Archief - Pc prob

Sedert ik een tijdje geleden een variant van het sasser virus op mn pc gehad heb, heeft hij wat problemen. Let wel, deze problemen doen zich niet constant voor, meestal begint het nadat mn pc een 5 min is opgestart, en dan af en toe werkt alles trug perfect.

Wat is nu het probleem? Gewone applicaties starten gewoon op, maar als er een programma online moet geraken heeft het probleme: IE laadt heeeel traag, outlook express timed out, teamspeak bijvoorbeeld heeft dan geen probleem, World of Warcraft geraakt ook heel traag online, maar eens ik ingelogd ben heb ik wel volle snelheid (25 ms). Ook msn geraakt niet ingelogd wanneer het probleem zich voordoet.

Een vriend van me zei om winsockfix te proberen, ik dacht dat het opgelost was hiermee, maar helaas....

Bij deze wil ik dus es mn logje plaatsen om wat hulp te kunnen krijgen..:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16:10:42, on 8/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\SYSTEM32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\SYSTEM32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\CTSvcCDA.EXE
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\MsPMSPSv.exe
D:\WINDOWS\CTHELPER.EXE
D:\WINDOWS\SYSTEM32\CTXFIHLP.EXE
D:\WINDOWS\Explorer.EXE
D:\Program Files\ATI Technologies\ATI.ACE\cli.exe
D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
D:\WINDOWS\CTHELPER.EXE
D:\WINDOWS\system32\CTXFIHLP.EXE
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\SYSTEM32\CTXFISPI.EXE
D:\Program Files\ATI Technologies\ATI.ACE\cli.exe
D:\Program Files\MSN Messenger\usnsvc.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Administrator\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "D:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [igndlm.exe] D:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SetDefaultMIDI] MIDIDEF.EXE /s:'Creative SoundFont Synthesizer' /w:'SB Audigy' (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SetDefaultMIDI] MIDIDEF.EXE /s:'Creative SoundFont Synthesizer' /w:'SB Audigy' (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://D:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/wuweb_site.cab?1186551141796
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1186551122984
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://express.foto.com/NewUploader/ImageUploader4.cab
O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://swgbetareg.station.sony.com/soesysinfo.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game19.zylomgames.com/activex/zylomloader.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/74914091/activex/IPSUploader.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://asp05.photoprintit.de/microsite/defaults/activex/XUpload.ocx
O20 - Winlogon Notify: ddcca - D:\WINDOWS\
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - D:\WINDOWS\system32\j8231136.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - D:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

--
End of file - 6306 bytes

P.S. Mijn ventilatorke op mn Nforce Chipset draait niet meer Maar dit kan het probleem niet zijn imho...

Combofix Logske:

ComboFix 07-08-07.6 - "Administrator" 2007-08-08 16:42:14.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1628 [GMT 2:00]


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


D:\Autorun.inf
D:\Program Files\Common Files\{30259~1
D:\WINDOWS\system32\drivers\sfsync02.sys
D:\WINDOWS\system32\unsvchosts.lzma
D:\WINDOWS\system32\xpdx.sys


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_DNSCACHEREADER
-------\LEGACY_NTMLSVC
-------\LEGACY_SFSYNC02
-------\DNSCacheReader
-------\NtmlSvc
-------\sfsync02
-------\xpdx


((((((((((((((((((((((((( Files Created from 2007-07-08 to 2007-08-08 )))))))))))))))))))))))))))))))


2007-08-08 16:41 51,200 --a------ D:\WINDOWS\nircmd.exe
2007-08-08 15:59 <DIR> d-------- D:\DOCUME~1\LOCALS~1\APPLIC~1\Creative
2007-08-08 08:40 <DIR> d-------- D:\WINDOWS\system32\Defaults
2007-08-08 07:50 151,484 --a------ D:\Undo COMMEYNE 20070808 075029.Reg
2007-08-08 07:24 38,528 --a------ D:\WINDOWS\system32\drivers\FastNIC.sys
2007-08-08 06:53 36,224 --a--c--- D:\WINDOWS\system32\dllcache\an983.sys
2007-08-08 06:53 36,224 --a------ D:\WINDOWS\system32\drivers\an983.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-08 16:51 66095 --a------ D:\WINDOWS\system32\neteveot.dat
2007-08-08 16:51 5997 --a------ D:\WINDOWS\system32\dmstyvem.dat
2007-08-08 16:51 18353 --a------ D:\WINDOWS\system32\streamcb.dat
2007-08-08 16:51 0 --a------ D:\WINDOWS\system32\wmaudsdy.dat
2007-08-08 16:45 4528 --a------ D:\WINDOWS\system32\msdmqdp.dat
2007-08-08 16:45 1614 --a------ D:\WINDOWS\system32\psisdefd.dat
2007-08-08 16:45 1176 --a------ D:\WINDOWS\system32\dmsynhh.dat
2007-08-08 16:44 0 --a------ D:\WINDOWS\system32\atipdlxo.dat
2007-08-08 16:04 86016 --a------ D:\WINDOWS\system32\OpenAL32.dll
2007-08-08 14:44 377 --a------ D:\WINDOWS\system32\dimadiqg.dat
2007-08-08 08:40 --------- d--h----- D:\Program Files\InstallShield Installation Information
2007-08-08 08:40 --------- d-------- D:\Program Files\Creative
2007-08-07 10:29 --------- d-------- D:\DOCUME~1\ADMINI~1\APPLIC~1\uTorrent
2007-08-05 14:29 --------- d-------- D:\Program Files\World of Warcraft
2007-07-15 17:45 --------- d-------- D:\Program Files\mIRC
2007-06-26 16:57 --------- d-------- D:\Program Files\GlobalSCAPE
2007-06-23 19:05 --------- d-------- D:\DOCUME~1\ADMINI~1\APPLIC~1\AdobeUM
2007-06-16 11:53 --------- d-------- D:\Program Files\Funcom
2007-06-16 02:23 1885290777 --a------ D:\AOInstall17.1.1_EP1_EP3_live_nointro.exe
2007-06-15 21:43 --------- d-------- D:\DOCUME~1\ADMINI~1\APPLIC~1\IGN_DLM
2007-06-14 18:49 881564 ---hs---- D:\WINDOWS\system32\accdd.ini2
2007-06-14 17:43 --------- d-------- D:\Program Files\Kaspersky Lab
2007-06-14 17:28 --------- d-------- D:\Program Files\a-squared Free
2007-06-14 16:14 899751 ---hs---- D:\WINDOWS\system32\accdd.bak2
2007-06-13 20:29 --------- d-------- D:\DOCUME~1\ADMINI~1\APPLIC~1\Turbine
2007-06-13 19:56 --------- d-------- D:\Program Files\Codemasters
2007-06-13 16:14 883073 ---hs---- D:\WINDOWS\system32\accdd.bak1
2007-05-16 17:12 86528 -----c--- D:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 17:12 85504 -----c--- D:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 17:12 683520 --a------ D:\WINDOWS\system32\inetcomm.dll
2007-05-16 17:12 683520 -----c--- D:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 17:12 510976 -----c--- D:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 17:12 1314816 -----c--- D:\WINDOWS\system32\dllcache\msoe.dll
2005-09-24 10:13 774144 --a------ D:\Program Files\RngInterstitial.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-03 21:05]
"ATICCC"="D:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 14:43]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"CTHelper"="CTHELPER.EXE" [2006-08-11 14:56 D:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 14:56 D:\WINDOWS\system32\CTXFIHLP.EXE]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="D:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:54]
"Steam"="" []
"igndlm.exe"="D:\Program Files\IGN\Download Manager\DLM.exe" [2007-03-05 13:57]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"SetDefaultMIDI"=MIDIDEF.EXE /s:'Creative SoundFont Synthesizer' /w:'SB Audigy'

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcca]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" -atboottime
"DAEMON Tools-1033"="D:\Program Files\D-Tools\daemon.exe" -lang 1033

R0 prohlp02;StarForce Protection Helper Driver v2;D:\WINDOWS\system32\drivers\prohlp02.sys
R0 prosync1;StarForce Protection Synchronization Driver v1;D:\WINDOWS\system32\drivers\prosync1.sys
R0 sfhlp01;StarForce Protection Helper Driver;D:\WINDOWS\system32\drivers\sfhlp01.sys
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x);D:\WINDOWS\system32\drivers\sfvfs02.sys
R1 prodrv06;StarForce Protection Environment Driver v6;D:\WINDOWS\system32\drivers\prodrv06.sys
R2 PfDetNT;PfDetNT;\??\D:\WINDOWS\System32\drivers\PfModNT.sys
R3 BridgeMP;MAC Bridge Miniport;D:\WINDOWS\system32\DRIVERS\bridge.sys
R3 FastNIC;SMC EZ Card 10/100 (SMC1244TX V2);D:\WINDOWS\system32\DRIVERS\FastNIC.sys
R3 ha20x2k;Creative 20X HAL Driver;D:\WINDOWS\system32\drivers\ha20x2k.sys
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;D:\WINDOWS\system32\drivers\WmBEnum.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;D:\WINDOWS\system32\drivers\WmXlCore.sys
S3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;D:\WINDOWS\system32\DRIVERS\AN983.sys
S3 Bridge;MAC Bridge;D:\WINDOWS\system32\DRIVERS\bridge.sys
S3 hap17v2k;Creative P17V HAL Driver;D:\WINDOWS\system32\drivers\hap17v2k.sys
S3 idsvc;Windows CardSpace;"D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
S3 LMouKE;Logitech SetPoint Mouse Filter Driver;D:\WINDOWS\system32\DRIVERS\LMouKE.Sys
S3 SaiH0464;SaiH0464;D:\WINDOWS\system32\DRIVERS\SaiH0464.sys
S3 SaiNtHid;%SAINTHID_NAME%;D:\WINDOWS\system32\DRIVERS\SaiNtHid.sys
S3 SaiNtSub;SaiNtSub;D:\WINDOWS\system32\DRIVERS\SaiNtSub.sys
S3 sbpci;SB PCI Family Audio Driver (WDM);D:\WINDOWS\system32\drivers\sbpci.sys
S3 usbprint;Microsoft USB PRINTER Class;D:\WINDOWS\system32\DRIVERS\usbprint.sys
S3 WmFilter;Logitech WingMan HID Filter Driver;D:\WINDOWS\system32\drivers\WmFilter.sys
S3 WmVirHid;Logitech Virtual Hid Device Driver;D:\WINDOWS\system32\drivers\WmVirHid.sys
S3 XTrapD12;XTrapD12;\??\D:\WINDOWS\System32\XTrapD12.sys
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"


Contents of the 'Scheduled Tasks' folder
2007-07-13 15:15:00 D:\WINDOWS\Tasks\1-Click Maintenance.job - D:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-08 16:51:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\i\5]
"DisplayName"="\xd930\21\x1d0\25\xda14\21\x4809\x77e9\x3278\x77e8\xffff\xffff\x5f10\x77e7\x5faa\x77e7\2"
"DeviceDesc"="\xd930\21\x1d0\25\xda14\21\x4809\x77e9\x3278\x77e8\xffff\xffff\x5f10\x77e7\x5faa\x77e7\2"
"ProviderName"="\xcbf0\x575"
"MFG"="urrentControlSet\Services\ati2mtag\Device0"
"ReinstallString"="\x7f98\x77f5\x8a3a\x77f5"
"DeviceInstanceIds"=str(7):"`"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\(\f\v\r(\f\v\r]
"DisplayName"="\xd930\21\x1d8\25\xda14\21\x4809\x77e9\x3278\x77e8\xffff\xffff\x5f10\x77e7\x5faa\x77e7\2"
"DeviceDesc"="\xd930\21\x1d8\25\xda14\21\x4809\x77e9\x3278\x77e8\xffff\xffff\x5f10\x77e7\x5faa\x77e7\2"
"ProviderName"="\x1af8\xd15"
"MFG"="urrentControlSet\Services\ati2mtag\Device0"
"ReinstallString"="\x7f98\x77f5\x8a3a\x77f5"
"DeviceInstanceIds"=str(7):"`"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\\x02c64"\r]
"DisplayName"="\xffff\xffff\xf70f\x77f5\xf7f\x77f6"
"DeviceDesc"="\xffff\xffff\xf70f\x77f5\xf7f\x77f6"
"ProviderName"="\xe8a0\xd08\4"
"MFG"="urrentControlSet\Services\ati2mtag\Device0"
"ReinstallString"="D:\WINDOWS\System32\ReinstallBackups\\x3488\xd22\DriverFiles\\x3ae5\x77f82.INF"
"DeviceInstanceIds"=str(7):"`"

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-08 16:52:47 - machine was rebooted
D:\ComboFix-quarantined-files.txt ... 2007-08-08 16:52

--- E O F ---

euh... bump?

Kan ik een nieuw hijackthis logje zien?

Pfff problemen problemen, blijkbaar heeft/geeft mijn d schijf nu problemen. Als ik iets wil copieren/verplaatsen op mn c schijf werkt alles ok, maar op mn d schijf gaan explorer op 99% van de cpu draaien en loopt alles vast...

Hier mn nieuwe hijackthis logske...

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:40, on 2007-08-14
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\SYSTEM32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\SYSTEM32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\ATI Technologies\ATI.ACE\cli.exe
D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
D:\WINDOWS\CTHELPER.EXE
D:\WINDOWS\system32\CTXFIHLP.EXE
D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\WINDOWS\SYSTEM32\CTXFISPI.EXE
D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
D:\WINDOWS\System32\CTSvcCDA.EXE
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\MsPMSPSv.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\ATI Technologies\ATI.ACE\cli.exe
D:\Program Files\MSN Messenger\usnsvc.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Administrator\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.thottbot.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "D:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [igndlm.exe] D:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SetDefaultMIDI] MIDIDEF.EXE /s:'Creative SoundFont Synthesizer' /w:'SB Audigy' (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SetDefaultMIDI] MIDIDEF.EXE /s:'Creative SoundFont Synthesizer' /w:'SB Audigy' (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://D:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/wuweb_site.cab?1186551141796
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1186551122984
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://express.foto.com/NewUploader/ImageUploader4.cab
O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://swgbetareg.station.sony.com/soesysinfo.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game19.zylomgames.com/activex/zylomloader.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/74914091/activex/IPSUploader.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://asp05.photoprintit.de/microsite/defaults/activex/XUpload.ocx
O20 - Winlogon Notify: ddcca - D:\WINDOWS\
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - D:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

--
End of file - 6720 bytes


P.S. ik zou indien het echt moet wel een format d doen (windows staat op d), maar ik kan niks van mn d copieren...

* Download Dr.Web CureIt naar je bureaublad:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Dubbelklik drweb-cureit.exe en sta het toe om de express scan te starten.
• Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt, klik de Yes to all knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
• Eenmaal de korte scan is beeïndigd, Klik Options > Change Settings
• Kies de "Scan"-tab en verwijder het vinkje bij "Heuristic analyse"
• Terug in het hoofdvenster kan je de drives selecteren die je wilt laten scannen.
• Selecteer hier alle drives. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
• Klik daarna de groene pijl rechts om de scan te starten.
• Klik 'Yes to all' wanneer er gevraagd wordt om cure of move uit te voeren.
• Wanneer de scan gedaan is, kijk of je volgende icoontje kan aanklikken dat staat naast hetgeen gevonden werd:
  
• Indien wel, klik erop en daarna klik op het icoontje er net onder en kies: Move incurable zoals je zal zien in volgende afbeelding:
  
  
  
  Dit zal de bestanden verplaatsen naar volgende map %userprofile%\DoctorWeb\quarantaine-folder indien het niet gedesinfecteerd kan worden. (dit in het geval dat we samples nodig hebben)
• Na bovenstaande te selecteren, in het menu bovenaan van Dr.Web CureIt, klik file en kies save report list. Bewaar de log op je bureaublad.
• Sluit daarna Dr.Web Cureit.
• Herstart je computer!! Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.
• Na het herstarten, Kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post.

Kon zelf dit progske niet meer downloaden, dan maar via andere pc erop gezet, maar dan liep Dr. Web CureIt ook vast, gevolg => format d: . Ook dit hielp niet, aangezien er constant fouten kwamen van beschadigde bestanden => nieuwe hdd en alles gaat weer (nog) vlot nu

Toch bedankt voor het advies/pogingen ...

Ik denk dat je hdd moet beschadigd geweest zijn.