Archief - Optische stations uitgeschakeld

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
K

Krisse²1

Legacy Member
Yups,

kzit hier met een Acer Aspire 5020series laptop waarvan alle optische stations uitgeschakeld zijn, het gekke eraan is dat de "software-matige" daemon-tool emulator ook uitgeschakeld wordt. Dus is de DVDRW waarschijnlijk ook niet kapot.

* wordt herkent in bios
* wordt herkent in apparaatbeheer (en is ingeschakeld)
* rechts klikken en uitwerpen --> werkt
* verbodstekens errond (zie foto)

http://img75.imageshack.us/my.php?image=optischestationswerkenncx9.jpg

Heeft er dit al iemand gehad en beter: hoe kan ik dit uitschakelen??

Mvg,
Krisse²:woohoo:
K

Krisse²1

Legacy Member
Is het mogelijk bv. dat de gebruiker mss via "hardware veilig verwijderen" de dvdrw geselecteerd heeft en dat windows ze uitschakeld...
E

Exit

Legacy Member
neen want dan zijn ze na reboot er terug.

post eens een hjt logje hier.
mogelijks start er een progje/virus mee op die deze disabled
K

Krisse²1

Legacy Member
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:28:32, on 28/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\awServ.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
c:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: ads_optimizer - {26E45419-7205-4fac-BBFE-174BC7337A79} - C:\WINDOWS\system32\nsf285.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: rightonadz browser optimizer - {971C3384-F75E-4562-95B3-CBE7417529BC} - C:\WINDOWS\system32\gzmrotate.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Adssite Toolbar - {41C29B07-6F91-4966-91BE-2E2841643C83} - C:\Program Files\Adssite Advanced Toolbar\toolbar.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AMTray.exe] "C:\Acer\Empowering Technology\amtray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [hid_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Snelstart HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Acer\Empowering Technology\awServ.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Planner voor Automatische LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 9126 bytes


Ik kijk er wss over :crazy: maar ik zie nix verdachts...
K

Krisse²1

Legacy Member
* O2 - BHO: ads_optimizer - {26E45419-7205-4fac-BBFE-174BC7337A79} - C:\WINDOWS\system32\nsf285.dll


* O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


* O2 - BHO: rightonadz browser optimizer - {971C3384-F75E-4562-95B3-CBE7417529BC} - C:\WINDOWS\system32\gzmrotate.dll


* O3 - Toolbar: Adssite Toolbar - {41C29B07-6F91-4966-91BE-2E2841643C83} - C:\Program Files\Adssite Advanced Toolbar\toolbar.dll
K

Krisse²1

Legacy Member
Volgende laten lopen:

* Ad Aware 2007 laten lopen
* Spybot S&D
* Norton Internet Security 2008 :rofl: :rofl:
* CCleaner (nog laten lopen)

Nog niet verholpen,
in veilige modus is het wel weg, dus is het idd een 4us
J

Jurgenv1

Legacy Member
Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.
K

Krisse²1

Legacy Member
De Combofix-log:

ComboFix 07-10-28.2 - Jorn 2007-10-28 17:38:39.1 - NTFSx86
Gestart vanuit: C:\Documents and Settings\Jorn\Bureaublad\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt
.

(((((((((((((((((((( Bestanden Gemaakt van 2007-09-28 to 2007-10-28 ))))))))))))))))))))))))))))))
.

2007-10-28 17:36 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-28 17:28 <DIR> dr-h----- C:\Documents and Settings\Jorn\Onlangs geopend
2007-10-28 16:43 <DIR> d--h----- C:\Documents and Settings\Administrator\Sjablonen
2007-10-28 16:43 <DIR> d--h----- C:\Documents and Settings\Administrator\Onlangs geopend
2007-10-28 16:43 <DIR> d--h----- C:\Documents and Settings\Administrator\Netwerkprinteromgeving
2007-10-28 16:43 <DIR> d-------- C:\Documents and Settings\Administrator\Mijn documenten
2007-10-28 16:43 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2007-10-28 16:43 <DIR> d-------- C:\Documents and Settings\Administrator\Favorieten
2007-10-28 16:43 <DIR> d-------- C:\Documents and Settings\Administrator\Bureaublad
2007-10-28 16:28 22,112 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-10-28 12:28 <DIR> d-------- C:\Program Files\Trend Micro
2007-10-24 20:35 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2007-10-24 13:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-10-23 23:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HP
2007-10-23 23:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sonic
2007-10-23 23:12 <DIR> d-------- C:\Program Files\Hewlett-Packard
2007-10-23 23:10 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2007-10-23 23:08 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-10-23 23:08 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2007-10-23 22:44 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-10-23 22:44 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2007-10-23 22:44 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2007-10-23 22:44 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2007-10-23 22:44 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2007-10-23 22:44 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2007-10-23 22:44 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2007-10-23 22:42 <DIR> d-------- C:\Program Files\HP
2007-10-23 22:41 112,871 --a------ C:\WINDOWS\hpoins07.dat
2007-10-23 22:41 21,124 --------- C:\WINDOWS\hpomdl07.dat
2007-10-23 22:12 <DIR> d-------- C:\Documents and Settings\Jorn\Application Data\HP
2007-10-23 22:10 <DIR> d-------- C:\temp\HP_WebRelease
2007-10-23 17:33 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-10-23 17:33 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2007-10-23 17:31 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-10-23 17:31 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-10-14 20:01 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2007-10-14 20:01 12,288 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2007-10-14 20:01 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2007-10-14 20:01 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2007-10-14 19:26 <DIR> d-------- C:\Program Files\Common Files\Micro Application Shared
2007-10-14 19:23 <DIR> d-------- C:\Program Files\Easy Computing
2007-10-14 19:09 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2007-10-13 21:03 <DIR> d-------- C:\Program Files\Adssite Advanced Toolbar
2007-10-13 21:03 <DIR> d-------- C:\Documents and Settings\Jorn\Application Data\Adssite Advanced Toolbar
2007-10-12 17:59 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-10-10 21:07 <DIR> d-------- C:\Program Files\ING
2007-10-10 20:14 <DIR> d-------- C:\Documents and Settings\Jorn\Contacts
2007-10-10 19:54 <DIR> d-------- C:\SAMMY
2007-10-10 18:53 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-09 20:21 <DIR> d-------- C:\Program Files\Norton Internet Security
2007-10-09 19:36 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-10-09 19:36 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-10-09 19:35 <DIR> d-------- C:\Program Files\Symantec
2007-10-09 19:35 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2007-10-09 19:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2007-10-09 19:32 <DIR> d---s---- C:\Documents and Settings\Jorn\UserData
2007-10-09 18:54 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2007-10-09 18:54 46,352 --a------ C:\WINDOWS\setdebug.exe
2007-10-09 18:54 6,550 --a------ C:\WINDOWS\jautoexp.dat
2007-10-09 18:54 113 --a------ C:\WINDOWS\system32\zonedon.reg
2007-10-09 18:54 113 --a------ C:\WINDOWS\system32\zonedoff.reg
2007-10-09 18:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avocent AdminWorks
2007-10-07 20:13 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-10-07 20:10 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-10-07 20:06 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-10-07 20:06 <DIR> d-------- C:\Program Files\Ahead
2007-10-07 20:06 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2007-10-07 20:06 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2007-10-07 20:06 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2007-10-07 20:06 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll
2007-10-07 20:06 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2007-10-07 20:06 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2007-10-07 20:06 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2007-10-07 20:06 38,912 --------- C:\WINDOWS\system32\picn20.dll
2007-10-07 20:00 19,751 --a------ C:\WINDOWS\system32\drivers\OsaFsLoc.sys
2007-10-07 20:00 10,944 --a------ C:\WINDOWS\system32\drivers\osanbm.sys
2007-10-07 20:00 6,784 --a------ C:\WINDOWS\system32\drivers\osaio.sys
2007-10-07 19:56 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-10-07 19:52 <DIR> d-------- C:\Documents and Settings\Jorn\Incomplete
2007-10-07 19:52 <DIR> d-------- C:\Documents and Settings\Jorn\Application Data\LimeWire
2007-10-07 19:51 <DIR> d-------- C:\WINDOWS\Sun
2007-10-07 19:50 <DIR> d-------- C:\Program Files\Java
2007-10-07 19:50 <DIR> d-------- C:\Program Files\Common Files\Java
2007-10-07 19:41 <DIR> d-------- C:\Documents and Settings\LocalService\Menu Start
2007-10-07 19:32 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2007-10-07 19:28 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-10-07 19:26 <DIR> d-------- C:\WINDOWS\EHome
2007-10-07 00:00 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2007-10-06 23:59 <DIR> d-------- C:\Program Files\Microsoft.NET
2007-10-06 23:59 <DIR> d-------- C:\Program Files\Microsoft Works
2007-10-06 23:58 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-10-06 23:56 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-10-06 23:56 <DIR> dr-h----- C:\MSOCache
2007-10-06 23:54 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-10-06 23:53 <DIR> d-------- C:\WINDOWS\pss
2007-10-06 23:53 <DIR> d-------- C:\Program Files\MSN Messenger
2007-10-06 23:51 <DIR> d-------- C:\Program Files\VideoLAN
2007-10-06 23:51 <DIR> d-------- C:\Documents and Settings\Jorn\Application Data\vlc
2007-10-06 23:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-06 23:49 <DIR> d-------- C:\Program Files\DVD Shrink

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-09 19:37 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-10-09 19:37 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-10-07 18:43 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2007-10-06 16:24 --------- d-----w C:\Program Files\microsoft frontpage
2007-09-18 12:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspx.cat
2007-09-18 12:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspl.cat
2007-09-18 12:44 10,658 ----a-w C:\WINDOWS\system32\drivers\srtsp.cat
2007-09-18 12:44 1,430 ----a-w C:\WINDOWS\system32\drivers\srtspl.inf
2007-09-18 12:44 1,421 ----a-w C:\WINDOWS\system32\drivers\srtspx.inf
2007-09-18 12:44 1,415 ----a-w C:\WINDOWS\system32\drivers\srtsp.inf
2007-09-18 12:43 43,696 ----a-w C:\WINDOWS\system32\drivers\srtspx.sys
2007-09-18 12:43 317,616 ----a-w C:\WINDOWS\system32\drivers\srtspl.sys
2007-09-18 12:43 278,576 ----a-w C:\WINDOWS\system32\drivers\srtsp.sys
2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-08 20:05]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-03-30 14:29]
"PowerKey"="C:\Program Files\Launch Manager\PowerKey.exe" [2002-08-30 14:02]
"LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2005-05-19 13:45]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 13:28]
"LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2004-10-11 09:47]
"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2005-04-18 10:41]
"SoundMan"="SOUNDMAN.EXE" [2005-08-17 17:39 C:\WINDOWS\SOUNDMAN.EXE]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"AMTray.exe"="C:\Acer\Empowering Technology\amtray.exe" [2006-12-29 10:23]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-01-14 00:11]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 09:22]
"HP Software Update"="c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 22:12]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:03]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 15:16]

R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys
R1 OsaFsLoc;OsaFsLoc;\??\C:\WINDOWS\system32\drivers\OsaFsLoc.sys
R2 osaio;osaio;\??\C:\WINDOWS\system32\drivers\osaio.sys
R2 osanbm;osanbm;\??\C:\WINDOWS\system32\drivers\osanbm.sys
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys
R3 POWERKEY;POWERKEY;\??\C:\Program Files\Launch Manager\POWERKEY.sys
S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys

*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
.
Inhoud van de 'Gedeelde Taken' map
"2007-10-09 19:29:06 C:\WINDOWS\Tasks\Norton Internet Security - Volledige systeemscan - Jorn.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe
.
**************************************************************************

catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-28 17:40:51
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
Voltooingstijd: 2007-10-28 17:41:30
.
--- E O F ---




De Hijackthis-log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:42:12, on 28/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\awServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AMTray.exe] "C:\Acer\Empowering Technology\amtray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Acer\Empowering Technology\awServ.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Planner voor Automatische LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 7646 bytes




Maar nog steeds niet weg :sop: En de laptop is juist een 8-tal dagen geleden geformateerd en volledig werkend geïnstalleerd... Hoe doen mensen dat?????? :oink:
K

Krisse²1

Legacy Member
Heeft dit effect als ik de combofix in veilige modus laat draaien? Nu is dit in de standaard run-mode uitgevoerd...
K

Krisse²1

Legacy Member
Combo + CCleaner in veilige modus laten lopen, ook zonder enig suc6...
Nog iemand een voorstel?
J

Jurgenv1

Legacy Member
Ziet er goed uit hoor, het zal wellicht niet aan spyware liggen.
K

Krisse²1

Legacy Member
mhmmm
Kzal uiteindelijk toch ff format proberen...

Toch bedankt voor de hulp!
K

Krisse²1

Legacy Member
Format uitgevoerd, alles werkt terug perfect...

Misteries zijn de wereld nog niet uit ;)
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan