Hi,
De unknow files zijn nergens te vinden op c,hieronder logfile hggraph en analyze afbeelding van c,als laatste de hijackfile
*****************************************************************************************
HDGraph.exe Error: 0 : Error during folder analysis (c:\Program Files\Windows NT\Bureau-accessoires). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\Program Files\Windows NT\Bureau-accessoires is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles()
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-05T14:56:21.0319184Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\System Volume Information). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\System Volume Information is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles()
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-05T14:56:34.3339184Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\Users\JACKO\AppData\Local). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\Users\JACKO\AppData\Local\Temporary Internet Files is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-05T14:56:34.9489184Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\Users\JACKO\AppData\Roaming). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\Users\JACKO\AppData\Roaming\Microsoft\Windows\Start Menu\Programma's is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-05T14:56:35.2679184Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\Windows\System32\LogFiles\WMI). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\Windows\System32\LogFiles\WMI\RtBackup is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-05T14:57:06.4769184Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\Program Files\Windows NT\Bureau-accessoires). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\Program Files\Windows NT\Bureau-accessoires is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles()
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-06T09:51:56.0851460Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\System Volume Information). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\System Volume Information is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles()
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-06T09:52:11.9815460Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\Users\JACKO\AppData\Local). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\Users\JACKO\AppData\Local\Temporary Internet Files is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-06T09:52:12.6055460Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\Users\JACKO\AppData\Roaming). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\Users\JACKO\AppData\Roaming\Microsoft\Windows\Start Menu\Programma's is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-06T09:52:12.8395460Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\Windows\System32\LogFiles\WMI). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\Windows\System32\LogFiles\WMI\RtBackup is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-06T09:52:44.9287460Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\Program Files\Windows NT\Bureau-accessoires). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\Program Files\Windows NT\Bureau-accessoires is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles()
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-06T14:12:31.8109100Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\System Volume Information). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\System Volume Information is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles()
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-06T14:12:47.4577100Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\Users\JACKO\AppData\Local). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\Users\JACKO\AppData\Local\Temporary Internet Files is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-06T14:12:48.0661100Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\Users\JACKO\AppData\Roaming). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\Users\JACKO\AppData\Roaming\Microsoft\Windows\Start Menu\Programma's is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-06T14:12:48.2845100Z
HDGraph.exe Error: 0 : Error during folder analysis (c:\Windows\System32\LogFiles\WMI). Folder skiped. Details: System.UnauthorizedAccessException: Toegang tot het pad c:\Windows\System32\LogFiles\WMI\RtBackup is geweigerd.
bij System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
bij System.IO.Directory.InternalGetFileDirectoryNames(String path, String userPathOriginal, String searchPattern, Boolean includeFiles, Boolean includeDirs, SearchOption searchOption)
bij System.IO.DirectoryInfo.GetFiles(String searchPattern, SearchOption searchOption)
bij HDGraph.HDGraphScanEngine.ConstruireArborescence(DirectoryNode dir, Int32 maxLevel)
DateTime=2011-02-06T14:13:18.1741100Z
Rode band zijn de 87gb unknowfiles
****************************************************************************************************
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:31:37, on 6/02/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18999)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Codyssey\Freeraser\Freeraser.exe
D:\RocketDock\RocketDock.exe
C:\Users\JACKO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MAGICDSK.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchFilterHost.exe
D:\Trend Micro\HiJackThis\HiJackThis.exe
C:\Windows\system32\DllHost.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HP Consumer | MSN
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Startpagina KlikKlik.be - de startpagina met iconen
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HP Consumer | MSN
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = HP Consumer | MSN
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - d:\BitComet\tools\BitCometBHO_1.3.3.2.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [Freeraser] C:\Program Files\Codyssey\Freeraser\Freeraser.exe
O4 - HKCU\..\Run: [RocketDock] "D:\RocketDock\RocketDock.exe"
O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: MAGICDSK.EXE
O8 - Extra context menu item: &D&ownload &met BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload alle video met BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload alles met BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://d:\BitComet\tools\BitCometBHO_1.3.3.2.dll/206 (file missing)
O9 - Extra button: HP Slim selecteren - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} (HPDDClientExec Class) - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsVista.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{13399424-021E-4E41-9AF0-4FD9327BE6EB}: NameServer = 216.146.35.35,216.146.36.36
O17 - HKLM\System\CCS\Services\Tcpip\..\{A22C76A1-E410-4709-BA39-3AE983A45558}: NameServer = 213.146.37.0
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: DynDNS Updater - Dynamic Network Services, Inc. - C:\Program Files\DynDNS Updater\DynUpSvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HerculesWiFi - Guillemot Corporation - C:\Windows\system32\HerculesWiFiService.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Program Files\SMINST\BLService.exe
O23 - Service: SHDSERV - Unknown owner - C:\Program Files\Shield\shdserv.exe
O23 - Service: Shield Client Service (ShieldClientService) - Unknown owner - C:\Program Files\Shield\shieldclnt.exe
O23 - Service: SymSnapService - Symantec - C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe
--
End of file - 8974 bytes
