Archief - check log plz

Ok, ik kijk er later op de avond nog naar.

Logfile of HijackThis v1.99.1
Scan saved at 16:57:28, on 21/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\system32\ati2sgag.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\Documents and Settings\Destro\Desktop\Programma's\Hijackthis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O20 - Winlogon Notify: IPConfTSP - C:\WINDOWS\system32\n8n60i5se8.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RGVzdHJv\command.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe





********
16:45: |··· Start of Session, vrijdag 21 oktober 2005 ···|
16:45: Spy Sweeper started
16:45: Sweep initiated using definitions version 559
16:45: Found Adware: icannnews
16:45: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\dynamic directory\ || dllname (ID = 359348)
16:45: dnlu0139e.dll (ID = 359348)
16:45: Starting Memory Sweep
16:45: Warning: Failed to check file "C:\WINDOWS\system32\vrrifier.dll". Cannot open file "C:\WINDOWS\system32\vrrifier.dll". The process cannot access the file because it is being used by another process
16:46: Warning: Failed to check file "C:\WINDOWS\system32\dnlu0139e.dll". Cannot open file "C:\WINDOWS\system32\dnlu0139e.dll". The process cannot access the file because it is being used by another process
16:46: Warning: Failed to check file "C:\WINDOWS\system32\vrrifier.dll". Cannot open file "C:\WINDOWS\system32\vrrifier.dll". The process cannot access the file because it is being used by another process
16:47: Memory Sweep Complete, Elapsed Time: 00:01:33
16:47: Starting Registry Sweep
16:47: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\dynamic directory\ (6 subtraces) (ID = 359346)
16:47: Starting Cookie Sweep
16:47: Registry Sweep Complete, Elapsed Time:00:00:00
16:47: Cookie Sweep Complete, Elapsed Time: 00:00:11
16:47: Starting File Sweep
16:47: Warning: Failed to read file "c:\windows\system32\n8n60i5se8.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:47: Found Adware: sp2ms
16:47: msresearch[1].exe (ID = 148760)
16:48: Found Adware: surf accuracy
16:48: sacc[1].cfg (ID = 162775)
16:48: Found Adware: effective-i toolbar
16:48: ucmoreiex[1].exe (ID = 59853)
16:48: Found Adware: look2me
16:48: installer[1].exe (ID = 168558)
16:48: Found Adware: ist yoursitebar
16:48: ysbinstall_1003585[1].exe (ID = 166206)
16:48: Warning: Failed to read file "c:\windows\system32\dnlu0139e.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:48: ysb[1].dll (ID = 161559)
16:48: yoursitebar[1].xml (ID = 131226)
16:48: Warning: Failed to read file "c:\windows\system32\vrrifier.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:49: File Sweep Complete, Elapsed Time: 00:01:41
16:49: Full Sweep has completed. Elapsed time 00:03:27
16:49: Traces Found: 16
16:53: Removal process initiated
16:53: Quarantining All Traces: icannnews
16:53: An error occurred during quarantine:
16:53: Cannot open file "C:\WINDOWS\system32\dnlu0139e.dll". The process cannot access the file because it is being used by another process
16:53: Quarantining All Traces: sp2ms
16:53: Quarantining All Traces: surf accuracy
16:53: Quarantining All Traces: effective-i toolbar
16:53: Quarantining All Traces: look2me
16:53: Quarantining All Traces: ist yoursitebar
16:54: Removal process completed. Elapsed time 00:00:17
********
16:36: |··· Start of Session, vrijdag 21 oktober 2005 ···|
16:36: Spy Sweeper started
16:36: Sweep initiated using definitions version 559
16:36: Found Adware: icannnews
16:36: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\dynamic directory\ || dllname (ID = 359348)
16:36: dnlu0139e.dll (ID = 359348)
16:36: Starting Memory Sweep
16:37: Warning: Failed to check file "C:\WINDOWS\system32\vrrifier.dll". Cannot open file "C:\WINDOWS\system32\vrrifier.dll". The process cannot access the file because it is being used by another process
16:37: Warning: Failed to check file "C:\WINDOWS\system32\dnlu0139e.dll". Cannot open file "C:\WINDOWS\system32\dnlu0139e.dll". The process cannot access the file because it is being used by another process
16:40: Warning: Failed to check file "C:\WINDOWS\system32\vrrifier.dll". Cannot open file "C:\WINDOWS\system32\vrrifier.dll". The process cannot access the file because it is being used by another process
16:40: Memory Sweep Complete, Elapsed Time: 00:03:23
16:40: Starting Registry Sweep
16:40: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\dynamic directory\ (6 subtraces) (ID = 359346)
16:40: Registry Sweep Complete, Elapsed Time:00:00:10
16:40: Starting Cookie Sweep
16:40: Cookie Sweep Complete, Elapsed Time: 00:00:00
16:40: Starting File Sweep
16:40: Warning: Failed to read file "c:\windows\system32\n8n60i5se8.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:40: Warning: Failed to read file "c:\windows\system32\dnlu0139e.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:40: Warning: Failed to read file "c:\windows\system32\vrrifier.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:40: File Sweep Complete, Elapsed Time: 00:00:12
16:40: Full Sweep has completed. Elapsed time 00:03:46
16:40: Traces Found: 9
16:43: Removal process initiated
16:43: Quarantining All Traces: icannnews
16:43: An error occurred during quarantine:
16:43: Cannot open file "C:\WINDOWS\system32\dnlu0139e.dll". The process cannot access the file because it is being used by another process
16:43: Removal process completed. Elapsed time 00:00:00
16:45: |··· End of Session, vrijdag 21 oktober 2005 ···|
********
16:32: |··· Start of Session, vrijdag 21 oktober 2005 ···|
16:32: Spy Sweeper started
16:32: Sweep initiated using definitions version 559
16:32: Starting Memory Sweep
16:32: Warning: Failed to check file "C:\WINDOWS\system32\r48slel71hq.dll". Cannot open file "C:\WINDOWS\system32\r48slel71hq.dll". The process cannot access the file because it is being used by another process
16:32: Warning: Failed to check file "C:\WINDOWS\system32\VMAME.DLL". Cannot open file "C:\WINDOWS\system32\VMAME.DLL". The process cannot access the file because it is being used by another process
16:32: Memory Sweep Complete, Elapsed Time: 00:00:30
16:32: Starting Registry Sweep
16:32: Registry Sweep Complete, Elapsed Time:00:00:03
16:32: Starting Cookie Sweep
16:32: Cookie Sweep Complete, Elapsed Time: 00:00:00
16:32: Starting File Sweep
16:32: Warning: Failed to read file "c:\windows\system32\vmame.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:32: Warning: Failed to read file "c:\windows\system32\r48slel71hq.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:32: Warning: Failed to read file "c:\windows\system32\dnlu0139e.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:32: File Sweep Complete, Elapsed Time: 00:00:11
16:32: Full Sweep has completed. Elapsed time 00:00:46
16:32: Traces Found: 0
16:36: Updating spyware definitions
16:36: Your definitions are up to date.
16:36: Updating spyware definitions
16:36: Your definitions are up to date.
16:36: Only Sweep Folders Where Threats Are Known to Reside
16:36: |··· End of Session, vrijdag 21 oktober 2005 ···|
********
16:30: |··· Start of Session, vrijdag 21 oktober 2005 ···|
16:30: Spy Sweeper started
16:30: Sweep initiated using definitions version 559
16:30: Starting Memory Sweep
16:30: Warning: Failed to check file "C:\WINDOWS\system32\r48slel71hq.dll". Cannot open file "C:\WINDOWS\system32\r48slel71hq.dll". The process cannot access the file because it is being used by another process
16:31: Warning: Failed to check file "C:\WINDOWS\system32\VMAME.DLL". Cannot open file "C:\WINDOWS\system32\VMAME.DLL". The process cannot access the file because it is being used by another process
16:31: Memory Sweep Complete, Elapsed Time: 00:00:38
16:31: Starting Registry Sweep
16:31: Registry Sweep Complete, Elapsed Time:00:00:03
16:31: Starting Cookie Sweep
16:31: Cookie Sweep Complete, Elapsed Time: 00:00:00
16:31: Starting File Sweep
16:31: Warning: Failed to read file "c:\windows\system32\vmame.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:31: Warning: Failed to read file "c:\windows\system32\r48slel71hq.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:31: Warning: Failed to read file "c:\windows\system32\dnlu0139e.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:31: File Sweep Complete, Elapsed Time: 00:00:11
16:31: Full Sweep has completed. Elapsed time 00:00:57
16:31: Traces Found: 0
16:32: |··· End of Session, vrijdag 21 oktober 2005 ···|
********
16:02: |··· Start of Session, vrijdag 21 oktober 2005 ···|
16:02: Spy Sweeper started
16:02: Sweep initiated using definitions version 559
16:02: Starting Memory Sweep
16:02: Found Adware: icannnews
16:02: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\shareddlls\ || dllname (ID = 359349)
16:02: d6j0lg1m16.dll (ID = 359349)
16:02: Warning: Failed to check file "C:\WINDOWS\system32\d6j0lg1m16.dll". Cannot open file "C:\WINDOWS\system32\d6j0lg1m16.dll". The process cannot access the file because it is being used by another process
16:04: Memory Sweep Complete, Elapsed Time: 00:01:51
16:04: Starting Registry Sweep
16:04: Found Adware: surf accuracy
16:04: HKLM\software\microsoft\windows\currentversion\uninstall\sacc\ (2 subtraces) (ID = 203070)
16:04: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\shareddlls\ (6 subtraces) (ID = 359347)
16:04: Starting Cookie Sweep
16:04: Registry Sweep Complete, Elapsed Time:00:00:00
16:04: Found Spy Cookie: yieldmanager cookie
16:04: [email protected][1].txt (ID = 3751)
16:04: Found Spy Cookie: netvenda cookie
16:04: destro@netvenda[1].txt (ID = 3074)
16:04: [email protected][1].txt (ID = 3074)
16:04: Found Spy Cookie: ysbweb cookie
16:04: destro@ysbweb[1].txt (ID = 3757)
16:04: Cookie Sweep Complete, Elapsed Time: 00:00:12
16:04: Starting File Sweep
16:04: Warning: Failed to read file "c:\windows\system32\r48slel71hq.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:04: Warning: Failed to read file "c:\windows\system32\d6j0lg1m16.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:04: Found Adware: sp2ms
16:04: msresearch.exe (ID = 148760)
16:04: File Sweep Complete, Elapsed Time: 00:00:12
16:04: Full Sweep has completed. Elapsed time 00:02:16
16:04: Traces Found: 17
16:04: Removal process initiated
16:04: Quarantining All Traces: icannnews
16:04: An error occurred during quarantine:
16:04: Cannot open file "C:\WINDOWS\system32\d6j0lg1m16.dll". The process cannot access the file because it is being used by another process
16:04: Quarantining All Traces: surf accuracy
16:04: Quarantining All Traces: yieldmanager cookie
16:04: Quarantining All Traces: netvenda cookie
16:04: Quarantining All Traces: ysbweb cookie
16:04: Quarantining All Traces: sp2ms
16:04: Removal process completed. Elapsed time 00:00:01
16:30: Program Version 4.0.3 (Build 374) Using Spyware Definitions 559
16:30: |··· End of Session, vrijdag 21 oktober 2005 ···|
********
16:01: |··· Start of Session, vrijdag 21 oktober 2005 ···|
16:01: Spy Sweeper started
16:01: Updating spyware definitions
16:02: Your spyware definitions have been updated.
16:02: Updating spyware definitions
16:02: Your definitions are up to date.
16:02: Only Sweep Folders Where Threats Are Known to Reside
16:02: |··· End of Session, vrijdag 21 oktober 2005 ···|

Nog steeds geïnfecteerd!

Nogmaals scannen, ditmaal in veilige mode.

vorige scan was in veilige mode...
nieuws ivm L2mfix ?

Kan je eens nagaan welke versie van SpySweeper je hebt?

Program Version 4.0.3 (Build 374) Using Spyware Definitions 560
Trial Program
Subscription Service: 30 Day Trial (30 days left)
http://www.webroot.com/

Als je Spysweeper via Hitman Pro hebt gedownload is het mogelijk dat je een oudere versie hebt. Deze kan L2m niet verwijderen. Je zal dan de trial van SpySweeper 4.5.3 moeten installeren en stand-alone moeten gebruiken.

k
was de ouder versie stand alone aan't gebruiken
goeie tip
(starting to love this forum)


tga wel nog tijde duren eer ik het binnen heb +-15 mins *edit* nu is't 30 mins

update: na scannen met nieuwe spysweeper


********
0:31: | Start of Session, zaterdag 22 oktober 2005 |
0:31: Spy Sweeper started
0:31: Sweep initiated using definitions version 560
0:31: Starting Memory Sweep
0:32: Found Adware: icannnews
0:32: Detected running threat: C:\WINDOWS\system32\mlxparhd.dll (ID = 83)
0:32: Detected running threat: C:\WINDOWS\system32\t6r80g9ue6.dll (ID = 83)
0:32: Memory Sweep Complete, Elapsed Time: 00:01:03
0:32: Starting Registry Sweep
0:33: Registry Sweep Complete, Elapsed Time:00:00:22
0:33: Starting Cookie Sweep
0:33: Cookie Sweep Complete, Elapsed Time: 00:00:00
0:33: Starting File Sweep
0:36: Found Adware: coolwebsearch (cws)
0:36: server.zip (ID = 54345)
0:40: server.zip (ID = 54345)
0:48: Found Adware: look2me
0:48: backup.zip (ID = 163672)
0:48: File Sweep Complete, Elapsed Time: 00:14:50
0:48: Full Sweep has completed. Elapsed time 00:16:18
0:48: Traces Found: 5
0:54: Removal process initiated
0:54: Quarantining All Traces: look2me
0:54: Quarantining All Traces: coolwebsearch (cws)
0:54: Quarantining All Traces: icannnews
0:54: icannnews is in use. It will be removed on reboot.
0:54: C:\WINDOWS\system32\mlxparhd.dll is in use. It will be removed on reboot.
0:54: C:\WINDOWS\system32\t6r80g9ue6.dll is in use. It will be removed on reboot.
0:54: Warning: Launched explorer.exe
0:54: Warning: Quarantine process could not restart Explorer.
0:55: Preparing to restart your computer. Please wait...
0:55: Removal process completed. Elapsed time 00:01:00
********
23:45: |··· Start of Session, vrijdag 21 oktober 2005 ···|
23:45: Spy Sweeper started
23:45: Sweep initiated using definitions version 560
23:46: Starting Memory Sweep
23:46: Warning: Failed to check file "C:\WINDOWS\system32\enrml1911.dll". Cannot open file "C:\WINDOWS\system32\enrml1911.dll". The process cannot access the file because it is being used by another process
23:46: Warning: Failed to check file "C:\WINDOWS\system32\mlbsync.dll". Cannot open file "C:\WINDOWS\system32\mlbsync.dll". The process cannot access the file because it is being used by another process
23:46: Warning: Failed to check file "C:\WINDOWS\system32\mlbsync.dll". Cannot open file "C:\WINDOWS\system32\mlbsync.dll". The process cannot access the file because it is being used by another process
23:46: Memory Sweep Complete, Elapsed Time: 00:00:35
23:46: Starting Registry Sweep
23:46: Registry Sweep Complete, Elapsed Time:00:00:03
23:46: Starting Cookie Sweep
23:46: Cookie Sweep Complete, Elapsed Time: 00:00:00
23:46: Starting File Sweep
23:46: Warning: Failed to read file "c:\windows\system32\enrml1911.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
23:47: Warning: Failed to read file "c:\windows\system32\mlbsync.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
23:47: Warning: Failed to read file "c:\windows\system32\k6080gdue6080.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
23:47: File Sweep Complete, Elapsed Time: 00:01:04
23:47: Full Sweep has completed. Elapsed time 00:01:44
23:47: Traces Found: 0
23:59: Warning: Failed to check file "C:\WINDOWS\system32\vrhelper.dll". Cannot open file "C:\WINDOWS\system32\vrhelper.dll". The process cannot access the file because it is being used by another process
23:59: Warning: Failed to check file "C:\WINDOWS\system32\k6080gdue6080.dll". Cannot open file "C:\WINDOWS\system32\k6080gdue6080.dll". The process cannot access the file because it is being used by another process
23:59: Warning: Failed to check file "C:\WINDOWS\system32\vrhelper.dll". Cannot open file "C:\WINDOWS\system32\vrhelper.dll". The process cannot access the file because it is being used by another process
0:04: Warning: Failed to check file "C:\WINDOWS\system32\vrhelper.dll". Cannot open file "C:\WINDOWS\system32\vrhelper.dll". The process cannot access the file because it is being used by another process
0:04: Warning: Failed to check file "C:\WINDOWS\system32\k6080gdue6080.dll". Cannot open file "C:\WINDOWS\system32\k6080gdue6080.dll". The process cannot access the file because it is being used by another process
0:04: Warning: Failed to check file "C:\WINDOWS\system32\vrhelper.dll". Cannot open file "C:\WINDOWS\system32\vrhelper.dll". The process cannot access the file because it is being used by another process
0:09: Warning: Failed to check file "C:\WINDOWS\system32\vrhelper.dll". Cannot open file "C:\WINDOWS\system32\vrhelper.dll". The process cannot access the file because it is being used by another process
0:09: Warning: Failed to check file "C:\WINDOWS\system32\k6080gdue6080.dll". Cannot open file "C:\WINDOWS\system32\k6080gdue6080.dll". The process cannot access the file because it is being used by another process
0:09: Warning: Failed to check file "C:\WINDOWS\system32\vrhelper.dll". Cannot open file "C:\WINDOWS\system32\vrhelper.dll". The process cannot access the file because it is being used by another process
0:26: Your spyware definitions have been updated.
0:27: Updating spyware definitions
0:31: Your spyware definitions have been updated.
0:31: | End of Session, zaterdag 22 oktober 2005 |
********
23:43: |··· Start of Session, vrijdag 21 oktober 2005 ···|
23:43: Spy Sweeper started
23:43: Sweep initiated using definitions version 560
23:43: Starting Memory Sweep
23:43: Warning: Failed to check file "C:\WINDOWS\system32\enrml1911.dll". Cannot open file "C:\WINDOWS\system32\enrml1911.dll". The process cannot access the file because it is being used by another process
23:43: Warning: Failed to check file "C:\WINDOWS\system32\mlbsync.dll". Cannot open file "C:\WINDOWS\system32\mlbsync.dll". The process cannot access the file because it is being used by another process
23:43: Warning: Failed to check file "C:\WINDOWS\system32\mlbsync.dll". Cannot open file "C:\WINDOWS\system32\mlbsync.dll". The process cannot access the file because it is being used by another process
23:43: Memory Sweep Complete, Elapsed Time: 00:00:33
23:43: Starting Registry Sweep
23:43: Registry Sweep Complete, Elapsed Time:00:00:04
23:43: Starting Cookie Sweep
23:43: Cookie Sweep Complete, Elapsed Time: 00:00:00
23:43: Starting File Sweep
23:43: Found Adware: isearch desktop search
23:43: mte3ndi6odoxng[1].exe (ID = 178687)
23:43: Warning: Failed to read file "c:\windows\system32\enrml1911.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
23:45: Warning: Failed to read file "c:\windows\system32\mlbsync.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
23:45: Warning: Failed to read file "c:\windows\system32\k6080gdue6080.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
23:45: File Sweep Complete, Elapsed Time: 00:01:44
23:45: Full Sweep has completed. Elapsed time 00:02:22
23:45: Traces Found: 1
23:45: Removal process initiated
23:45: Quarantining All Traces: isearch desktop search
23:45: Removal process completed. Elapsed time 00:00:00
23:45: |··· End of Session, vrijdag 21 oktober 2005 ···|
********
16:45: |··· Start of Session, vrijdag 21 oktober 2005 ···|
16:45: Spy Sweeper started
16:45: Sweep initiated using definitions version 559
16:45: Found Adware: icannnews
16:45: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\dynamic directory\ || dllname (ID = 359348)
16:45: dnlu0139e.dll (ID = 359348)
16:45: Starting Memory Sweep
16:45: Warning: Failed to check file "C:\WINDOWS\system32\vrrifier.dll". Cannot open file "C:\WINDOWS\system32\vrrifier.dll". The process cannot access the file because it is being used by another process
16:46: Warning: Failed to check file "C:\WINDOWS\system32\dnlu0139e.dll". Cannot open file "C:\WINDOWS\system32\dnlu0139e.dll". The process cannot access the file because it is being used by another process
16:46: Warning: Failed to check file "C:\WINDOWS\system32\vrrifier.dll". Cannot open file "C:\WINDOWS\system32\vrrifier.dll". The process cannot access the file because it is being used by another process
16:47: Memory Sweep Complete, Elapsed Time: 00:01:33
16:47: Starting Registry Sweep
16:47: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\dynamic directory\ (6 subtraces) (ID = 359346)
16:47: Starting Cookie Sweep
16:47: Registry Sweep Complete, Elapsed Time:00:00:00
16:47: Cookie Sweep Complete, Elapsed Time: 00:00:11
16:47: Starting File Sweep
16:47: Warning: Failed to read file "c:\windows\system32\n8n60i5se8.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:47: Found Adware: sp2ms
16:47: msresearch[1].exe (ID = 148760)
16:48: Found Adware: surf accuracy
16:48: sacc[1].cfg (ID = 162775)
16:48: Found Adware: effective-i toolbar
16:48: ucmoreiex[1].exe (ID = 59853)
16:48: Found Adware: look2me
16:48: installer[1].exe (ID = 168558)
16:48: Found Adware: ist yoursitebar
16:48: ysbinstall_1003585[1].exe (ID = 166206)
16:48: Warning: Failed to read file "c:\windows\system32\dnlu0139e.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:48: ysb[1].dll (ID = 161559)
16:48: yoursitebar[1].xml (ID = 131226)
16:48: Warning: Failed to read file "c:\windows\system32\vrrifier.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:49: File Sweep Complete, Elapsed Time: 00:01:41
16:49: Full Sweep has completed. Elapsed time 00:03:27
16:49: Traces Found: 16
16:53: Removal process initiated
16:53: Quarantining All Traces: icannnews
16:53: An error occurred during quarantine:
16:53: Cannot open file "C:\WINDOWS\system32\dnlu0139e.dll". The process cannot access the file because it is being used by another process
16:53: Quarantining All Traces: sp2ms
16:53: Quarantining All Traces: surf accuracy
16:53: Quarantining All Traces: effective-i toolbar
16:53: Quarantining All Traces: look2me
16:53: Quarantining All Traces: ist yoursitebar
16:54: Removal process completed. Elapsed time 00:00:17
23:40: Program Version 4.0.3 (Build 374) Using Spyware Definitions 559
23:40: Updating spyware definitions
23:40: Your spyware definitions have been updated.
23:42: Program Version 4.0.3 (Build 374) Using Spyware Definitions 560
********
16:36: |··· Start of Session, vrijdag 21 oktober 2005 ···|
16:36: Spy Sweeper started
16:36: Sweep initiated using definitions version 559
16:36: Found Adware: icannnews
16:36: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\dynamic directory\ || dllname (ID = 359348)
16:36: dnlu0139e.dll (ID = 359348)
16:36: Starting Memory Sweep
16:37: Warning: Failed to check file "C:\WINDOWS\system32\vrrifier.dll". Cannot open file "C:\WINDOWS\system32\vrrifier.dll". The process cannot access the file because it is being used by another process
16:37: Warning: Failed to check file "C:\WINDOWS\system32\dnlu0139e.dll". Cannot open file "C:\WINDOWS\system32\dnlu0139e.dll". The process cannot access the file because it is being used by another process
16:40: Warning: Failed to check file "C:\WINDOWS\system32\vrrifier.dll". Cannot open file "C:\WINDOWS\system32\vrrifier.dll". The process cannot access the file because it is being used by another process
16:40: Memory Sweep Complete, Elapsed Time: 00:03:23
16:40: Starting Registry Sweep
16:40: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\dynamic directory\ (6 subtraces) (ID = 359346)
16:40: Registry Sweep Complete, Elapsed Time:00:00:10
16:40: Starting Cookie Sweep
16:40: Cookie Sweep Complete, Elapsed Time: 00:00:00
16:40: Starting File Sweep
16:40: Warning: Failed to read file "c:\windows\system32\n8n60i5se8.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:40: Warning: Failed to read file "c:\windows\system32\dnlu0139e.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:40: Warning: Failed to read file "c:\windows\system32\vrrifier.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:40: File Sweep Complete, Elapsed Time: 00:00:12
16:40: Full Sweep has completed. Elapsed time 00:03:46
16:40: Traces Found: 9
16:43: Removal process initiated
16:43: Quarantining All Traces: icannnews
16:43: An error occurred during quarantine:
16:43: Cannot open file "C:\WINDOWS\system32\dnlu0139e.dll". The process cannot access the file because it is being used by another process
16:43: Removal process completed. Elapsed time 00:00:00
16:45: |··· End of Session, vrijdag 21 oktober 2005 ···|
********
16:32: |··· Start of Session, vrijdag 21 oktober 2005 ···|
16:32: Spy Sweeper started
16:32: Sweep initiated using definitions version 559
16:32: Starting Memory Sweep
16:32: Warning: Failed to check file "C:\WINDOWS\system32\r48slel71hq.dll". Cannot open file "C:\WINDOWS\system32\r48slel71hq.dll". The process cannot access the file because it is being used by another process
16:32: Warning: Failed to check file "C:\WINDOWS\system32\VMAME.DLL". Cannot open file "C:\WINDOWS\system32\VMAME.DLL". The process cannot access the file because it is being used by another process
16:32: Memory Sweep Complete, Elapsed Time: 00:00:30
16:32: Starting Registry Sweep
16:32: Registry Sweep Complete, Elapsed Time:00:00:03
16:32: Starting Cookie Sweep
16:32: Cookie Sweep Complete, Elapsed Time: 00:00:00
16:32: Starting File Sweep
16:32: Warning: Failed to read file "c:\windows\system32\vmame.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:32: Warning: Failed to read file "c:\windows\system32\r48slel71hq.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:32: Warning: Failed to read file "c:\windows\system32\dnlu0139e.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:32: File Sweep Complete, Elapsed Time: 00:00:11
16:32: Full Sweep has completed. Elapsed time 00:00:46
16:32: Traces Found: 0
16:36: Updating spyware definitions
16:36: Your definitions are up to date.
16:36: Updating spyware definitions
16:36: Your definitions are up to date.
16:36: Only Sweep Folders Where Threats Are Known to Reside
16:36: |··· End of Session, vrijdag 21 oktober 2005 ···|
********
16:30: |··· Start of Session, vrijdag 21 oktober 2005 ···|
16:30: Spy Sweeper started
16:30: Sweep initiated using definitions version 559
16:30: Starting Memory Sweep
16:30: Warning: Failed to check file "C:\WINDOWS\system32\r48slel71hq.dll". Cannot open file "C:\WINDOWS\system32\r48slel71hq.dll". The process cannot access the file because it is being used by another process
16:31: Warning: Failed to check file "C:\WINDOWS\system32\VMAME.DLL". Cannot open file "C:\WINDOWS\system32\VMAME.DLL". The process cannot access the file because it is being used by another process
16:31: Memory Sweep Complete, Elapsed Time: 00:00:38
16:31: Starting Registry Sweep
16:31: Registry Sweep Complete, Elapsed Time:00:00:03
16:31: Starting Cookie Sweep
16:31: Cookie Sweep Complete, Elapsed Time: 00:00:00
16:31: Starting File Sweep
16:31: Warning: Failed to read file "c:\windows\system32\vmame.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:31: Warning: Failed to read file "c:\windows\system32\r48slel71hq.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:31: Warning: Failed to read file "c:\windows\system32\dnlu0139e.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:31: File Sweep Complete, Elapsed Time: 00:00:11
16:31: Full Sweep has completed. Elapsed time 00:00:57
16:31: Traces Found: 0
16:32: |··· End of Session, vrijdag 21 oktober 2005 ···|
********
16:02: |··· Start of Session, vrijdag 21 oktober 2005 ···|
16:02: Spy Sweeper started
16:02: Sweep initiated using definitions version 559
16:02: Starting Memory Sweep
16:02: Found Adware: icannnews
16:02: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\shareddlls\ || dllname (ID = 359349)
16:02: d6j0lg1m16.dll (ID = 359349)
16:02: Warning: Failed to check file "C:\WINDOWS\system32\d6j0lg1m16.dll". Cannot open file "C:\WINDOWS\system32\d6j0lg1m16.dll". The process cannot access the file because it is being used by another process
16:04: Memory Sweep Complete, Elapsed Time: 00:01:51
16:04: Starting Registry Sweep
16:04: Found Adware: surf accuracy
16:04: HKLM\software\microsoft\windows\currentversion\uninstall\sacc\ (2 subtraces) (ID = 203070)
16:04: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\shareddlls\ (6 subtraces) (ID = 359347)
16:04: Starting Cookie Sweep
16:04: Registry Sweep Complete, Elapsed Time:00:00:00
16:04: Found Spy Cookie: yieldmanager cookie
16:04: [email protected][1].txt (ID = 3751)
16:04: Found Spy Cookie: netvenda cookie
16:04: destro@netvenda[1].txt (ID = 3074)
16:04: [email protected][1].txt (ID = 3074)
16:04: Found Spy Cookie: ysbweb cookie
16:04: destro@ysbweb[1].txt (ID = 3757)
16:04: Cookie Sweep Complete, Elapsed Time: 00:00:12
16:04: Starting File Sweep
16:04: Warning: Failed to read file "c:\windows\system32\r48slel71hq.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:04: Warning: Failed to read file "c:\windows\system32\d6j0lg1m16.dll". System Error. Code: 32.
The process cannot access the file because it is being used by another process
16:04: Found Adware: sp2ms
16:04: msresearch.exe (ID = 148760)
16:04: File Sweep Complete, Elapsed Time: 00:00:12
16:04: Full Sweep has completed. Elapsed time 00:02:16
16:04: Traces Found: 17
16:04: Removal process initiated
16:04: Quarantining All Traces: icannnews
16:04: An error occurred during quarantine:
16:04: Cannot open file "C:\WINDOWS\system32\d6j0lg1m16.dll". The process cannot access the file because it is being used by another process
16:04: Quarantining All Traces: surf accuracy
16:04: Quarantining All Traces: yieldmanager cookie
16:04: Quarantining All Traces: netvenda cookie
16:04: Quarantining All Traces: ysbweb cookie
16:04: Quarantining All Traces: sp2ms
16:04: Removal process completed. Elapsed time 00:00:01
16:30: Program Version 4.0.3 (Build 374) Using Spyware Definitions 559
16:30: |··· End of Session, vrijdag 21 oktober 2005 ···|
********
16:01: |··· Start of Session, vrijdag 21 oktober 2005 ···|
16:01: Spy Sweeper started
16:01: Updating spyware definitions
16:02: Your spyware definitions have been updated.
16:02: Updating spyware definitions
16:02: Your definitions are up to date.
16:02: Only Sweep Folders Where Threats Are Known to Reside
16:02: |··· End of Session, vrijdag 21 oktober 2005 ···|



Logfile of HijackThis v1.99.1
Scan saved at 1:00:43, on 22/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Documents and Settings\Destro\Desktop\Programma's\Hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RGVzdHJv\command.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Dat ziet er al heel wat beter uit!

Nog even dit:

Je hebt 2 antivirusprogramma's! Nod32 is waarschijnlijk geïnstalleerd via Hitman. Dit kan voor conflicten zorgen. Verwijder één AV!

* Start HJT scan en vink het volgende item aan:
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RGVzdHJv\command.exe (file missing)

* Sluit alle vensters en klik op "Fix Checked"

* Verwijder de volgende map via verkenner:
C:\WINDOWS\RGVzdHJv\

* Herstarten en nieuw HJT logje posten aub (normaal gezien zou alles nu in orde moeten zijn )

De rest is evt voor morgen

Jownzzzzzzzzzzzzz

wat klinkt dat als muziek in de oren!als virusscanner hou ik wel panda - ben daar nogal content van
bijkomende vraag - panda start altyd op, die andere gebruik ik alleen met hitman pro (bijna nooit meer maw) kan het kwaat om deze er toch op te laten staan? of is het verdict van de voor mijn part tot halfgod verheven jownz -> remove!

niewu log komt zo meteen

Logfile of HijackThis v1.99.1
Scan saved at 1:39:27, on 22/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\Documents and Settings\Destro\Desktop\Programma's\Hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RGVzdHJv\command.exe (file missing)
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe


da blijft ook al staan
(khad die folder dervoor al weggedaan via delete)

Hoi,

* Twee AV's op één machine lijkt me nooit een goed idee. Dus ik raad je toch aan om die Nod32 te verwijderen. In de plaats daarvan kan je ook af en toe scannen met een online scan.
Hier zijn er een paar:
Bitdefender of HouseCall of Panda

* Doe nog even het volgende:

Ga naar Start --> Uitvoeren --> typ daar in het venstertje: services.msc en klik OK
- Ga de lijst van services af naar deze :

Service: Command Service

- Doe daar rechtermuisklik op --> neem "eigenschappen"
- Zet in het venstertje dat verschijnt het "opstarttype" op uitgeschakeld en klik ietsje daaronder op het knopje "stoppen"

* Verwijder de volgende map via verkenner:
C:\WINDOWS\RGVzdHJv\

* Herstarten en logje posten aub.

Logfile of HijackThis v1.99.1
Scan saved at 15:12:07, on 22/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\Documents and Settings\Destro\Desktop\Programma's\Hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe


/me happy

me too

was me da nen boterham seg
maar toch noggis bedankt!