Archief - Een mogelijk virus of iets gelijkaardig.

Beste forumgangers,

Bij deze denk ik dat ik met een virus zit of iets gelijkaardig. De oorzaak van dit alles heeft te maken met een USB-stick. Ik was gisteren bij een vriend van me en had een USB-stick bij en om 1 of andere reden kon de stick niet geopend worden op zijn laptop.

Vervolgens heb ik de stick thuis getest en voor ik het nog goed en wel besefte kreeg ik een aantal errors, een blue screen van nog geen seconde en een reboot tot gevolg.

Na de reboot kwam ik tot de vaststelling dat ik rechtermuisknop in start programs niet meer kan gebruiken, dat hidden files niet meer bekijkbaar zijn onder windows, dat bepaalde sites niet meer willen openen waaronder www.google.com, www.gmail.com, www.loveno.be, www.edpnet.be enz.

Ik heb vervolgens AVG laten lopen weliswaar niet in safe modus maar een standaard fast system scan en daar vond hij enkel cookies en niets meer dan dat. Vervolgens ben ik Nod32 aan het runnen en daar vind hij al meer dan 15000 infected files.

Nog een aantal oorzaken zijn dat mijn computer traag opstart en mijn DVD-Writer heel lang nodig heeft om een cd of dvd te accepteren.

Ik weet niet met welk virus, trojan of spyware we hier te maken hebben maar alle hulp is welkom.

Bij deze alvast een HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:15:53, on 3/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\java\javaifx4\services.exe
C:\WINDOWS\java\javaifx4\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HybridTM_IR(A)\RC620_A.exe
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\Pidgin\pidgin.exe
C:\Program Files\Foobar2000\foobar2000.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20www.9lives.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {00F9D891-64C4-49A5-9595-BEAEFE1BF207} - C:\WINDOWS\system32\ddcCVPFy.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7F3EA905-DE65-4D00-BC1F-FF3A77F8CA30} - C:\WINDOWS\system32\opnlKCVm.dll
O4 - HKLM\..\Run: [HybridTM_A] C:\Program Files\HybridTM_IR(A)\RC620_A.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [6cb4ada5] rundll32.exe "C:\WINDOWS\system32\lrqdbbkq.dll",b
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [BM6f879e39] Rundll32.exe "C:\WINDOWS\system32\osgyunuh.dll",s
O4 - Global Startup: TMMonitor.lnk = C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: opnlKCVm - C:\WINDOWS\SYSTEM32\opnlKCVm.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: JavaIFX4 - Unknown owner - C:\WINDOWS\java\javaifx4\services.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Parallels DHCP Service for Virtual NIC (PRLDHCP) - Parallels Software International, Inc. - C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe (file missing)
O23 - Service: SessionLauncher - Unknown owner - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLauncher.exe (file missing)
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 4709 bytes

Greetz Cyaankali

Een term met bijbehorende file die sterk geviseerd wordt in Nod32 is application Win32/Adware.Virtumonde found in operating memory. System memory infection originated from file C:\WINDOWS\system32\ddcCVPFy.dll.

Het downloaden van files is ook niet mogelijk op dit moment.

Greetz Cyaankali

Update: Ik heb Malwarebytes' Anti-Malware geinstalleerd en laten lopen en het positieve van de zaak is is dat ik terug alle sites kan bekijken en kan dowloaden.

De overige problemen zijn nog niet opgelost zoals rechtermuisknop in start programs, het bekijken van hidden files en de DVD-Writer.

Ik zal alvast een logje plaatsen van Malwarebytes' Anti-Malware en een log van HijackThis.

Greetz Cyaankali


Malwarebytes' Anti-Malware 1.11
Database version: 711

Scan type: Quick Scan
Objects scanned: 33448
Time elapsed: 29 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 13
Registry Values Infected: 2
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\ddcCVPFy.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\lrqdbbkq.dll (Trojan.Vundo) -> Unloaded module successfully.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00f9d891-64c4-49a5-9595-beaefe1bf207} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{00f9d891-64c4-49a5-9595-beaefe1bf207} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{50ccd00a-66b6-4d95-aaef-8ee959498f92} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7f3ea905-de65-4d00-bc1f-ff3a77f8ca30} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7f3ea905-de65-4d00-bc1f-ff3a77f8ca30} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{7f3ea905-de65-4d00-bc1f-ff3a77f8ca30} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM6f879e39 (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\ddccvpfy -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\ddccvpfy -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\ddcCVPFy.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\yFPVCcdd.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yFPVCcdd.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lrqdbbkq.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\qkbbdqrl.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\osgyunuh.dll (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Administrator\Application Data\Microsoft\spoolsv.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:52:27, on 3/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HybridTM_IR(A)\RC620_A.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\java\javaifx4\services.exe
C:\WINDOWS\java\javaifx4\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Pidgin\pidgin.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20www.9lives.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [HybridTM_A] C:\Program Files\HybridTM_IR(A)\RC620_A.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [6cb4ada5] rundll32.exe "C:\WINDOWS\system32\lrqdbbkq.dll",b
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - Global Startup: TMMonitor.lnk = C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: opnlKCVm - opnlKCVm.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: JavaIFX4 - Unknown owner - C:\WINDOWS\java\javaifx4\services.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Parallels DHCP Service for Virtual NIC (PRLDHCP) - Parallels Software International, Inc. - C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe (file missing)
O23 - Service: SessionLauncher - Unknown owner - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLauncher.exe (file missing)
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 4460 bytes

Cyaankali zei:

Een term met bijbehorende file die sterk geviseerd wordt in Nod32 is application Win32/Adware.Virtumonde found in operating memory. System memory infection originated from file C:\WINDOWS\system32\ddcCVPFy.dll.

Het downloaden van files is ook niet mogelijk op dit moment.

Greetz Cyaankali

Klik om te vergroten...

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

Zo gezegd zo gedaan:

Combofix:

ComboFix 08-05-01.3 - Administrator 2008-05-05 2:38:34.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2093 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\ddcCVPFy.dll
C:\WINDOWS\system32\lrqdbbkq.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mtujtkpv.ini
C:\WINDOWS\system32\osgyunuh.dll
F:\Autorun.inf
G:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-04-05 to 2008-05-05 )))))))))))))))))))))))))))))))
.

2008-05-03 18:04 . 2008-05-03 18:04 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-05-03 18:03 . 2008-05-03 18:03 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-03 18:03 . 2008-05-03 18:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-03 17:16 . 2008-05-03 17:16 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-05-03 14:49 . 2008-05-03 18:36 <DIR> d-------- C:\Program Files\Eset
2008-05-03 14:49 . 2008-05-03 14:49 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2008-05-03 14:49 . 2008-05-03 14:49 298,104 --a------ C:\WINDOWS\system32\imon.dll
2008-05-03 14:49 . 2008-05-03 14:49 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2008-05-01 16:10 . 2008-05-03 18:31 109,784 --a------ C:\WINDOWS\BM6f879e39.xml
2008-04-30 12:53 . 2008-05-04 02:41 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2008-04-27 04:25 . 2008-04-27 04:25 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\K-Ninja
2008-04-27 04:25 . 2008-04-27 04:25 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\K-Meleon
2008-04-26 03:00 . 2008-05-03 15:13 <DIR> d--h----- C:\WINDOWS\FlyakiteOSX
2008-04-26 03:00 . 2004-08-04 14:00 218,624 --a--c--- C:\WINDOWS\system32\uxtheme.backup
2008-04-24 04:05 . 2008-05-05 00:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TrackMania
2008-04-23 19:00 . 2008-04-23 19:00 <DIR> d-------- C:\Program Files\iTunes
2008-04-23 19:00 . 2008-04-23 19:00 <DIR> d-------- C:\Program Files\iPod
2008-04-23 19:00 . 2008-04-23 19:00 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-04-22 17:44 . 2008-01-16 15:19 51,712 --a--c--- C:\WINDOWS\system32\drivers\hypervisor.sys
2008-04-22 17:44 . 2008-01-16 15:22 28,800 --a--c--- C:\WINDOWS\system32\drivers\pvs.sys
2008-04-22 17:44 . 2008-01-16 15:20 22,752 --a--c--- C:\WINDOWS\system32\drivers\pvsusb.sys
2008-04-22 17:44 . 2008-01-16 15:22 13,344 --a--c--- C:\WINDOWS\system32\drivers\pvspth.sys
2008-04-22 17:44 . 2008-01-16 15:22 12,310 --a------ C:\WINDOWS\system32\drivers\pvsnet.sys
2008-04-22 17:44 . 2008-01-16 15:20 8,320 --a--c--- C:\WINDOWS\system32\drivers\PvsUM.sys
2008-04-22 17:43 . 2008-04-22 17:43 <DIR> d-------- C:\Program Files\Parallels
2008-04-22 17:40 . 2008-01-16 15:20 4,412 --a------ C:\WINDOWS\system32\drivers\pvsvnic.sys
2008-04-21 12:35 . 2008-04-21 12:35 94,208 --a------ C:\WINDOWS\ScUnin.exe
2008-04-21 12:35 . 2008-04-21 12:35 10,494 --a--c--- C:\WINDOWS\scunin.dat
2008-04-21 12:35 . 2008-04-21 12:35 967 --a--c--- C:\WINDOWS\ScUnin.pif
2008-04-18 17:36 . 2008-04-18 17:36 0 --ah-c--- C:\Documents and Settings\NetworkService\NTUSER.DAT_TU_20153.LOG
2008-04-18 17:36 . 2008-04-18 17:36 0 --ah-c--- C:\Documents and Settings\LocalService\NTUSER.DAT_TU_10597.LOG
2008-04-18 17:36 . 2008-04-18 17:36 0 --ah-c--- C:\Documents and Settings\Administrator\NTUSER.DAT_TU_78735.LOG
2008-04-18 16:44 . 2008-04-18 16:47 <DIR> d-------- C:\WINDOWS\UbiSoft
2008-04-10 14:22 . 2008-04-10 14:22 <DIR> d-------- C:\Program Files\HD Tune

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-05 00:37 --------- d-----w C:\Documents and Settings\Administrator\Application Data\.purple
2008-05-04 20:40 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-05-04 19:14 --------- d-----w C:\Documents and Settings\Administrator\Application Data\foobar2000
2008-05-04 00:40 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Skype
2008-05-01 02:39 --------- d-----w C:\Program Files\mIRC
2008-05-01 02:37 --------- d-----w C:\Program Files\Soulseek
2008-04-30 10:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-23 17:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-04-23 16:59 --------- d-----w C:\Program Files\QuickTime Alternative
2008-04-22 15:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\VMware
2008-04-22 15:34 --------- d-----w C:\Documents and Settings\Administrator\Application Data\VMware
2008-04-20 00:06 --------- d-----w C:\Program Files\FlashFXP
2008-04-19 00:32 --------- d-----w C:\Documents and Settings\Administrator\Application Data\gtk-2.0
2008-04-16 15:53 --------- d-----w C:\Program Files\The GodFather
2008-04-02 15:10 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Talkback
2008-03-30 12:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-30 12:37 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-03-29 15:32 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-03-29 15:32 --------- d-----w C:\Documents and Settings\Administrator\Application Data\SystemRequirementsLab
2008-03-29 15:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-29 02:00 --------- d-----w C:\Documents and Settings\Administrator\Application Data\ICQ
2008-03-19 22:26 --------- d-----w C:\Program Files\Common Files\Skype
2008-03-12 21:13 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2007-10-15 10:35 22,328 -c--a-w C:\Documents and Settings\Administrator\Application Data\PnkBstrK.sys
2007-08-21 11:03 138,220 -c--a-w C:\Documents and Settings\All Users\Application Data\firstlsp.reg.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HybridTM_A"="C:\Program Files\HybridTM_IR(A)\RC620_A.exe" [2006-04-24 05:43 106496]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
"DeathAdder"="C:\Program Files\Razer\DeathAdder\razerhid.exe" [2007-09-07 15:54 159744]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-05-03 14:49 949376]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
TMMonitor.lnk - C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe [2007-11-06 02:40:30 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"nwiz"=nwiz.exe /install
"nForce Tray Options"=sstray.exe /r
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"QuickTime Task"="C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\BitLord\\BitLord.exe"=
"C:\\Program Files\\Soulseek\\slsk.exe"=
"C:\\WINDOWS\\java\\javaifx4\\spoolsv.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\WINDOWS\\system32\\svchost.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1024:TCP"= 1024:TCPpoolsv

R0 Si3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\si3112r.sys [2006-01-12 13:56]
R2 hypervisor;Parallels Hypervisor;C:\WINDOWS\system32\drivers\hypervisor.sys [2008-01-16 15:19]
R2 JavaIFX4;JavaIFX4;C:\WINDOWS\java\javaifx4\services.exe [2006-10-17 14:04]
R2 PRLDHCP;Parallels DHCP Service for Virtual NIC;C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe [2008-01-16 15:22]
R2 pvs;Parallels Kernel Driver;C:\WINDOWS\system32\drivers\pvs.sys [2008-01-16 15:22]
R2 pvsnet;Parallels Network Driver;C:\WINDOWS\system32\DRIVERS\pvsnet.sys [2008-01-16 15:22]
R2 pvspth;Parallels Passthrough Driver;C:\WINDOWS\system32\drivers\pvspth.sys [2008-01-16 15:22]
R2 pvsum;Parallels USB Manager;C:\WINDOWS\system32\drivers\pvsum.sys [2008-01-16 15:20]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2007-11-16 17:04]
R3 DAdderFltr;DeathAdder Mouse;C:\WINDOWS\system32\drivers\dadder.sys [2007-08-02 17:32]
R3 PVSVNIC;Parallels Virtual NIC Driver;C:\WINDOWS\system32\DRIVERS\pvsvnic.sys [2008-01-16 15:20]
R3 TridDev;Freecom USB Hybrid TV Device;C:\WINDOWS\system32\DRIVERS\Triddev.sys [2005-04-26 23:01]
R3 TridVid;Freecom USB Hybrid TV Receiver;C:\WINDOWS\system32\DRIVERS\TridVid.sys [2006-04-04 23:15]
S2 RoxLiveShare10;LiveShare P2P Server 10;"C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe" []
S3 CyUsb;Cypress Generic USB Driver;C:\WINDOWS\system32\Drivers\CyUsb.sys [2005-03-03 19:47]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-03-12 23:13]
S4 SessionLauncher;SessionLauncher;C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLauncher.exe []

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0457cd89-bee1-11db-aceb-000c6e11f6e7}]
\Shell\Auto\command - K:\sxs.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57b65e3d-be98-11db-9c8a-806d6172696f}]
\Shell\AutoRun\command - L:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79de14b4-dc33-11dc-9262-806d6172696f}]
\Shell\AutoRun\command - H:\Bin\asusqfe.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6778F1EE-80BB-4F27-BC69-F91B843782CD}]
C:\Documents and Settings\Administrator\Application Data\Microsoft\cfgmgr.vbs
.
Contents of the 'Scheduled Tasks' folder
"2008-05-05 00:43:10 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-05 02:43:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\java\javaifx4\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-05-05 2:48:56 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-05 00:48:26

Pre-Run: 4,825,186,304 bytes free
Post-Run: 4,818,657,280 bytes free

182 --- E O F --- 2008-04-12 23:32:18


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:50:56, on 5/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HybridTM_IR(A)\RC620_A.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\java\javaifx4\services.exe
C:\WINDOWS\java\javaifx4\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Pidgin\pidgin.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20www.9lives.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [HybridTM_A] C:\Program Files\HybridTM_IR(A)\RC620_A.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - Global Startup: TMMonitor.lnk = C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: JavaIFX4 - Unknown owner - C:\WINDOWS\java\javaifx4\services.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Parallels DHCP Service for Virtual NIC (PRLDHCP) - Parallels Software International, Inc. - C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe (file missing)
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 4197 bytes

Greetz Cyaankali

* Download OTMoveIt.exe en plaats het op je bureaublad:
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

* Open OTMoveIt.exe.
In het linkerpaneel, waar het zegt: "Paste List of Files/Folders to be Moved" ,kopieer en plak onderstaand gedeelte:

C:\WINDOWS\BM6f879e39.xml

Daarna klik de MoveIt knop onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in volgende map: C:\_OTMoveIt\MovedFiles.
Kopieer en plak de inhoud van die log in je volgende post met een nieuw hijackthis logje..

C:\WINDOWS\BM6f879e39.xml moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 05062008_031621


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:19:02, on 6/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HybridTM_IR(A)\RC620_A.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\java\javaifx4\services.exe
C:\WINDOWS\java\javaifx4\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Pidgin\pidgin.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\BitLord\BitLord.exe
C:\Program Files\Soulseek\slsk.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Program%20www.9lives.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [HybridTM_A] C:\Program Files\HybridTM_IR(A)\RC620_A.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - Global Startup: TMMonitor.lnk = C:\Program Files\ArcSoft\TotalMedia\TMMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: JavaIFX4 - Unknown owner - C:\WINDOWS\java\javaifx4\services.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Parallels DHCP Service for Virtual NIC (PRLDHCP) - Parallels Software International, Inc. - C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe (file missing)
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 4175 bytes

Greetz Cyaankali

Ziet er goed uit, zijn er nog problemen?

Hoi Jurgenv1,

Enkel rechtermuisknop bij start programs lukt nog niet. Voor de rest ziet alles er goed uit.

Greetz Cyaankali

Jurgenv1 zei:

Ziet er goed uit, zijn er nog problemen?

Klik om te vergroten...

Download Dial-a-fix via
http://wiki.djlizard.net/Dial-a-fix#Standard_version

Start Dial-A-Fix en in het hoofd-venster vink je alles aan en klik onderaan op 'Go'
Laat het tooltje zijn werk doen en herstart je pc, kijk of het dan gebeterd is.

Ik heb de applicatie laten draaien en kom tot de vaststelling dat mijn computer opnieuw sneller opstart. Alles is nu zo goed als correct buiten rechtermuisknop.

Op zich is dat niet zo een probleem want met linkermuisknop gaat het wel. Het enige dat me nog zorgen baart is dat mijn cd's en dvd's niet altijd herkend worden door mijn Nec DVD-writer.

Alvast bedankt voor alle gedane moeite Jurgenv1.

Greetz Cyaankali

Hoi Jurgenv1,

Met alle respect maar na een update uitgevoerd te hebben van Windows XP is het nog erger geworden. Al mijn applicaties in start programs zijn weg en ik kan geen enkel programma starten vanuit de Quick Launch.

De windows update opties bij start programs zijn ook weg en o.a. mijn icoontjes van my computer en network en nog iets waarvan ik niet weet wat het is worden aanzien als standaard witte files met als benaming folder.

Er zijn nog heel wat problemen zoals ik kan niet in configuratiescherm via start programs en als ik explore dan zie ik configuratiescherm wel maar ook dit segment wordt aanzien als een standaard witte folder. Mijn printerfolder eveneens.

Er zou een mogelijkheid moeten zijn om mijn systeem te refreshen of tenminste wat deze zaken betreft.

Mijn excuses voor al deze ongemakken maar ik zou niet weten aan wat het ligt.

Greetz Cyaankali

Cyaankali zei:

Ik heb de applicatie laten draaien en kom tot de vaststelling dat mijn computer opnieuw sneller opstart. Alles is nu zo goed als correct buiten rechtermuisknop.

Op zich is dat niet zo een probleem want met linkermuisknop gaat het wel. Het enige dat me nog zorgen baart is dat mijn cd's en dvd's niet altijd herkend worden door mijn Nec DVD-writer.

Alvast bedankt voor alle gedane moeite Jurgenv1.

Greetz Cyaankali

Klik om te vergroten...

Mss is het gewoon verstandiger om een format C uit te voeren...

Hoi Jurgenv1,

Alvast bedankt voor alle gedane moeite maar ik ga het zo laten. In september ben ik van plan van mij een nieuw systeem te kopen en van deze huidige pc een Ubuntu Server te maken.

Ik ben dus niet van plan om nog veel moeite te steken in dit systeem.

Greetz Cyaankali

Mss weten ze in het software forum nog wel raad?