Archief - log check...

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
C

COOLKILLer

Legacy Member
Ik heb wat last met pc, ik krijg veel popups en pc gaat traaaaag :doh:

Hier is hijackthis-log:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 9:14:16, on 17/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
D:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE
C:\Program Files\CyberLink\PowerVCRII\RemoteAgent.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\Program Files\VMware\VMware Workstation\vmware-tray.exe
D:\Program Files\VMware\VMware Workstation\hqtray.exe
C:\WINDOWS\system32\RunDLL32.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
D:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
C:\Documents and Settings\Stephen\Desktop\HiJackThis_v2.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: BitAccelerator module - {92860A02-4D69-48c1-82D7-EF6B2C609502} - C:\Program Files\BitAccelerator\BitAccelerator.dll
O2 - BHO: Knight Online Toolbar Helper - {9D006D63-579B-4D77-9C12-15623661ADDA} - C:\Program Files\Knight Online Toolbar\v3.2.0.0\Knight_Online_Toolbar.dll (file missing)
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Knight Online Toolbar - {E7D38ED4-2933-43B8-B0B9-52D11CE9CA10} - C:\Program Files\Knight Online Toolbar\v3.2.0.0\Knight_Online_Toolbar.dll (file missing)
O3 - Toolbar: NuSphere ToolBar - {0F62D223-9206-4EA3-9EA8-D0F3C7C82ACA} - C:\Program Files\nusphere\phped\nubar\NuSphereIEBar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus C66 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB001" /M "Stylus C66"
O4 - HKLM\..\Run: [Agent] C:\Program Files\CyberLink\PowerVCRII\Agent.exe
O4 - HKLM\..\Run: [Remote_Agent] C:\Program Files\CyberLink\PowerVCRII\RemoteAgent.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [vmware-tray] D:\Program Files\VMware\VMware Workstation\vmware-tray.exe
O4 - HKLM\..\Run: [VMware hqtray] "D:\Program Files\VMware\VMware Workstation\hqtray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AAWTray] D:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [Ad-Watch] D:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1159470191577
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1159470184498
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: 334748 - {00000222-1111-1234-4321-0A1B2C3D4E99} - s4728w32.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - D:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - D:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

--
End of file - 8718 bytes
J

Jurgenv1

Legacy Member
Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.
C

COOLKILLer

Legacy Member
combofix-log:

ComboFix 07-09-17.2 - "Stephen" 2007-09-17 22:09:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.27.1033.18.641 [GMT 2:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\a.exe

.
((((((((((((((((((((((((( Files Created from 2007-08-17 to 2007-09-17 )))))))))))))))))))))))))))))))
.

2007-09-17 22:09 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-17 16:40 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-09-17 16:39 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-09-17 16:37 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-09-17 12:50 <DIR> d-------- C:\Program Files\Everest Poker
2007-09-17 09:13 <DIR> d-------- C:\DOCUME~1\Stephen\APPLIC~1\spam iso live
2007-09-17 09:03 674,600 --a------ C:\WINDOWS\system32\pbsvc.exe
2007-09-16 19:04 <DIR> d-------- C:\DOCUME~1\Mathias\APPLIC~1\spam iso live
2007-09-16 19:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-16 17:35 <DIR> d-------- C:\Program Files\spam iso live
2007-09-16 17:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Book Slow Axis Web
2007-09-10 19:08 <DIR> d-------- C:\DOCUME~1\Mathias\APPLIC~1\Skype
2007-09-10 18:17 <DIR> d-------- C:\DOCUME~1\Sonja\Contacts
2007-09-10 18:17 <DIR> d-------- C:\DOCUME~1\Sonja\APPLIC~1\Skype
2007-09-09 14:35 <DIR> d-------- C:\Program Files\Skype
2007-09-09 14:35 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-09-09 14:35 <DIR> d-------- C:\DOCUME~1\Stephen\APPLIC~1\Skype
2007-09-09 14:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-09-06 13:15 <DIR> d-------- C:\New Folder
2007-09-06 12:48 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2007-09-06 12:25 <DIR> d-------- C:\pnp
2007-09-03 22:25 <DIR> d-------- C:\DOCUME~1\Ben\APPLIC~1\Logitech
2007-09-01 12:02 <DIR> d-------- C:\Program Files\AC3Filter
2007-08-27 23:16 <DIR> d-------- C:\Program Files\ConnectionServices
2007-08-26 21:06 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2007-08-25 12:53 <DIR> d-------- C:\DOCUME~1\Sonja\APPLIC~1\Logitech
2007-08-23 21:47 297,984 --a------ C:\WINDOWS\system32\midas.dll
2007-08-23 21:46 <DIR> d-------- C:\Program Files\nusphere
2007-08-23 20:46 <DIR> d--hs---- C:\DOCUME~1\ALLUSE~1\APPLIC~1\.nusphere
2007-08-23 20:24 <DIR> d-------- C:\DOCUME~1\Mathias\APPLIC~1\uTorrent
2007-08-23 15:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-08-21 10:09 <DIR> d-------- C:\DOCUME~1\Stephen\APPLIC~1\Real
2007-08-21 10:09 <DIR> d-------- C:\DOCUME~1\Stephen\APPLIC~1\Media Player Classic
2007-08-19 17:04 <DIR> d-------- C:\DOCUME~1\Stephen\APPLIC~1\Wireshark
2007-08-19 16:45 <DIR> d-------- C:\Program Files\Common Files\SourceTec

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-17 09:38 --------- d-------- C:\Program Files\Investintech.com Inc
2007-09-17 09:36 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Corporation
2007-09-17 09:28 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\VMware
2007-09-17 08:29 --------- d-------- C:\DOCUME~1\Stephen\APPLIC~1\VMware
2007-09-17 08:27 --------- d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\VMware
2007-09-16 19:01 --------- d-------- C:\Program Files\MSN Messenger
2007-09-16 18:59 --------- d-------- C:\DOCUME~1\Mathias\APPLIC~1\VMware
2007-09-16 18:56 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-09-16 13:53 --------- d-------- C:\DOCUME~1\Sonja\APPLIC~1\VMware
2007-09-09 15:04 --------- d-------- C:\DOCUME~1\Stephen\APPLIC~1\LimeWire
2007-09-03 22:25 --------- d-------- C:\DOCUME~1\Ben\APPLIC~1\VMware
2007-08-27 23:14 --------- d-------- C:\DOCUME~1\Stephen\APPLIC~1\uTorrent
2007-08-23 20:46 --------- d--hs---- C:\DOCUME~1\ALLUSE~1\APPLIC~1\.nusphere
2007-08-23 20:23 --------- d-------- C:\Program Files\uTorrent Extreme Leecher Edition
2007-08-23 15:39 --------- d-------- C:\Program Files\Common Files\Logitech
2007-08-19 16:51 --------- d-------- C:\Program Files\WinPcap
2007-08-15 11:37 --------- d-------- C:\DOCUME~1\Sonja\APPLIC~1\NetPumper
2007-08-13 22:23 --------- d-------- C:\Program Files\Real Alternative
2007-08-13 22:23 --------- d-------- C:\Program Files\Media Player Classic
2007-08-13 22:23 --------- d-------- C:\DOCUME~1\Mathias\APPLIC~1\Real
2007-08-13 22:23 --------- d-------- C:\DOCUME~1\Mathias\APPLIC~1\Media Player Classic
2007-08-13 22:23 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
2007-08-13 20:00 --------- d-------- C:\DOCUME~1\Mathias\APPLIC~1\NetPumper
2007-08-13 19:25 4096 --a------ C:\WINDOWS\spload.dll
2007-08-13 19:25 3328 --a------ C:\WINDOWS\system32\s887601.sys
2007-08-13 19:25 3072 --a------ C:\WINDOWS\s4728w32.dll
2007-08-13 19:25 20 --a------ C:\syshgwu.exe.bat
2007-08-13 17:04 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-11 15:34 --------- d-------- C:\DOCUME~1\Sonja\APPLIC~1\vlc
2007-08-10 12:36 --------- d-------- C:\DOCUME~1\Mathias\APPLIC~1\vlc
2007-08-07 13:58 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-03 10:15 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
2007-07-31 13:57 --------- d-------- C:\Program Files\Knight Online
2007-07-30 14:13 --------- d-------- C:\Program Files\Joost
2007-07-30 13:51 --------- d-------- C:\DOCUME~1\Stephen\APPLIC~1\Joost
2007-07-30 13:05 --------- d-------- C:\DOCUME~1\Stephen\APPLIC~1\Opera
2007-06-29 02:01 88696 --a------ C:\WINDOWS\system32\Packet.dll
2007-06-29 02:01 68224 --a------ C:\WINDOWS\system32\WanPacket.dll
2007-06-29 02:01 53299 --a------ C:\WINDOWS\system32\pthreadVC.dll
2007-06-29 02:01 240240 --a------ C:\WINDOWS\system32\wpcap.dll
2007-06-24 18:26 286720 --a------ C:\WINDOWS\system32\cnvshell.dll
2001-03-28 12:02 122880 --a------ C:\WINDOWS\inf\AGFA\message.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-18 14:22]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\smax4.exe" [2006-05-18 14:26]
"NWEReboot"="" []
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 12:03 C:\WINDOWS\KHALMNPR.Exe]
"DU Meter"="C:\Program Files\DU Meter\DUMeter.exe" [2005-02-01 19:28]
"amd_dc_opt"="C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe" [2006-06-28 15:42]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"EPSON Stylus C66 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.exe" [2003-11-27 03:00]
"Agent"="C:\Program Files\CyberLink\PowerVCRII\Agent.exe" [2002-10-01 16:57]
"Remote_Agent"="C:\Program Files\CyberLink\PowerVCRII\RemoteAgent.exe" [2004-07-14 14:24]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-02-18 21:16]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-12-06 19:37]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 23:55]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2007-04-19 13:26 C:\WINDOWS\system32\nvmctray.dll]
"AAWTray"="D:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 15:53]
"Ad-Watch"="D:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" [2007-08-28 19:03]
"PKR Pal"="D:\Program Files\PKR\pkrpal.exe" [2007-09-17 12:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"Steam"="" []
"New owns"="C:\DOCUME~1\Stephen\APPLIC~1\SPAMIS~1\flapshim.exe" []

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-08-23 15:39:29]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

C:\DOCUME~1\Mathias\STARTM~1\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"334748"= {00000222-1111-1234-4321-0A1B2C3D4E99} - s4728w32.dll [ ]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Snelle start.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Snelle start.lnk
backup=C:\WINDOWS\pss\Adobe Reader Snelle start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DUSuperControler.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DUSuperControler.lnk
backup=C:\WINDOWS\pss\DUSuperControler.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

R1 ATITool;ATITool Overclocking Utility;C:\WINDOWS\system32\DRIVERS\ATITool.sys
R1 Ext2fs;Ext2fs;C:\WINDOWS\system32\DRIVERS\ext2fs.sys
R1 IfsDrives;IfsDrives;C:\WINDOWS\system32\DRIVERS\IfsDrives.sys
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\C:\Program Files\CyberLink\PowerDVD\000.fcl
R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys
R2 PStrip;PStrip;C:\WINDOWS\system32\drivers\pstrip.sys
R2 Pv848;Hercules, SmartTV WDM Video Capture;C:\WINDOWS\system32\drivers\PH848.sys
R2 PVTUNER;ProVideo, PV-957 WDM TvTuner;C:\WINDOWS\system32\drivers\PHtuner.sys
R2 PVXBAR;Hercules, SmartTV WDM Crossbar;C:\WINDOWS\system32\drivers\PvXBAR.sys
R2 s887601.sys;s887601.sys;\??\C:\WINDOWS\system32\s887601.sys
R3 ADIDTSFiltService;ADI DTS Filter Service;C:\WINDOWS\system32\drivers\adidts.sys
R3 AmdTools;AMD Special Tools Driver;C:\WINDOWS\system32\DRIVERS\AmdTools.sys
R3 HomeQOS;HomeQOS Miniport;C:\WINDOWS\system32\DRIVERS\homeqos.sys
R4 vmkbd;VMware kbd;\??\C:\WINDOWS\system32\drivers\VMkbd.sys
S2 BT848;Bt878, WDM Video Capture;C:\WINDOWS\system32\drivers\BT848.sys
S2 BTTUNER;BtTuner, WDM TvTuner;C:\WINDOWS\system32\drivers\BTTUNER.sys
S2 BTXBAR;BtXBar, WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.sys
S3 Asushwio;Asushwio;\??\C:\WINDOWS\system32\drivers\Asushwio.sys
S3 nenum13E;nenum13E;\??\C:\DOCUME~1\Mathias\LOCALS~1\Temp\nenum13E.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys
S3 RivaTuner32;RivaTuner32;\??\D:\Program Files\RivaTuner v2.01\RivaTuner32.sys
S3 XDva002;XDva002;\??\C:\WINDOWS\system32\XDva002.sys
S3 XDva009;XDva009;\??\C:\WINDOWS\system32\XDva009.sys
S3 XDva010;XDva010;\??\C:\WINDOWS\system32\XDva010.sys
S3 XDva012;XDva012;\??\C:\WINDOWS\system32\XDva012.sys
S3 XDva013;XDva013;\??\C:\WINDOWS\system32\XDva013.sys
S3 XDva020;XDva020;\??\C:\WINDOWS\system32\XDva020.sys

*Newly Created Service* - AD-WATCH_CONNECT_FILTER
*Newly Created Service* - AD-WATCH_REAL-TIME_SCANNER
*Newly Created Service* - CATCHME
*Newly Created Service* - PNKBSTRA
.
Contents of the 'Scheduled Tasks' folder
"2007-09-17 20:00:00 C:\WINDOWS\Tasks\A3416D57914EE667.job"
- c:\docume~1\stephen\applic~1\spamis~1\Bodythunkinside.exe
"2007-02-19 10:00:00 C:\WINDOWS\Tasks\test.job"
- C:\kill.bat
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-17 22:12:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-09-17 22:13:30
C:\ComboFix-quarantined-files.txt ... 2007-09-17 22:12
.
--- E O F ---


ComboFix-quarantined-files:
Code: 
2007-01-12 21:37      34815    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\a.exe.vir


Folder PATH listing for volume C
Volume serial number is E0F4-F95B
C:\QOOBOX\QUARANTINE
+---C
|   +---ComboFix
|   \---WINDOWS
|       \---system32
|               a.exe.vir
|               
\---Registry_backups


Nieuw hijackthis-log:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:14:02, on 17/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE
C:\Program Files\CyberLink\PowerVCRII\RemoteAgent.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
D:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Stephen\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Knight Online Toolbar Helper - {9D006D63-579B-4D77-9C12-15623661ADDA} - C:\Program Files\Knight Online Toolbar\v3.2.0.0\Knight_Online_Toolbar.dll (file missing)
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Knight Online Toolbar - {E7D38ED4-2933-43B8-B0B9-52D11CE9CA10} - C:\Program Files\Knight Online Toolbar\v3.2.0.0\Knight_Online_Toolbar.dll (file missing)
O3 - Toolbar: NuSphere ToolBar - {0F62D223-9206-4EA3-9EA8-D0F3C7C82ACA} - C:\Program Files\nusphere\phped\nubar\NuSphereIEBar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus C66 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB001" /M "Stylus C66"
O4 - HKLM\..\Run: [Agent] C:\Program Files\CyberLink\PowerVCRII\Agent.exe
O4 - HKLM\..\Run: [Remote_Agent] C:\Program Files\CyberLink\PowerVCRII\RemoteAgent.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AAWTray] D:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [Ad-Watch] D:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKLM\..\Run: [PKR Pal] "D:\Program Files\PKR\pkrpal.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [New owns] C:\DOCUME~1\Stephen\APPLIC~1\SPAMIS~1\flapshim.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1159470191577
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1159470184498
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: 334748 - {00000222-1111-1234-4321-0A1B2C3D4E99} - s4728w32.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 7631 bytes
C

COOLKILLer

Legacy Member
C:\WINDOWS\spload.dll
Antivirus Versie Laatst geüpdatet Resultaat
AhnLab-V3 2007.9.18.0 2007.09.18 -
AntiVir 7.6.0.10 2007.09.18 TR/Agent.4096.133
Authentium 4.93.8 2007.09.18 -
Avast 4.7.1043.0 2007.09.17 Win32:Agent-KOB
AVG 7.5.0.485 2007.09.17 Generic6.LVP
BitDefender 7.2 2007.09.18 Generic.Malware.Fdld!!.27D4BF1B
CAT-QuickHeal 9.00 2007.09.17 -
ClamAV 0.91.2 2007.09.18 -
DrWeb 4.33 2007.09.18 -
eSafe 7.0.15.0 2007.09.17 -
eTrust-Vet 31.1.5142 2007.09.17 -
Ewido 4.0 2007.09.17 -
FileAdvisor 1 2007.09.18 -
Fortinet 3.11.0.0 2007.09.18 W32/Agent.275B!tr
F-Prot 4.3.2.48 2007.09.17 -
F-Secure 6.70.13030.0 2007.09.18 -
Ikarus T3.1.1.12 2007.09.18 Win32.SuspectCrc
Kaspersky 4.0.2.24 2007.09.18 -
McAfee 5121 2007.09.17 -
Microsoft 1.2803 2007.09.18 -
NOD32v2 2536 2007.09.18 -
Norman 5.80.02 2007.09.18 -
Panda 9.0.0.4 2007.09.17 Trj/Downloader.PWP
Prevx1 V2 2007.09.18 -
Rising 19.41.12.00 2007.09.18 -
Sophos 4.21.0 2007.09.18 -
Sunbelt 2.2.907.0 2007.09.15 -
Symantec 10 2007.09.18 -
TheHacker 6.2.5.061 2007.09.17 -
VBA32 3.12.2.4 2007.09.18 -
VirusBuster 4.3.26:9 2007.09.17 -
Webwasher-Gateway 6.0.1 2007.09.18 Trojan.Agent.4096.133

C:\WINDOWS\system32\s887601.sys
Antivirus Versie Laatst geüpdatet Resultaat
AhnLab-V3 2007.9.18.0 2007.09.18 -
AntiVir 7.6.0.10 2007.09.18 -
Authentium 4.93.8 2007.09.18 -
Avast 4.7.1043.0 2007.09.17 -
AVG 7.5.0.485 2007.09.17 Generic6.LVS
BitDefender 7.2 2007.09.18 Trojan.Webload.A
CAT-QuickHeal 9.00 2007.09.17 -
ClamAV 0.91.2 2007.09.18 -
DrWeb 4.33 2007.09.18 -
eSafe 7.0.15.0 2007.09.17 -
eTrust-Vet 31.1.5142 2007.09.17 -
Ewido 4.0 2007.09.17 -
FileAdvisor 1 2007.09.18 -
Fortinet 3.11.0.0 2007.09.18 -
F-Prot 4.3.2.48 2007.09.17 -
F-Secure 6.70.13030.0 2007.09.18 Trojan-Downloader.Win32.Small.frw
Ikarus T3.1.1.12 2007.09.18 Trojan.Webload.A
Kaspersky 4.0.2.24 2007.09.18 Trojan-Downloader.Win32.Small.frw
McAfee 5121 2007.09.17 -
Microsoft 1.2803 2007.09.18 -
NOD32v2 2536 2007.09.18 -
Norman 5.80.02 2007.09.18 -
Panda 9.0.0.4 2007.09.17 -
Prevx1 V2 2007.09.18 -
Rising 19.41.12.00 2007.09.18 -
Sophos 4.21.0 2007.09.18 -
Sunbelt 2.2.907.0 2007.09.15 -
Symantec 10 2007.09.18 -
TheHacker 6.2.5.061 2007.09.17 -
VBA32 3.12.2.4 2007.09.18 -
VirusBuster 4.3.26:9 2007.09.17 -
Webwasher-Gateway 6.0.1 2007.09.18 -

C:\WINDOWS\s4728w32.dll
Antivirus Versie Laatst geüpdatet Resultaat
AhnLab-V3 2007.9.18.0 2007.09.18 -
AntiVir 7.6.0.10 2007.09.18 -
Authentium 4.93.8 2007.09.18 -
Avast 4.7.1043.0 2007.09.17 -
AVG 7.5.0.485 2007.09.17 Generic6.LVU
BitDefender 7.2 2007.09.18 -
CAT-QuickHeal 9.00 2007.09.17 -
ClamAV 0.91.2 2007.09.18 -
DrWeb 4.33 2007.09.18 Trojan.Inject.363
eSafe 7.0.15.0 2007.09.17 -
eTrust-Vet 31.1.5142 2007.09.17 -
Ewido 4.0 2007.09.17 -
FileAdvisor 1 2007.09.18 -
Fortinet 3.11.0.0 2007.09.18 -
F-Prot 4.3.2.48 2007.09.17 -
F-Secure 6.70.13030.0 2007.09.18 -
Ikarus T3.1.1.12 2007.09.18 -
Kaspersky 4.0.2.24 2007.09.18 -
McAfee 5121 2007.09.17 -
Microsoft 1.2803 2007.09.18 -
NOD32v2 2536 2007.09.18 -
Norman 5.80.02 2007.09.18 -
Panda 9.0.0.4 2007.09.17 Trj/Inject.O
Prevx1 V2 2007.09.18 -
Rising 19.41.12.00 2007.09.18 -
Sophos 4.21.0 2007.09.18 -
Sunbelt 2.2.907.0 2007.09.15 -
Symantec 10 2007.09.18 -
TheHacker 6.2.5.061 2007.09.17 -
VBA32 3.12.2.4 2007.09.18 -
VirusBuster 4.3.26:9 2007.09.17 -
Webwasher-Gateway 6.0.1 2007.09.18 -
J

Jurgenv1

Legacy Member
Download OTMoveIt.exe en plaats het op je bureaublad:

Start OTMoveIt door dubbel te klikken op OTMoveIt.exe
In het linkerpaneel, waar het zegt: Paste List of Files/Folders to be Moved ,kopieer en plak je onderstaand gedeelte:

C:\WINDOWS\spload.dll
C:\WINDOWS\system32\s887601.sys
C:\WINDOWS\s4728w32.dll


Klik daarna op de knop MoveIt onderaan.
Wanneer voltooid zal het een log aanmaken (********_******.log -- de * staat voor datum en tijd) in de volgende map: C:\_OTMoveIt\MovedFiles.
Post de inhoud daarvan in je volgende bericht met een nieuw hijackthis logje.
C

COOLKILLer

Legacy Member
damn, nu bolt er niks meer fatsoenlijk
geluid werkt niet meer, pc gaat nog trager,...:doh: :doh: :doh:

Alles gaat er nu af, een verse windows zo nu en dan kan geen kwaad...

Toch bedankt voor uw hulp

grtz
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan