17:02 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-06-19 19:27 . 2009-06-19 19:27 -------- d-----w- c:\program files\MSECache
2009-06-19 19:19 . 2009-06-19 19:19 129 ----a-w- c:\documents and settings\Doelly\Local Settings\Application Data\fusioncache.dat
2009-06-19 19:19 . 2009-06-19 19:19 -------- d-----w- c:\documents and settings\Doelly\Local Settings\Application Data\ApplicationHistory
2009-06-19 19:14 . 2009-06-19 19:14 -------- d-sh--w- c:\documents and settings\Doelly\IECompatCache
2009-06-19 19:14 . 2009-06-19 19:14 -------- d-sh--w- c:\documents and settings\Doelly\PrivacIE
2009-06-19 19:09 . 2008-10-16 12:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-06-19 19:08 . 2009-06-19 19:08 -------- d-sh--w- c:\documents and settings\Doelly\IETldCache
2009-06-19 19:08 . 2009-06-19 19:08 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-06-19 19:05 . 2006-06-29 11:07 14048 ------w- c:\windows\system32\spmsg2.dll
2009-06-19 19:02 . 2009-06-19 19:05 -------- d-----w- c:\windows\system32\XPSViewer
2009-06-19 19:02 . 2009-06-19 19:02 -------- d-----w- c:\program files\MSBuild
2009-06-19 19:02 . 2009-06-19 19:02 -------- d-----w- c:\program files\Reference Assemblies
2009-06-19 19:01 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-06-19 19:01 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-06-19 19:01 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-06-19 19:01 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-06-19 19:01 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-06-19 19:01 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-06-19 19:01 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-06-19 19:01 . 2009-06-19 19:02 -------- d-----w- C:\095356244b46ae2c6858
2009-06-19 19:00 . 2009-04-30 21:18 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-19 19:00 . 2009-04-30 21:17 1985024 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-06-19 19:00 . 2009-04-30 21:17 11064832 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-06-19 19:00 . 2009-04-30 21:17 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-19 19:00 . 2009-06-19 19:00 -------- d-----w- c:\windows\ie8updates
2009-06-19 19:00 . 2009-05-12 05:11 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-19 18:59 . 2009-06-19 19:00 -------- dc-h--w- c:\windows\ie8
2009-06-19 18:58 . 2009-06-20 13:37 -------- d-----w- c:\documents and settings\Doelly\Tracing
2009-06-19 18:53 . 2009-06-19 18:53 -------- d-----w- c:\program files\Common Files\Windows Live
2009-06-19 18:53 . 2009-06-20 13:01 21752 ----a-w- c:\documents and settings\Doelly\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-19 18:53 . 2009-06-19 18:53 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-19 18:52 . 2009-06-19 18:52 -------- d-----w- c:\documents and settings\Doelly\Local Settings\Application Data\Identities
2009-06-19 18:52 . 2009-06-19 18:52 -------- d-----w- c:\documents and settings\Doelly\Application Data\Windows Desktop Search
2009-06-19 18:51 . 2009-06-19 19:20 -------- d-----w- c:\program files\Windows Desktop Search
2009-06-19 18:51 . 2009-06-19 18:51 -------- d-----w- c:\windows\system32\GroupPolicy
2009-06-19 18:51 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2009-06-19 18:51 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2009-06-19 18:51 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2009-06-19 18:51 . 2009-06-19 18:51 -------- d-----w- c:\program files\Windows Media Connect 2
2009-06-19 18:50 . 2009-06-19 18:50 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-06-19 18:49 . 2009-06-19 18:49 -------- d-----w- c:\windows\system32\URTTemp
2009-06-19 18:44 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-06-19 18:44 . 2008-09-04 17:17 1106944 -c----w- c:\windows\system32\dllcache\msxml3.dll
2009-06-19 18:44 . 2008-10-15 16:37 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2009-06-19 18:44 . 2008-05-01 14:37 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2009-06-19 18:44 . 2008-04-11 19:06 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2009-06-19 18:43 . 2008-06-14 17:36 272640 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-06-19 18:43 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2009-06-19 18:33 . 2009-06-19 18:33 -------- d-----w- c:\program files\NVIDIA Corporation
2009-06-19 18:32 . 2006-03-23 17:53 442368 ----a-w- c:\windows\system32\CapabilityTable.exe
2009-06-19 18:32 . 2006-04-14 12:00 208896 ------w- c:\windows\system32\nvuide.exe
2009-06-19 18:32 . 2006-03-23 17:51 208896 ----a-w- c:\windows\system32\nvunrm.exe
2009-06-19 18:32 . 2006-03-22 12:23 109568 ----a-w- c:\windows\system32\drivers\nvtcp.sys
2009-06-19 18:32 . 2006-03-23 18:51 208896 ----a-w- c:\windows\system32\nvusmb.exe
2009-06-19 18:29 . 2009-06-19 18:29 -------- d-----w- c:\windows\system32\Lang
2009-06-19 18:26 . 2008-08-25 08:17 528384 ----a-w- c:\windows\RtlExUpd.dll
2009-06-19 18:26 . 2009-06-19 18:33 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-19 17:56 . 2009-06-19 19:08 -------- d-----w- c:\windows\system32\nl-nl
2009-06-19 17:56 . 2009-06-19 17:56 -------- d-----w- c:\windows\system32\nl
2009-06-19 17:56 . 2009-06-19 17:56 -------- d-----w- c:\windows\l2schemas
2009-06-19 17:56 . 2009-06-19 17:56 -------- d-----w- c:\windows\system32\bits
2009-06-19 17:55 . 2009-06-19 17:57 -------- d-----w- c:\windows\ServicePackFiles
2009-06-19 17:50 . 2009-06-19 17:50 -------- d-----w- c:\windows\EHome
2009-06-19 17:30 . 2009-05-12 13:12 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-06-19 17:28 . 2008-10-16 12:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-06-19 17:28 . 2009-06-19 17:28 -------- d-sh--w- c:\documents and settings\Doelly\UserData
2009-06-19 17:04 . 2009-06-19 17:04 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-19 17:03 . 2009-06-10 16:33 457248 ----a-w- c:\windows\system32\nvudisp.exe
2009-06-19 17:03 . 2009-06-04 14:39 457248 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-06-19 16:38 . 2009-06-25 16:24 -------- d--h--r- c:\documents and settings\Doelly\Onlangs geopend
2009-06-19 16:32 . 2009-06-19 16:32 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-06-19 16:32 . 2009-06-19 16:32 226832 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-06-19 16:32 . 2009-06-19 16:32 206088 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe
2009-06-19 16:28 . 2009-06-25 16:27 270368 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-06-19 16:28 . 2009-06-25 16:27 1014304 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-19 16:28 . 2009-06-25 11:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-06-19 16:28 . 2009-06-19 16:28 -------- d-----w- c:\program files\Kaspersky Lab
2009-06-19 16:19 . 2005-11-10 10:54 402944 ----a-r- c:\windows\system32\drivers\BLKWGU.sys
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 16:27 . 2009-06-19 16:28 9004 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-25 16:27 . 2009-06-19 16:28 2004 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-06-19 20:55 . 2009-06-19 18:27 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-19 19:18 . 2006-03-02 12:00 533928 ----a-w- c:\windows\system32\perfh013.dat
2009-06-19 19:18 . 2006-03-02 12:00 100060 ----a-w- c:\windows\system32\perfc013.dat
2009-06-19 18:27 . 2009-06-19 18:27 -------- d-----w- c:\program files\Realtek
2009-06-19 17:58 . 2009-06-18 20:45 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-19 16:32 . 2008-01-29 15:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-06-18 20:46 . 2009-06-18 20:46 -------- d-----w- c:\program files\microsoft frontpage
2009-06-18 20:44 . 2009-06-18 20:44 21748 ----a-w- c:\windows\system32\emptyregdb.dat
2009-06-10 16:33 . 2009-06-10 16:33 9998336 ----a-w- c:\windows\system32\nvoglnt.dll
2009-06-10 16:33 . 2009-06-10 16:33 815104 ----a-w- c:\windows\system32\nvapi.dll
2009-06-10 16:33 . 2009-06-10 16:33 8087712 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-06-10 16:33 . 2009-06-10 16:33 671744 ----a-w- c:\windows\system32\nvcuvid.dll
2009-06-10 16:33 . 2009-06-10 16:33 5908608 ----a-w- c:\windows\system32\nv4_disp.dll
2009-06-10 16:33 . 2009-06-10 16:33 1720320 ----a-w- c:\windows\system32\nvcuda.dll
2009-06-10 16:33 . 2009-06-10 16:33 1580550 ----a-w- c:\windows\system32\nvdata.bin
2009-06-10 16:33 . 2009-06-10 16:33 151552 ----a-w- c:\windows\system32\nvcodins.dll
2009-06-10 16:33 . 2009-06-10 16:33 151552 ----a-w- c:\windows\system32\nvcod.dll
2009-06-10 16:33 . 2009-06-10 16:33 1310720 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-06-10 06:28 . 2009-06-10 06:28 3510272 ----a-w- c:\windows\system32\nvgames.dll
2009-06-10 06:28 . 2009-06-10 06:28 5890048 ----a-w- c:\windows\system32\nvdispsr.dll
2009-06-10 06:28 . 2009-06-10 06:28 4022272 ----a-w- c:\windows\system32\nvdisps.dll
2009-06-10 06:28 . 2009-06-10 06:28 86016 ----a-w- c:\windows\system32\nvmctray.dll
2009-06-10 06:28 . 2009-06-10 06:28 168004 ----a-w- c:\windows\system32\nvsvc32.exe
2009-06-10 06:28 . 2009-06-10 06:28 143360 ----a-w- c:\windows\system32\nvcolor.exe
2009-06-10 06:28 . 2009-06-10 06:28 13758464 ----a-w- c:\windows\system32\nvcpl.dll
2009-06-10 06:28 . 2009-06-10 06:28 229376 ----a-w- c:\windows\system32\nvmccs.dll
2009-05-24 22:24 . 2008-05-26 20:18 350208 ------w- c:\windows\system32\mssph.dll
2009-05-13 05:06 . 2006-03-02 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:34 . 2006-03-02 12:00 347136 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:46 . 2009-04-29 04:46 81920 ------w- c:\windows\system32\ieencode.dll
2009-04-19 19:51 . 2006-03-02 12:00 1847296 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:55 . 2006-03-02 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-06-25_12.06.23 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-25 12:07 . 2008-10-16 12:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe
+ 2009-06-25 12:07 . 2008-04-14 17:02 82432 c:\windows\system32\dllcache\cache\ws2_32.dll
+ 2009-06-25 12:07 . 2008-04-14 17:03 26112 c:\windows\system32\dllcache\cache\userinit.exe
+ 2009-06-25 12:07 . 2008-04-14 17:03 14336 c:\windows\system32\dllcache\cache\svchost.exe
+ 2009-06-25 12:07 . 2008-04-14 17:03 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
+ 2009-06-25 12:07 . 2008-04-14 17:02 17408 c:\windows\system32\dllcache\cache\powrprof.dll
+ 2009-06-25 12:07 . 2008-04-14 17:03 13312 c:\windows\system32\dllcache\cache\lsass.exe
+ 2009-06-25 12:07 . 2008-04-14 16:39 25088 c:\windows\system32\dllcache\cache\kbdclass.sys
+ 2009-06-25 12:07 . 2008-04-13 18:53 36608 c:\windows\system32\dllcache\cache\ip6fw.sys
+ 2009-06-25 12:07 . 2008-04-14 17:02 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
+ 2009-06-25 12:07 . 2008-04-14 17:03 510464 c:\windows\system32\dllcache\cache\winlogon.exe
+ 2009-06-25 12:07 . 2009-05-13 05:06 915456 c:\windows\system32\dllcache\cache\wininet.dll
+ 2009-06-25 12:07 . 2008-04-14 17:02 580096 c:\windows\system32\dllcache\cache\user32.dll
+ 2009-06-25 12:07 . 2008-04-14 17:02 297472 c:\windows\system32\dllcache\cache\termsrv.dll
+ 2009-06-25 12:07 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\cache\tcpip.sys
+ 2009-06-25 12:07 . 2009-02-09 11:27 111104 c:\windows\system32\dllcache\cache\services.exe
+ 2009-06-25 12:07 . 2008-04-13 19:20 182656 c:\windows\system32\dllcache\cache\ndis.sys
+ 2009-06-25 12:07 . 2008-04-14 17:02 110080 c:\windows\system32\dllcache\cache\imm32.dll
+ 2009-06-25 12:07 . 2008-04-14 17:02 1571840 c:\windows\system32\dllcache\cache\sfcfiles.dll
+ 2009-06-25 12:07 . 2009-02-09 11:27 2149888 c:\windows\system32\dllcache\cache\ntoskrnl.exe
+ 2009-06-25 12:07 . 2009-02-09 11:27 2028544 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
+ 2009-06-25 12:07 . 2009-03-21 14:09 1030656 c:\windows\system32\dllcache\cache\kernel32.dll
+ 2009-06-25 12:07 . 2008-04-14 17:02 1037312 c:\windows\system32\dllcache\cache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2009-06-20 190024]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-06-10 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13758464]
"MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2009-06-20 190024]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-06-10 1657376]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2009-02-17 17508864]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 17:29 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 18:02 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 17:06 24592]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [19/06/2009 20:27 1684736]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Inhoud van de 'Gedeelde Taken' map
2009-06-25 c:\windows\Tasks\User_Feed_Synchronization-{A4D713B6-4D8F-405A-82FF-7C842D93D9B0}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.goegel.be/
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.17.0.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-06-25 18:28
Windows 5.1.2600 Service Pack 3 NTFS
scannen van verborgen processen ...
scannen van verborgen autostart items ...
scannen van verborgen bestanden ...
Scan succesvol afgerond
verborgen bestanden: 0
**************************************************************************
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
[HKEY_USERS\S-1-5-21-602162358-1897051121-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:31,c7,6b,36,1f,b4,b8,de,5d,14,86,18,dd,3d,33,6f,37,35,00,99,a3,
fe,ac,40,a9,ef,12,86,88,57,1c,3d,56,8a,d1,2e,24,e0,77,f7,4a,7d,4d,c8,08,e8,\
"rkeysecu"=hex:53,6d,de,45,0f,21,4c,93,9c,5a,46,ff,88,3d,e1,97
.
--------------------- DLLs Geladen Onder Lopende Processen ---------------------
- - - - - - - > 'lsass.exe'(1148)
c:\windows\system32\nvappfilter.dll
- - - - - - - > 'explorer.exe'(720)
c:\program files\MessengerPlus! 3\MsgPlusLoader.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll
.
------------------------ Andere Aktieve Processen ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\searchindexer.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Voltooingstijd: 2009-06-25 18:30 - machine werd herstart
ComboFix-quarantined-files.txt 2009-06-25 16:30
ComboFix2.txt 2009-06-25 12:07
Pre-Run: 63.199.432.704 bytes beschikbaar
Post-Run: 63.219.224.576 bytes beschikbaar
289 --- E O F --- 2009-06-24 22:30

Hoe staat het nu met alle problemen ... want een belangrijke "boosdoener" is nu opgeruimd door Combofix ?