Archief - Check Logje AUB

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:38:52, on 15/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\AskBarDis\bar\bin\AskService.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = Home
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REGystem.ini: UserInit=userinit.exe,EXPLORER.EXE
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: ZoneAlarm Spy Blocker Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe
O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O20 - AppInit_DLLs: C:\WINDOWS\System32\glmf3232.dll
O20 - Winlogon Notify: 262916f0573 - C:\WINDOWS\System32\glmf3232.dll (file missing)
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZONELABS\vsmon.exe

--
End of file - 6216 bytes

BEDANKT!

Start Hijackthis op en kies voor 'Do a system scan only'
Selecteer alleen de items die hieronder zijn genoemd:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = Home
F2 - REGystem.ini: UserInit=userinit.exe,EXPLORER.EXE
O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe
O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE
O20 - AppInit_DLLs: C:\WINDOWS\System32\glmf3232.dll
O20 - Winlogon Notify: 262916f0573 - C:\WINDOWS\System32\glmf3232.dll (file missing)

Klik op 'Fix checked' om de items te verwijderen.



Jouw computer is geinfecteerd door een virus dat via USB-memorysticks of USB disk wordt verspreid.
Maar ook via een MP3 speler of digitale camera is het mogelijk om het virus over te dragen.

Download het volgende programma en start het.
Flash_Disinfector.exe

Het programma sluit Internet Explorer en de Windows Verkenner.
Er wordt gevraagd om de USB-disk aan te sluiten. Herhaal dit als je meerdere USB apparaten hebt.

Volg deze instructies om Combofix te downloaden. Is er iets niet duidelijk, dan vraag je het.
Voer de instructies op de BleepingComputer pagina uit, inclusief het installeren van de XP Recovery Console.
Indien je combofix al eerder gebruikt hebt en de recovery console al geïnstalleerd hebt mag je die stap overslaan.

OPMERKING:
Indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus- of een andere realtime scanner,
schakel dan deze scanner uit en download Combofix opnieuw.
Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

Dubbelklik op Combofix.exe, als Combofix aangeeft dat er een nieuwere versie beschikbaar is, dan sta je toe dat deze gedownload wordt.
Volg de instructies en aanvaard de disclaimer.
Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.
Wanneer de fix voltooid is en na herstart, zal de log Combofix.txt openen.

Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

Thanks alles gedaan dit is het nieuwe logje:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:37:46, on 5/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\EXPLORER.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\AskBarDis\bar\bin\AskService.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Live Search:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Home
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb128\SearchSettings.dll
F2 - REGystem.ini: UserInit=userinit.exe,EXPLORER.EXE
O2 - BHO: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb128\SearchSettings.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: ZoneAlarm Spy Blocker Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Blubster] C:\Program Files\Blubster\Blubster.exe SILENT
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe
O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZONELABS\vsmon.exe

--
End of file - 7321 bytes

Voer de volgende acties eerst uit:
Klik op Start -> (Settings) -> Configuratiescherm -> Software en verwijder het volgende programma:
SearchSettings




Start Hijackthis op en kies voor 'Do a system scan only'
Selecteer alleen de items die hieronder zijn genoemd:

R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb128\SearchSettings.dll
F2 - REGystem.ini: UserInit=userinit.exe,EXPLORER.EXE
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb128\SearchSettings.dll
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe
O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE

Sluit alle vensters behalve Hijackthis
Klik op 'Fix checked' om de items te verwijderen.



Jouw computer is geinfecteerd door een virus dat via USB-memorysticks of USB disk wordt verspreid.
Maar ook via een MP3 speler of digitale camera is het mogelijk om het virus over te dragen.

Download het volgende programma en start het.
Flash_Disinfector.exe

Het programma sluit Internet Explorer en de Windows Verkenner.
Er wordt gevraagd om de USB-disk aan te sluiten. Herhaal dit als je meerdere USB apparaten hebt.


Download Combofix naar je Bureaublad en gebruik het volgens deze handleiding.

OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download Combofix opnieuw.
Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

• Dubbelklik op Combofix.exe om het te starten.
• Indien je Combofix al eerder hebt gebruikt, kan je een waarschuwing krijgen dat een update beschikbaar is. Sta toe dat ComboFix wordt geupdate.
• Klik op OK in het "NirCmd" venstertje.
• Indien de Recovery Console niet geïnstalleerd is, wordt je gevraagd om dit alsnog te doen door op JA te klikken in het "Query - Recovery Console" venster.
• Klik op OK en Ja om automatisch de Recovery Console te laten installeren.
• Klik na afloop terug op Ja om het scannen op malware te starten.
• Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.
• Wanneer de fix voltooid is en na herstart, zal de log Combofix.txt openen.

Post dit logje in je volgende antwoord.

Voila. Bedankt





ComboFix 09-05-08.03 - An Boel 10/05/2009 9:45.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.446.180 [GMT 2:00]
Gestart vanuit: c:\program files\ComboFix.exe
FW: ZoneAlarm Firewall *enabled*
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\explorer.exe
D:\Autorun.inf

.
(((((((((((((((((((( Bestanden Gemaakt van 2009-04-10 to 2009-05-10 ))))))))))))))))))))))))))))))
.

2009-05-10 07:43 . 2009-05-10 07:43 3019457 ----a-r c:\program files\ComboFix.exe
2009-05-10 07:38 . 2009-05-10 07:38 132597 ----a-w c:\program files\Flash_Disinfector.exe
2009-05-07 15:02 . 2009-05-07 15:02 -------- d-----r c:\documents and settings\An Boel\Application Data\Brother
2009-05-05 18:48 . 2009-05-05 18:48 17570056 ----a-w c:\program files\PDFCreator-0_9_8_setup.exe
2009-05-05 18:37 . 2009-05-05 18:37 -------- d-----w c:\program files\Trend Micro
2009-05-05 18:37 . 2009-05-05 18:37 812344 ----a-w c:\program files\HJTInstall.exe
2009-05-01 07:16 . 2009-05-01 07:16 -------- d-----w c:\documents and settings\An Boel\Application Data\Dealio
2009-05-01 07:11 . 2009-05-01 07:11 -------- d-----w c:\program files\Dealio Toolbar
2009-05-01 07:10 . 2009-05-01 07:10 5888824 ----a-w c:\program files\BlubsterSetup.exe
2009-05-01 06:15 . 2009-05-01 06:15 -------- d-----w c:\windows\system32\nl-nl
2009-05-01 06:15 . 2009-05-01 06:15 -------- d-----w c:\windows\l2schemas
2009-05-01 06:15 . 2009-05-01 06:15 -------- d-----w c:\windows\system32\nl
2009-04-28 15:24 . 2009-04-28 15:24 -------- d-----w c:\program files\MSXML 4.0
2009-04-28 15:08 . 2008-09-10 01:16 1307648 ------w c:\windows\system32\dllcache\msxml6.dll
2009-04-28 15:08 . 2008-09-10 01:16 1307648 ------w c:\windows\system32\msxml6.dll
2009-04-28 15:06 . 2008-04-13 18:40 10240 ------w c:\windows\system32\drivers\sffp_mmc.sys
2009-04-28 15:06 . 2008-04-14 17:02 9216 ------w c:\windows\system32\dot3dlg.dll
2009-04-28 15:06 . 2008-04-14 17:01 6144 ------w c:\windows\system32\kbdnepr.dll
2009-04-28 15:06 . 2008-04-14 17:02 7168 ------w c:\windows\system32\bitsprx4.dll
2009-04-28 15:06 . 2008-04-14 17:01 6144 ------w c:\windows\system32\kbdpash.dll
2009-04-28 15:06 . 2008-04-14 17:01 6144 ------w c:\windows\system32\kbdbhc.dll
2009-04-28 15:06 . 2008-04-14 17:01 6144 ------w c:\windows\system32\kbdiultn.dll
2009-04-28 14:39 . 2008-06-14 17:36 272640 ------w c:\windows\system32\dllcache\bthport.sys
2009-04-28 14:38 . 2009-02-06 10:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-28 14:38 . 2009-02-09 11:27 2193408 ------w c:\windows\system32\dllcache\ntoskrnl.exe
2009-04-28 14:38 . 2009-03-06 14:23 285696 ------w c:\windows\system32\dllcache\pdh.dll
2009-04-28 14:38 . 2009-02-09 11:27 111104 ------w c:\windows\system32\dllcache\services.exe
2009-04-28 14:38 . 2009-02-09 10:56 401408 ------w c:\windows\system32\dllcache\rpcss.dll
2009-04-28 14:38 . 2009-02-09 10:56 473600 ------w c:\windows\system32\dllcache\fastprox.dll
2009-04-28 14:38 . 2009-02-09 10:56 684544 ------w c:\windows\system32\dllcache\advapi32.dll
2009-04-28 14:38 . 2009-02-09 10:56 734208 ------w c:\windows\system32\dllcache\lsasrv.dll
2009-04-28 14:38 . 2009-02-09 10:56 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-28 14:38 . 2009-02-09 10:56 735744 ------w c:\windows\system32\dllcache\ntdll.dll
2009-04-28 14:38 . 2009-02-09 11:27 2149888 ------w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-04-28 14:38 . 2009-02-09 11:27 2028544 ------w c:\windows\system32\dllcache\ntkrpamp.exe
2009-04-28 14:37 . 2008-05-08 14:02 203136 ------w c:\windows\system32\dllcache\rmcast.sys
2009-04-28 14:37 . 2008-10-24 11:21 455296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2009-04-28 14:36 . 2008-12-11 10:57 333952 ------w c:\windows\system32\dllcache\srv.sys
2009-04-28 14:36 . 2008-05-01 14:37 331776 ------w c:\windows\system32\dllcache\msadce.dll
2009-04-28 14:36 . 2008-04-11 19:06 691712 ------w c:\windows\system32\dllcache\inetcomm.dll
2009-04-28 14:35 . 2008-10-03 10:05 247326 ------w c:\windows\system32\dllcache\strmdll.dll
2009-04-28 14:35 . 2008-10-15 16:37 337408 ------w c:\windows\system32\dllcache\netapi32.dll
2009-04-28 14:35 . 2008-04-21 21:16 218624 ------w c:\windows\system32\dllcache\wordpad.exe
2009-04-28 14:30 . 2008-10-16 12:06 208744 ----a-w c:\windows\system32\muweb.dll
2009-04-28 14:30 . 2008-10-16 12:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-04-28 11:18 . 2009-04-28 11:18 -------- d-----w c:\windows\system32\LogFiles
2009-04-28 10:05 . 2009-04-28 10:05 -------- d-----w c:\windows\Downloaded Installations
2009-04-28 10:04 . 2009-04-28 10:04 532616 ----a-w c:\program files\ImageResizerPowertoySetup.exe
2009-04-28 09:49 . 2009-04-28 09:49 -------- d-----w c:\documents and settings\An Boel\Application Data\Apple Computer
2009-04-28 09:41 . 2009-04-28 09:41 -------- d-----w c:\program files\AskBarDis
2009-04-28 09:40 . 2009-04-28 09:41 4212 ---ha-w c:\windows\system32\zllictbl.dat
2009-04-28 09:40 . 2009-02-15 22:10 1221512 ----a-w c:\windows\system32\zpeng25.dll
2009-04-28 09:40 . 2009-04-28 09:40 -------- d-----w c:\windows\system32\ZoneLabs
2009-04-28 09:34 . 2009-04-28 09:34 -------- d-----w c:\program files\Zone Labs
2009-04-28 09:26 . 2009-04-28 09:26 -------- d-----w c:\documents and settings\An Boel\Local Settings\Application Data\Scansoft
2009-04-28 09:23 . 2008-04-13 18:47 25856 ----a-w c:\windows\system32\drivers\usbprint.sys
2009-04-28 09:23 . 2008-04-13 18:45 32128 ----a-w c:\windows\system32\drivers\usbccgp.sys
2009-04-28 09:21 . 2009-04-28 09:21 50 ----a-w c:\windows\system32\bridf07a.dat
2009-04-28 09:20 . 2007-01-26 12:06 45568 ----a-w c:\windows\system32\BrUsi07a.dll
2009-04-28 09:20 . 2007-02-01 11:19 1520640 ----a-w c:\windows\system32\BrWia07a.dll
2009-04-28 09:20 . 2004-10-15 10:50 15295 ----a-w c:\windows\system32\drivers\BrScnUsb.sys
2009-04-28 09:20 . 2007-01-26 14:26 56320 ----a-w c:\windows\system32\brinsstr.dll
2009-04-28 09:20 . 2007-01-15 14:17 12288 ------r c:\windows\system32\BrDctF2L.dll
2009-04-28 09:20 . 2007-01-15 19:54 12288 ------r c:\windows\system32\BrDctF2S.dll
2009-04-28 09:20 . 2007-01-25 15:16 94208 ------r c:\windows\system32\BrDctF2.dll
2009-04-28 09:20 . 2006-12-28 11:39 176128 ------w c:\windows\system32\BroSNMP.dll
2009-04-28 09:20 . 2007-01-18 11:51 163840 ------w c:\windows\system32\NSSearch.dll
2009-04-28 09:20 . 2009-04-28 09:20 -------- d-----w c:\program files\Brother
2009-04-28 09:20 . 2007-02-15 11:54 131072 ------w c:\windows\brunin03.dll
2009-04-28 09:20 . 2009-04-28 09:20 -------- d-----w c:\documents and settings\An Boel\Application Data\InstallShield
2009-04-28 09:19 . 2009-04-28 09:19 -------- d-----w c:\program files\Nuance
2009-04-28 09:18 . 2009-04-28 09:18 -------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2009-04-28 09:17 . 2009-04-28 09:17 -------- d-----w c:\program files\Common Files\ScanSoft Shared
2009-04-28 09:17 . 2009-04-28 09:17 -------- d-----w c:\documents and settings\All Users\Application Data\ScanSoft
2009-04-28 09:17 . 2009-04-28 09:17 -------- d-----w c:\program files\ScanSoft
2009-04-28 09:15 . 2009-04-28 09:15 -------- d-----w c:\documents and settings\An Boel\Local Settings\Application Data\KodakGallery
2009-04-28 09:14 . 2009-04-28 09:14 -------- d-----w c:\documents and settings\An Boel\Application Data\Skinux
2009-04-28 09:13 . 2009-04-28 09:13 -------- d-----w c:\program files\QuickTime
2009-04-28 09:13 . 2009-04-28 09:13 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-28 09:13 . 2009-04-28 09:13 -------- d-----w c:\documents and settings\An Boel\Local Settings\Application Data\Apple Computer
2009-04-28 09:12 . 2001-09-06 19:27 5632 ----a-w c:\windows\system32\ptpusb.dll
2009-04-28 09:12 . 2008-04-13 18:45 15104 ----a-w c:\windows\system32\drivers\usbscan.sys
2009-04-28 09:12 . 2004-08-04 08:03 159232 ----a-w c:\windows\system32\ptpusd.dll
2009-04-28 09:10 . 2009-04-28 09:10 -------- d-----w c:\program files\Common Files\Kodak
2009-04-28 09:10 . 2009-04-28 09:10 -------- d-----w c:\program files\Kodak
2009-04-28 08:42 . 2009-04-28 08:42 -------- d-----w c:\documents and settings\An Boel\Tracing
2009-04-28 08:40 . 2009-02-06 16:08 55152 ----a-w c:\windows\system32\drivers\fssfltr_tdi.sys
2009-04-28 08:40 . 2009-04-28 08:40 -------- d-----w c:\windows\system32\DRVSTORE
2009-04-28 08:35 . 2009-04-28 08:35 -------- d-----w c:\program files\Microsoft Sync Framework
2009-04-28 08:34 . 2006-11-29 11:06 3426072 ----a-w c:\windows\system32\d3dx9_32.dll
2009-04-28 08:34 . 2009-04-28 08:34 -------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-04-28 08:33 . 2009-04-28 08:33 -------- d-----w c:\program files\Microsoft
2009-04-28 08:32 . 2009-04-28 08:32 -------- d-----w c:\program files\Windows Live SkyDrive
2009-04-28 08:32 . 2009-04-28 08:32 -------- d-----w c:\program files\Windows Live
2009-04-28 08:25 . 2009-04-28 08:25 -------- d-----w c:\program files\Common Files\Windows Live
2009-04-28 08:23 . 2009-04-28 08:23 -------- d-----w c:\program files\MSN_Messenger-7.5
2009-04-28 08:22 . 2009-04-28 08:22 9302470 ----a-w c:\program files\MSN_Messenger-7.5.zip
2009-04-28 07:48 . 2009-04-28 07:48 -------- d-----w c:\documents and settings\LocalService\Menu Start
2009-04-28 07:07 . 2009-04-28 07:07 -------- d-----w c:\windows\peernet
2009-04-28 07:07 . 2009-04-28 07:07 -------- d-----w c:\windows\provisioning
2009-04-28 07:04 . 2009-04-28 07:04 -------- d-----w c:\windows\ServicePackFiles
2009-04-28 06:56 . 2009-04-28 06:56 -------- d-----w c:\windows\EHome
2009-04-27 18:44 . 2008-04-14 20:33 11264 ------w c:\windows\system32\spnpinst.exe
2009-04-27 18:44 . 2004-08-02 12:20 4569 ------w c:\windows\system32\secupd.dat
2009-04-20 05:34 . 2009-04-20 05:34 -------- d-----w c:\windows\Internet Logs
2009-04-20 05:33 . 2009-04-20 05:33 267152 ----a-w c:\program files\zaSetup_en.exe
2009-04-19 19:34 . 2009-04-19 19:34 -------- d-----w c:\documents and settings\All Users\Application Data\NortonInstaller
2009-04-19 19:33 . 2009-04-19 19:33 3063218 ----a-w c:\program files\Norton_Removal_Tool.exe
2009-04-17 19:26 . 2009-04-28 09:47 37016 ----a-w c:\documents and settings\An Boel\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-17 19:24 . 2009-04-17 19:24 7417544 ----a-w c:\program files\INSTALL_MSN_MESSENGER_DL.EXE
2009-04-17 19:21 . 2009-04-17 19:21 -------- d-sh--w C:\Recycled
2009-04-17 19:17 . 2009-04-17 19:17 -------- d-----w c:\program files\Trader's Little Helper
2009-04-17 19:17 . 2009-04-17 19:17 1428679 ----a-w c:\program files\tralih241160.exe
2009-04-17 19:15 . 2009-04-17 19:15 23244 ----a-w c:\program files\xmp-flac.zip
2009-04-17 19:14 . 2009-04-17 19:14 109794 ----a-w c:\program files\Flac_Plugin_for_WA2.exe
2009-04-17 19:14 . 2009-04-17 19:14 -------- d-----w c:\program files\Tag Support Plugin for Media Player
2009-04-17 19:14 . 2009-04-17 19:14 1069777 ----a-w c:\program files\WMPTagSupport11.exe
2009-04-17 19:10 . 2009-04-17 19:10 272688 ----a-w c:\program files\utorrent.exe
2009-04-17 19:09 . 2009-04-17 19:09 -------- d-----w c:\program files\uTorrent
2009-04-17 19:09 . 2009-04-17 19:09 -------- d-----w c:\documents and settings\An Boel\Application Data\uTorrent
2009-04-17 19:09 . 2009-04-17 19:09 281904 ----a-w c:\program files\utorrent-1.8.3-beta-15104.upx.exe
2009-04-17 19:02 . 2009-04-17 19:02 -------- d-----w c:\program files\MSECache
2009-04-17 19:02 . 2009-04-17 19:02 28764616 ----a-w c:\program files\FileFormatConverters.exe
2009-04-17 18:51 . 2008-04-14 17:02 1092096 ----a-w c:\windows\system32\esent.dll
2009-04-17 18:51 . 2009-04-17 18:51 -------- d-----w c:\documents and settings\All Users\Application Data\Brother

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-01 06:29 . 1979-12-31 22:00 78294 ----a-w c:\windows\system32\perfc013.dat
2009-05-01 06:29 . 1979-12-31 22:00 458016 ----a-w c:\windows\system32\perfh013.dat
2009-05-01 06:18 . 2003-09-02 09:32 84023 ----a-w c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-04-17 19:12 . 2009-04-17 19:12 -------- d-----w c:\program files\Winamp
2009-04-17 19:12 . 2009-04-17 19:11 9914224 ----a-w c:\program files\winamp5551_full_emusic-7plus_en-us.exe
2009-04-17 19:02 . 2009-04-17 19:02 386938880 ----a-w c:\program files\xpsp3_5512.080413-2113_nl_x86fre_spcd.iso
2009-04-17 18:21 . 2009-04-17 18:21 5058 ----a-w c:\windows\Help\hhcolreg.dat
2009-03-06 14:23 . 1979-12-31 22:00 285696 ----a-w c:\windows\system32\pdh.dll
2009-02-20 08:12 . 2006-06-23 11:29 669184 ----a-w c:\windows\system32\wininet.dll
2009-02-20 08:12 . 2004-08-04 08:03 81920 ------w c:\windows\system32\ieencode.dll
2009-02-10 17:10 . 2002-09-09 11:17 2070400 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 14:08 . 1979-12-31 22:00 1846912 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:27 . 1979-12-31 22:00 2193408 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:27 . 1979-12-31 22:00 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:56 . 2005-07-26 04:39 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:56 . 1979-12-31 22:00 734208 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:56 . 1979-12-31 22:00 684544 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:56 . 1979-12-31 22:00 735744 ----a-w c:\windows\system32\ntdll.dll
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}]
2009-04-09 18:09 688128 ----a-w c:\program files\Dealio Toolbar\DealioToolbarIE.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-10-16 16:22 333192 ----a-w c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-16 333192]
"{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}"= "c:\program files\Dealio Toolbar\DealioToolbarIE.dll" [2009-04-09 688128]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CLASSES_ROOT\clsid\{01398b87-61af-4ffb-9ab5-1a1c5fb39a9c}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-16 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2002-11-15 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2002-11-18 561152]
"LManager"="c:\progra~1\LAUNCH~1\QtZpAcer.EXE" [2003-08-22 282624]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-03-09 37888]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-31 385024]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-15 981384]
"VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2003-05-07 36864]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2003-05-14 55296]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2003-04-01 88267]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-5-10 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [28/04/2009 11:41 464264]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [28/04/2009 10:40 55152]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [14/01/2009 17:53 226656]
R3 rtl8180;Realtek RTL8180 Wireless LAN (Mini-)PCI NIC NT Driver;c:\windows\system32\drivers\rtl8180.sys [2/09/2003 12:06 173184]
S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [6/02/2009 18:08 533360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4867d070-3bf8-11de-8d62-000b6b281a9f}]
\Shell\AutoRun\command - F:\EXPLORER.EXE
\Shell\explore\Command - F:\EXPLORER.EXE
\Shell\open\Command - F:\EXPLORER.EXE
.
- - - - ORPHANS VERWIJDERD - - - -

HKCU-Run-wsctf.exe - wsctf.exe
HKLM-Run-Blubster - c:\program files\Blubster\Blubster.exe


.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.be/
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-05-10 09:47
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
Voltooingstijd: 2009-05-10 9:48
ComboFix-quarantined-files.txt 2009-05-10 07:48

Pre-Run: 13.829.521.408 bytes beschikbaar
Post-Run: 14.661.877.760 bytes beschikbaar

WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

256 --- E O F --- 2009-05-01 09:03

Open Kladblok, kopieer en plak het volgende (vetgedrukte, blauwe tekst) in een leeg venster:


Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{4867d070-3bf8-11de-8d62-000b6b281a9f}]



Sla dit op op je Bureaublad als CFScript.txt.

Sleep CFScript.txt in ComboFix.exe zoals getoond in onderstaand voorbeeld :




Dit zal ComboFix doen herstarten.

Na het herstarten van je computer, (indien het vraagt om te herstarten), kopieer en plak de inhoud van log.txt in je volgende antwoord.

Kan het dat dit programma er voor gezorgd heeft dat mijn USB-Stick niet meer herkent wordt?

Thanks

Mmmm, de USB-stick wordt ook niet meer in andere PC's herkent

Als het goed is word je stick gewoon weer opnieuw geinstalleerd.

Nog niet zal er eens naar moeten kijken.

Deze Thread mag verder gesloten worden. Alles werkt trg perfect geen pop-ups meer, etc...

Echt bedankt!