Archief - Probleem firefox

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
W

Weelieman

Legacy Member
Ik had eerst in het gewone software-gedeelte een thread gepost maar Exit raadde aan om hier een logje te posten. En ergens zal dit wel de beste oplossing zijn, iets anders vind ik niet dus de kans wordt dan wel groter dat het aan spyware of iets dergelijks ligt.

Het probleem dus: Telkens als ik een webpagina open dan blokkeert firefox even, ook al is de pagina volledig geladen. Dit probleem doet zich voor tijdens het scrollen of tijdens het intypen van een wachtwoord. Het duurt maar een kleine seconde, dus misschien niet zo vervelend, maar de afgelopen keer werd dit steeds langer en langer en dan wordt het wel irritant. En een format is geleden sinds gisteren en ik vind het een beetje te drastisch om terug te formatteren als het misschien eenvoudiger opgelost kan worden.

Hier een logje:

Logfile of HijackThis v1.99.1
Scan saved at 14:03:42, on 16/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\psimsvc.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AVENGINE.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\apvxdwin.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\SRVLOAD.EXE
c:\program files\panda software\panda platinum 2006 internet security\WebProxy.exe
C:\WINDOWS\system32\wpabaln.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Progs\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158369077140
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1158369066906
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\psimsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe

Op voorhand nen dikke merci!
Grtz,
Weelieman
J

Jurgenv1

Legacy Member
* Download Dr.Web CureIt naar je bureaublad:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
  • Dubbelklik drweb-cureit.exe en sta het toe om de express scan te starten.
  • Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt, klik de Yes to all knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
  • Eenmaal de korte scan is beeïndigd, Klik Options > Change Settings
  • Kies de "Scan"-tab en verwijder het vinkje bij "Heuristic analyse"
  • Terug in het hoofdvenster kan je de drives selecteren die je wilt laten scannen.
  • Selecteer hier alle drives. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
  • Klik daarna de groene pijl rechts om de scan te starten.
  • Klik 'Yes to all' wanneer er gevraagd wordt om cure of move uit te voeren.
  • Wanneer de scan gedaan is, kijk of je volgende icoontje kan aanklikken dat staat naast hetgeen gevonden werd:
    check.gif
  • Indien wel, klik erop en daarna klik op het icoontje er net onder en kies: Move incurable zoals je zal zien in volgende afbeelding:
    move.gif

    Dit zal de bestanden verplaatsen naar volgende map %userprofile%\DoctorWeb\quarantaine-folder indien het niet gedesinfecteerd kan worden. (dit in het geval dat we samples nodig hebben)
  • Na bovenstaande te selecteren, in het menu bovenaan van Dr.Web CureIt, klik file en kies save report list. Bewaar de log op je bureaublad.
  • Sluit daarna Dr.Web Cureit.
  • Herstart je computer!! Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.
  • Na het herstarten, Kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post met een nieuw hijackthis logje.
W

Weelieman

Legacy Member
De korte en de langere scan vonden beide niets, vandaar dus ook geen logje van Dr.Web Cureit. Heb voor de zekerheid ook eens herstart en hier is een nieuw hijack this logje:

Logfile of HijackThis v1.99.1
Scan saved at 14:51:14, on 16/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\psimsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\apvxdwin.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\SRVLOAD.EXE
c:\program files\panda software\panda platinum 2006 internet security\WebProxy.exe
D:\Progs\Hijack This\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158369077140
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1158369066906
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\psimsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe

Pff ik krijg er het wel van, weeral zoiets stoms en ik weet niet waar het probleem zit, maar alleszins heel erg bedankt voor de moeite om mij (weeral) te helpen!!
J

Jurgenv1

Legacy Member
1. Download dit bestand: - combofix.exe
2. Dubbelklik op combofix.exe en volg de instructies die je krijgt.
3. Wanneer het tooltje klaar is zal het een rapport maken voor je, post die log hier met een nieuw hijackthis logje.

Note:
Niet klikken terwijl combofix bezig is, dat zou het tooltje doen vastlopen!
W

Weelieman

Legacy Member
Hier is het logje van Combofix:

Janssens - 06-09-16 20:07:23,31 Service Pack 2
ComboFix 06.09.14 - Running from: C:\Documents and Settings\Janssens\Bureaublad

((((((((((((((((((((((((((((((( Files Created from 2006-08-16 to 2006-09-16 ))))))))))))))))))))))))))))))))))


2006-09-16 13:05 128,232 --a------ C:\WINDOWS\system32\mucltui.dll
2006-09-16 03:11 18,200 --a------ C:\WINDOWS\system32\wups2.dll
2006-09-16 02:51 940,544 --a------ C:\WINDOWS\system32\wmspdmoe.dll
2006-09-16 02:51 9,728 --------- C:\WINDOWS\system32\proxycfg.exe
2006-09-16 02:51 88,064 --------- C:\WINDOWS\system32\p2pnetsh.dll
2006-09-16 02:51 86,016 --------- C:\WINDOWS\system32\p2pgasvc.dll
2006-09-16 02:51 86,016 --------- C:\WINDOWS\system32\mdmxsdk.dll
2006-09-16 02:51 81,920 --------- C:\WINDOWS\system32\ieencode.dll
2006-09-16 02:51 81,408 --------- C:\WINDOWS\system32\wscsvc.dll
2006-09-16 02:51 8,192 --------- C:\WINDOWS\system32\smbinst.exe
2006-09-16 02:51 8,192 --------- C:\WINDOWS\system32\bitsprx2.dll
2006-09-16 02:51 755,200 --------- C:\WINDOWS\system32\ir50_32.dll
2006-09-16 02:51 75,776 --------- C:\WINDOWS\system32\strmfilt.dll
2006-09-16 02:51 73,832 --------- C:\WINDOWS\system32\slcoinst.dll
2006-09-16 02:51 73,796 --------- C:\WINDOWS\system32\slserv.exe
2006-09-16 02:51 71,680 --------- C:\WINDOWS\system32\blastcln.exe
2006-09-16 02:51 7,680 --------- C:\WINDOWS\system32\kbdsmsno.dll
2006-09-16 02:51 7,680 --------- C:\WINDOWS\system32\kbdsmsfi.dll
2006-09-16 02:51 7,168 --------- C:\WINDOWS\system32\kbdukx.dll
2006-09-16 02:51 7,168 --------- C:\WINDOWS\system32\kbdno1.dll
2006-09-16 02:51 7,168 --------- C:\WINDOWS\system32\kbdfi1.dll
2006-09-16 02:51 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll
2006-09-16 02:51 61,440 --------- C:\WINDOWS\system32\logman.exe
2006-09-16 02:51 60,416 --------- C:\WINDOWS\system32\fwcfg.dll
2006-09-16 02:51 6,656 --------- C:\WINDOWS\system32\kbdinmal.dll
2006-09-16 02:51 6,656 --------- C:\WINDOWS\system32\kbdinben.dll
2006-09-16 02:51 6,144 --------- C:\WINDOWS\system32\kbdmlt48.dll
2006-09-16 02:51 6,144 --------- C:\WINDOWS\system32\kbdmlt47.dll
2006-09-16 02:51 6,144 --------- C:\WINDOWS\system32\kbdinbe1.dll
2006-09-16 02:51 526,848 --------- C:\WINDOWS\system32\p2psvc.dll
2006-09-16 02:51 516,768 --------- C:\WINDOWS\system32\ativvaxx.dll
2006-09-16 02:51 50,688 --------- C:\WINDOWS\system32\btpanui.dll
2006-09-16 02:51 50,176 --------- C:\WINDOWS\system32\xmlprovi.dll
2006-09-16 02:51 5,632 --------- C:\WINDOWS\system32\kbdmaori.dll
2006-09-16 02:51 49,152 --------- C:\WINDOWS\system32\powercfg.exe
2006-09-16 02:51 48,640 --------- C:\WINDOWS\system32\pnrpnsp.dll
2006-09-16 02:51 466,200 --a------ C:\WINDOWS\system32\wuapi.dll
2006-09-16 02:51 44,032 --------- C:\WINDOWS\system32\twext.dll
2006-09-16 02:51 437,248 --------- C:\WINDOWS\system32\xpob2res.dll
2006-09-16 02:51 413,944 --a------ C:\WINDOWS\system32\wmspdmod.dll
2006-09-16 02:51 41,240 --a------ C:\WINDOWS\system32\wups.dll
2006-09-16 02:51 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll
2006-09-16 02:51 397,056 --------- C:\WINDOWS\system32\s3gnb.dll
2006-09-16 02:51 384,512 --------- C:\WINDOWS\system32\mp4sdmod.dll
2006-09-16 02:51 377,984 --------- C:\WINDOWS\system32\ati2dvaa.dll
2006-09-16 02:51 338,432 --------- C:\WINDOWS\system32\ir41_qcx.dll
2006-09-16 02:51 32,866 --------- C:\WINDOWS\system32\slrundll.exe
2006-09-16 02:51 32,768 --------- C:\WINDOWS\system32\ativtmxx.dll
2006-09-16 02:51 32,285 --------- C:\WINDOWS\system32\hsfcisp2.dll
2006-09-16 02:51 312,320 --------- C:\WINDOWS\system32\p2pgraph.dll
2006-09-16 02:51 310,272 --------- C:\WINDOWS\system32\mp43dmod.dll
2006-09-16 02:51 30,208 --------- C:\WINDOWS\system32\bthserv.dll
2006-09-16 02:51 29,184 --------- C:\WINDOWS\system32\sdhcinst.dll
2006-09-16 02:51 286,792 --------- C:\WINDOWS\system32\slextspk.dll
2006-09-16 02:51 282,624 --a------ C:\WINDOWS\system32\wmpdxm.dll
2006-09-16 02:51 25,088 --a------ C:\WINDOWS\system32\MsPMSNSv.dll
2006-09-16 02:51 24,576 --------- C:\WINDOWS\system32\httpapi.dll
2006-09-16 02:51 23,040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-09-16 02:51 229,376 --------- C:\WINDOWS\system32\ati2cqag.dll
2006-09-16 02:51 209,920 --a------ C:\WINDOWS\system32\wmerror.dll
2006-09-16 02:51 200,192 --------- C:\WINDOWS\system32\ir50_qc.dll
2006-09-16 02:51 20,992 --------- C:\WINDOWS\system32\bthci.dll
2006-09-16 02:51 2,962,432 --------- C:\WINDOWS\system32\xpsp2res.dll
2006-09-16 02:51 194,840 --a------ C:\WINDOWS\system32\wuaueng1.dll
2006-09-16 02:51 193,024 --------- C:\WINDOWS\system32\fsquirt.exe
2006-09-16 02:51 188,508 --------- C:\WINDOWS\system32\slgen.dll
2006-09-16 02:51 183,808 --------- C:\WINDOWS\system32\ir50_qcx.dll
2006-09-16 02:51 174,360 --a------ C:\WINDOWS\system32\wuauclt1.exe
2006-09-16 02:51 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2006-09-16 02:51 17,408 --------- C:\WINDOWS\system32\winshfhc.dll
2006-09-16 02:51 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-09-16 02:51 150,016 --a------ C:\WINDOWS\system32\wmidx.dll
2006-09-16 02:51 15,872 --------- C:\WINDOWS\system32\w3ssl.dll
2006-09-16 02:51 14,336 --------- C:\WINDOWS\system32\auditusr.exe
2006-09-16 02:51 135,168 --a------ C:\WINDOWS\system32\wmpasf.dll
2006-09-16 02:51 13,824 --------- C:\WINDOWS\system32\wscntfy.exe
2006-09-16 02:51 13,824 --------- C:\WINDOWS\system32\cmsetacl.dll
2006-09-16 02:51 129,536 --------- C:\WINDOWS\system32\xmlprov.dll
2006-09-16 02:51 128,280 --a------ C:\WINDOWS\system32\wucltui.dll
2006-09-16 02:51 120,320 --------- C:\WINDOWS\system32\ir41_qc.dll
2006-09-16 02:51 118,784 --------- C:\WINDOWS\system32\msdadiag.dll
2006-09-16 02:51 116,224 --------- C:\WINDOWS\system32\p2p.dll
2006-09-16 02:51 108,032 --------- C:\WINDOWS\system32\wshbth.dll
2006-09-16 02:51 1,737,856 --------- C:\WINDOWS\system32\mtxparhd.dll
2006-09-16 02:51 1,119,744 --a------ C:\WINDOWS\system32\wmsdmoe2.dll
2006-09-16 02:51 1,003,008 --a------ C:\WINDOWS\system32\wmvdmoe2.dll
2006-09-16 02:44 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-09-16 02:40 98,304 --a------ C:\WINDOWS\system32\msir3jp.dll
2006-09-16 02:40 838,144 --a------ C:\WINDOWS\system32\chtbrkr.dll
2006-09-16 02:40 811,064 --a------ C:\WINDOWS\system32\imjp81k.dll
2006-09-16 02:40 76,288 --a------ C:\WINDOWS\system32\uniime.dll
2006-09-16 02:40 70,656 --a------ C:\WINDOWS\system32\korwbrkr.dll
2006-09-16 02:40 6,144 --a------ C:\WINDOWS\system32\kbd101a.dll
2006-09-16 02:40 218,112 --a------ C:\WINDOWS\system32\c_g18030.dll
2006-09-16 02:40 1,677,824 --a------ C:\WINDOWS\system32\chsbrkr.dll
2006-09-16 02:39 9,216 --a------ C:\WINDOWS\system32\kbdnecAT.dll
2006-09-16 02:39 8,704 --a------ C:\WINDOWS\system32\kbdjpn.dll
2006-09-16 02:39 8,192 --a------ C:\WINDOWS\system32\kbdkor.dll
2006-09-16 02:39 7,680 --a------ C:\WINDOWS\system32\kbdnecNT.dll
2006-09-16 02:39 7,168 --a------ C:\WINDOWS\system32\kbdnec95.dll
2006-09-16 02:39 7,168 --a------ C:\WINDOWS\system32\kbdibm02.dll
2006-09-16 02:39 7,168 --a------ C:\WINDOWS\system32\f3ahvoas.dll
2006-09-16 02:39 6,656 --a------ C:\WINDOWS\system32\kbdlk41a.dll
2006-09-16 02:39 6,656 --a------ C:\WINDOWS\system32\c_is2022.dll
2006-09-16 02:39 6,144 -ra------ C:\WINDOWS\system32\kbdth3.dll
2006-09-16 02:39 6,144 -ra------ C:\WINDOWS\system32\kbdth2.dll
2006-09-16 02:39 6,144 -ra------ C:\WINDOWS\system32\kbdinpun.dll
2006-09-16 02:39 6,144 --a------ C:\WINDOWS\system32\kbdlk41j.dll
2006-09-16 02:39 6,144 --a------ C:\WINDOWS\system32\kbdax2.dll
2006-09-16 02:39 6,144 --a------ C:\WINDOWS\system32\kbd106n.dll
2006-09-16 02:39 6,144 --a------ C:\WINDOWS\system32\kbd106.dll
2006-09-16 02:39 6,144 --a------ C:\WINDOWS\system32\kbd101c.dll
2006-09-16 02:39 6,144 --a------ C:\WINDOWS\system32\kbd101b.dll
2006-09-16 02:39 6,144 --a------ C:\WINDOWS\system32\kbd101.dll
2006-09-16 02:39 6,144 --a------ C:\WINDOWS\system32\ftlx041e.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdvntc.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdurdu.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdth1.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdth0.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdsyr2.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdsyr1.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdintel.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdintam.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdinmar.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdinkan.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdinhin.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdinguj.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdindev.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdheb.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbdfa.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbddiv2.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbddiv1.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbda3.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbda2.dll
2006-09-16 02:39 5,632 -ra------ C:\WINDOWS\system32\kbda1.dll
2006-09-16 02:39 5,632 --a------ C:\WINDOWS\system32\kbdusa.dll
2006-09-16 02:39 5,632 --a------ C:\WINDOWS\system32\kbd103.dll
2006-09-16 02:39 5,120 -ra------ C:\WINDOWS\system32\kbdgeo.dll
2006-09-16 02:39 5,120 -ra------ C:\WINDOWS\system32\kbdarmw.dll
2006-09-16 02:39 5,120 -ra------ C:\WINDOWS\system32\kbdarme.dll
2006-09-16 02:39 185,344 --a------ C:\WINDOWS\system32\Thawbrkr.dll
2006-09-16 02:39 10,752 --a------ C:\WINDOWS\system32\c_iscii.dll
2006-09-16 02:36 86,556 --a------ C:\WINDOWS\system32\dgsetup.dll
2006-09-16 02:36 8,704 --a------ C:\WINDOWS\system32\batt.dll
2006-09-16 02:36 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2006-09-16 02:36 76,288 --a------ C:\WINDOWS\system32\storprop.dll
2006-09-16 02:36 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2006-09-16 02:36 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2006-09-16 02:36 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2006-09-16 02:36 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2006-09-16 02:36 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2006-09-16 02:36 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2006-09-16 02:36 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2006-09-16 02:36 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2006-09-16 02:36 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2006-09-16 02:36 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2006-09-16 02:36 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2006-09-16 02:36 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2006-09-16 02:36 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2006-09-16 02:36 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2006-09-16 02:36 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2006-09-16 02:36 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2006-09-16 02:36 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2006-09-16 02:36 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdycc.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbduzb.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdur.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdtat.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdru1.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdru.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdkaz.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdbu.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdblr.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2006-09-16 02:36 5,632 -ra------ C:\WINDOWS\system32\kbdaze.dll
2006-09-16 02:36 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2006-09-16 02:36 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2006-09-16 02:36 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2006-09-16 02:36 103,936 --a------ C:\WINDOWS\system32\EqnClass.Dll
2006-09-16 02:27 57,344 --a------ C:\WINDOWS\system32\pavipc.dll
2006-09-16 02:27 499,712 --a------ C:\WINDOWS\system32\MSVCP71.DLL
2006-09-16 02:27 45,056 --a------ C:\WINDOWS\system32\avldr.dll
2006-09-16 02:27 348,160 --a------ C:\WINDOWS\system32\MSVCR71.DLL
2006-09-16 02:27 245,760 --a------ C:\WINDOWS\system32\PavSHook.dll
2006-09-16 02:27 139,264 --a------ C:\WINDOWS\system32\TpUtil.dll
2006-09-16 02:27 101,888 --a------ C:\WINDOWS\system32\SYSTOOLS.DLL
2006-09-16 02:04 9,488 --a------ C:\WINDOWS\system32\sporder.dll
2006-09-16 02:04 446,464 --a------ C:\WINDOWS\system32\HHActiveX.dll
2006-09-16 02:04 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2006-09-16 01:54 83,456 --a------ C:\WINDOWS\system32\dpvsetup.exe
2006-09-16 01:54 825,344 --a------ C:\WINDOWS\system32\d3dim700.dll
2006-09-16 01:54 82,432 --a------ C:\WINDOWS\system32\dmscript.dll
2006-09-16 01:54 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll
2006-09-16 01:54 733,696 --a------ C:\WINDOWS\system32\qedwipes.dll
2006-09-16 01:54 72,192 --a------ C:\WINDOWS\system32\dsdmoprp.dll
2006-09-16 01:54 70,656 --a------ C:\WINDOWS\system32\amstream.dll
2006-09-16 01:54 619,008 --a------ C:\WINDOWS\system32\dx7vb.dll
2006-09-16 01:54 61,440 --a------ C:\WINDOWS\system32\dmcompos.dll
2006-09-16 01:54 60,928 --a------ C:\WINDOWS\system32\dpnhupnp.dll
2006-09-16 01:54 59,904 --a------ C:\WINDOWS\system32\devenum.dll
2006-09-16 01:54 57,856 --a------ C:\WINDOWS\system32\dpwsockx.dll
2006-09-16 01:54 562,688 --a------ C:\WINDOWS\system32\qedit.dll
2006-09-16 01:54 51,200 --a------ C:\WINDOWS\system32\wstdecod.dll
2006-09-16 01:54 44,544 --a------ C:\WINDOWS\system32\dxdllreg.exe
2006-09-16 01:54 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2006-09-16 01:54 385,536 --a------ C:\WINDOWS\system32\qdvd.dll
2006-09-16 01:54 375,296 --a------ C:\WINDOWS\system32\dpnet.dll
2006-09-16 01:54 367,616 --a------ C:\WINDOWS\system32\dsound.dll
2006-09-16 01:54 363,520 --a------ C:\WINDOWS\system32\psisdecd.dll
2006-09-16 01:54 35,840 --a------ C:\WINDOWS\system32\dmloader.dll
2006-09-16 01:54 35,328 --a------ C:\WINDOWS\system32\mciqtz32.dll
2006-09-16 01:54 35,328 --a------ C:\WINDOWS\system32\dpnhpast.dll
2006-09-16 01:54 30,208 --a------ C:\WINDOWS\system32\dplaysvr.exe
2006-09-16 01:54 3,584 --a------ C:\WINDOWS\system32\dpnlobby.dll
2006-09-16 01:54 3,584 --a------ C:\WINDOWS\system32\dpnaddr.dll
2006-09-16 01:54 28,672 --a------ C:\WINDOWS\system32\dmband.dll
2006-09-16 01:54 279,040 --a------ C:\WINDOWS\system32\qdv.dll
2006-09-16 01:54 27,136 --a------ C:\WINDOWS\system32\ddrawex.dll
2006-09-16 01:54 266,240 --a------ C:\WINDOWS\system32\ddraw.dll
2006-09-16 01:54 24,064 --a------ C:\WINDOWS\system32\dpmodemx.dll
2006-09-16 01:54 229,888 --a------
W

Weelieman

Legacy Member
Vervolg:

C:\WINDOWS\system32\dplayx.dll
2006-09-16 01:54 221,184 --a------ C:\WINDOWS\system32\qasf.dll
2006-09-16 01:54 212,480 --a------ C:\WINDOWS\system32\dpvoice.dll
2006-09-16 01:54 21,504 --a------ C:\WINDOWS\system32\dpvacm.dll
2006-09-16 01:54 204,800 --a------ C:\WINDOWS\system32\mswebdvd.dll
2006-09-16 01:54 20,480 --a------ C:\WINDOWS\system32\encapi.dll
2006-09-16 01:54 2,113,536 --a------ C:\WINDOWS\system32\dxdiagn.dll
2006-09-16 01:54 192,512 --a------ C:\WINDOWS\system32\qcap.dll
2006-09-16 01:54 19,456 --a------ C:\WINDOWS\system32\dswave.dll
2006-09-16 01:54 181,760 --a------ C:\WINDOWS\system32\dsdmo.dll
2006-09-16 01:54 181,248 --a------ C:\WINDOWS\system32\dmime.dll
2006-09-16 01:54 18,432 --a------ C:\WINDOWS\system32\dpnsvr.exe
2006-09-16 01:54 17,408 --a------ C:\WINDOWS\system32\msyuv.dll
2006-09-16 01:54 14,336 --a------ C:\WINDOWS\system32\msdmo.dll
2006-09-16 01:54 116,736 --a------ C:\WINDOWS\system32\dpvvox.dll
2006-09-16 01:54 105,984 --a------ C:\WINDOWS\system32\dmstyle.dll
2006-09-16 01:54 104,448 --a------ C:\WINDOWS\system32\dmusic.dll
2006-09-16 01:54 103,424 --a------ C:\WINDOWS\system32\dmsynth.dll
2006-09-16 01:54 1,689,088 --a------ C:\WINDOWS\system32\d3d9.dll
2006-09-16 01:54 1,432,576 --a------ C:\WINDOWS\system32\msvidctl.dll
2006-09-16 01:54 1,298,432 --a------ C:\WINDOWS\system32\dxdiag.exe
2006-09-16 01:54 1,294,336 --a------ C:\WINDOWS\system32\dsound3d.dll
2006-09-16 01:54 1,291,264 --a------ C:\WINDOWS\system32\quartz.dll
2006-09-16 01:54 1,227,264 --a------ C:\WINDOWS\system32\dx8vb.dll
2006-09-16 01:54 1,179,648 --a------ C:\WINDOWS\system32\d3d8.dll
2006-09-16 01:52 278,528 -ra------ C:\WINDOWS\system32\atiiiexx.dll
2006-09-16 01:52 114,688 --------- C:\WINDOWS\system32\ati2sgag.exe
2006-09-16 01:49 41,852 -ra------ C:\WINDOWS\system32\UpdDrv2K.exe
2006-09-16 01:47 991,232 --a------ C:\WINDOWS\system32\virtear.dll
2006-09-16 01:47 720,896 --a------ C:\WINDOWS\system32\Audio3d.dll
2006-09-16 01:47 720,896 --a------ C:\WINDOWS\system32\a3d.dll
2006-09-16 01:47 49,152 --a------ C:\WINDOWS\system32\DSndUp.exe
2006-09-16 01:47 45,056 --a------ C:\WINDOWS\system32\CleanUp.exe
2006-09-16 01:47 30,208 --a------ C:\WINDOWS\system32\wdmioctl.dll
2006-09-16 01:47 1,285,632 --a------ C:\WINDOWS\system32\SMMedia.dll
2006-09-16 01:11 76,288 --a------ C:\WINDOWS\system32\usbui.dll
2006-09-16 00:47 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2006-09-16 00:47 0 -rahs---- C:\MSDOS.SYS
2006-09-16 00:47 0 -rahs---- C:\IO.SYS
2006-09-16 00:47 0 --a------ C:\CONFIG.SYS
2006-09-16 00:47 0 --a------ C:\AUTOEXEC.BAT
2006-09-16 00:45 86,016 --a------ C:\WINDOWS\system32\isign32.dll
2006-09-16 00:45 81,920 --a------ C:\WINDOWS\system32\ils.dll
2006-09-16 00:45 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2006-09-16 00:45 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2006-09-16 00:45 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2006-09-16 00:45 67,584 --a------ C:\WINDOWS\system32\acctres.dll
2006-09-16 00:45 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2006-09-16 00:45 50,176 --a------ C:\WINDOWS\system32\inetres.dll
2006-09-16 00:45 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2006-09-16 00:45 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2006-09-16 00:45 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2006-09-16 00:45 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2006-09-16 00:45 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2006-09-16 00:45 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2006-09-16 00:45 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2006-09-16 00:45 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2006-09-16 00:45 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2006-09-16 00:45 278,528 --a------ C:\WINDOWS\system32\inetcfg.dll
2006-09-16 00:45 241,152 --a------ C:\WINDOWS\system32\srrstr.dll
2006-09-16 00:45 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2006-09-16 00:45 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2006-09-16 00:45 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2006-09-16 00:45 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2006-09-16 00:45 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2006-09-16 00:44 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-09-16 00:44 278,528 --a------ C:\WINDOWS\system32\mstask.dll
2006-09-16 00:44 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll
2006-09-16 00:44 192,000 --a------ C:\WINDOWS\system32\schedsvc.dll
2006-09-16 00:44 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2006-09-16 00:44 105,984 --a------ C:\WINDOWS\system32\msoert2.dll
2006-09-16 00:43 97,792 --a------ C:\WINDOWS\system32\comrepl.dll
2006-09-16 00:43 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2006-09-16 00:43 94,208 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2006-09-16 00:43 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2006-09-16 00:43 9,728 --a------ C:\WINDOWS\system32\reset.exe
2006-09-16 00:43 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2006-09-16 00:43 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2006-09-16 00:43 80,896 --a------ C:\WINDOWS\system32\charmap.exe
2006-09-16 00:43 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2006-09-16 00:43 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2006-09-16 00:43 662,528 --a------ C:\WINDOWS\system32\getuname.dll
2006-09-16 00:43 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2006-09-16 00:43 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll
2006-09-16 00:43 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2006-09-16 00:43 61,440 --a------ C:\WINDOWS\system32\remotepg.dll
2006-09-16 00:43 60,416 --a------ C:\WINDOWS\system32\colbact.dll
2006-09-16 00:43 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2006-09-16 00:43 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2006-09-16 00:43 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2006-09-16 00:43 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2006-09-16 00:43 57,344 --a------ C:\WINDOWS\system32\sol.exe
2006-09-16 00:43 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2006-09-16 00:43 55,808 --a------ C:\WINDOWS\system32\freecell.exe
2006-09-16 00:43 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2006-09-16 00:43 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2006-09-16 00:43 539,136 --a------ C:\WINDOWS\system32\spider.exe
2006-09-16 00:43 5,632 --a------ C:\WINDOWS\system32\write.exe
2006-09-16 00:43 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2006-09-16 00:43 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll
2006-09-16 00:43 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2006-09-16 00:43 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2006-09-16 00:43 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2006-09-16 00:43 412,160 --a------ C:\WINDOWS\system32\mstsc.exe
2006-09-16 00:43 4,608 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2006-09-16 00:43 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2006-09-16 00:43 39,424 --a------ C:\WINDOWS\system32\cfgbkend.dll
2006-09-16 00:43 352,768 --a------ C:\WINDOWS\system32\hypertrm.dll
2006-09-16 00:43 35,840 --a------ C:\WINDOWS\system32\winchat.exe
2006-09-16 00:43 345,600 --a------ C:\WINDOWS\system32\mspaint.exe
2006-09-16 00:43 33,792 --a------ C:\WINDOWS\system32\regini.exe
2006-09-16 00:43 297,472 --a------ C:\WINDOWS\system32\termsrv.dll
2006-09-16 00:43 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2006-09-16 00:43 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2006-09-16 00:43 233,472 --a------ C:\WINDOWS\system32\avtapi.dll
2006-09-16 00:43 23,040 --a------ C:\WINDOWS\system32\qwinsta.exe
2006-09-16 00:43 225,792 --a------ C:\WINDOWS\system32\catsrv.dll
2006-09-16 00:43 22,016 --a------ C:\WINDOWS\system32\msg.exe
2006-09-16 00:43 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2006-09-16 00:43 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2006-09-16 00:43 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2006-09-16 00:43 188,928 --a------ C:\WINDOWS\system32\cmprops.dll
2006-09-16 00:43 187,392 --a------ C:\WINDOWS\system32\accwiz.exe
2006-09-16 00:43 17,920 --a------ C:\WINDOWS\system32\tsshutdn.exe
2006-09-16 00:43 17,920 --a------ C:\WINDOWS\system32\mmfutil.dll
2006-09-16 00:43 17,408 --a------ C:\WINDOWS\system32\qappsrv.exe
2006-09-16 00:43 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2006-09-16 00:43 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2006-09-16 00:43 16,384 --a------ C:\WINDOWS\system32\rwinsta.exe
2006-09-16 00:43 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2006-09-16 00:43 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2006-09-16 00:43 15,360 --a------ C:\WINDOWS\system32\tsdiscon.exe
2006-09-16 00:43 15,360 --a------ C:\WINDOWS\system32\tscon.exe
2006-09-16 00:43 15,360 --a------ C:\WINDOWS\system32\shadow.exe
2006-09-16 00:43 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2006-09-16 00:43 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2006-09-16 00:43 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2006-09-16 00:43 142,336 --a------ C:\WINDOWS\system32\sessmgr.exe
2006-09-16 00:43 139,264 --a------ C:\WINDOWS\system32\sndvol32.exe
2006-09-16 00:43 132,608 --a------ C:\WINDOWS\system32\sndrec32.exe
2006-09-16 00:43 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2006-09-16 00:43 128,000 --a------ C:\WINDOWS\system32\mshearts.exe
2006-09-16 00:43 125,208 --a------ C:\WINDOWS\system32\wuauclt.exe
2006-09-16 00:43 124,416 --a------ C:\WINDOWS\system32\mplay32.exe
2006-09-16 00:43 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2006-09-16 00:43 114,688 --a------ C:\WINDOWS\system32\calc.exe
2006-09-16 00:43 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2006-09-16 00:43 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2006-09-16 00:43 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2006-09-16 00:43 104,448 --a------ C:\WINDOWS\system32\clipbrd.exe
2006-09-16 00:43 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2006-09-16 00:43 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll
2006-09-16 00:43 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-16 20:03 -------- d-------- C:\Program Files\Mozilla Firefox
2006-09-16 16:10 -------- d-------- C:\Documents and Settings\Janssens\Application Data\Macromedia
2006-09-16 15:00 -------- d-------- C:\Program Files\QuickTime
2006-09-16 14:26 -------- d-------- C:\Program Files\MSN Messenger
2006-09-16 06:21 -------- d-------- C:\Program Files\Common Files
2006-09-16 06:18 -------- d-------- C:\Documents and Settings\Janssens\Application Data\Sun
2006-09-16 05:53 -------- d-------- C:\Documents and Settings\Janssens\Application Data\Apple Computer
2006-09-16 05:49 -------- d-------- C:\Program Files\Windows Media Player
2006-09-16 04:07 -------- d-------- C:\Documents and Settings\Janssens\Application Data\Mozilla
2006-09-16 03:51 -------- d-------- C:\Program Files\Messenger
2006-09-16 03:51 -------- d-------- C:\Program Files\Internet Explorer
2006-09-16 03:46 -------- d-------- C:\Program Files\Outlook Express
2006-09-16 03:46 -------- d-------- C:\Program Files\Common Files\System
2006-09-16 02:52 -------- d---s---- C:\Documents and Settings\Janssens\Application Data\Microsoft
2006-09-16 02:51 -------- d-------- C:\Program Files\Movie Maker
2006-09-16 02:48 -------- d-------- C:\Program Files\Windows NT
2006-09-16 02:48 -------- d-------- C:\Program Files\NetMeeting
2006-09-16 02:36 62 --ahs---- C:\Documents and Settings\Janssens\Application Data\desktop.ini
2006-09-16 02:36 -------- d-------- C:\Program Files\Common Files\SpeechEngines
2006-09-16 02:36 -------- d-------- C:\Program Files\Common Files\ODBC
2006-09-16 02:04 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-09-16 02:04 -------- d-------- C:\Program Files\Panda Software
2006-09-16 02:00 -------- d-------- C:\Program Files\Common Files\Panda Software
2006-09-16 02:00 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-09-16 01:55 -------- d-------- C:\Documents and Settings\Janssens\Application Data\Help
2006-09-16 01:53 -------- d-------- C:\Program Files\ATI Technologies
2006-09-16 01:47 -------- d-------- C:\Program Files\Analog Devices
2006-09-16 01:11 -------- d-------- C:\Program Files\Intel
2006-09-16 01:10 -------- d--h----- C:\Program Files\Uninstall Information
2006-09-16 01:10 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-09-16 01:10 -------- d-------- C:\Documents and Settings\Janssens\Application Data\Identities
2006-09-16 00:47 -------- d-------- C:\Program Files\xerox
2006-09-16 00:47 -------- d-------- C:\Program Files\microsoft frontpage
2006-09-16 00:46 -------- d-------- C:\Program Files\Online Services
2006-09-16 00:45 -------- d-------- C:\Program Files\Common Files\Services
2006-09-16 00:45 -------- d-------- C:\Program Files\Common Files\MSSoap
2006-09-16 00:44 -------- d--h----- C:\Program Files\WindowsUpdate
2006-09-16 00:44 -------- d-------- C:\Program Files\MSN
2006-09-16 00:44 -------- d-------- C:\Program Files\ComPlus Applications
2006-09-16 00:43 -------- d-------- C:\Program Files\MSN Gaming Zone
2006-08-21 11:14 128896 --------- C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-04 11:58 140416 --a------ C:\WINDOWS\system32\drivers\netflt.sys
2006-08-03 16:37 44544 --a------ C:\WINDOWS\system32\drivers\APPFLT.SYS
2006-08-02 14:17 16000 --a------ C:\WINDOWS\system32\drivers\wnmflt.sys
2006-08-02 14:15 23296 --a------ C:\WINDOWS\system32\drivers\smsflt.sys
2006-08-02 14:10 185472 --a------ C:\WINDOWS\system32\drivers\idsflt.sys
2006-08-02 14:08 36864 --a------ C:\WINDOWS\system32\drivers\dsaflt.sys
2006-07-21 10:29 72704 --a------ C:\WINDOWS\system32\hlink.dll
2006-06-22 07:17 69120 --a------ C:\WINDOWS\system32\ciodm.dll
2006-06-22 07:17 1440768 --a------ C:\WINDOWS\system32\query.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"PHIME2002ASync"="C:\\WINDOWS\\System32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\System32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"SoundMAXPnP"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMax4PNP.exe"
"SoundMAX"="\"C:\\Program Files\\Analog Devices\\SoundMAX\\Smax4.exe\" /tray"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"APVXDWIN"="\"C:\\Program Files\\Panda Software\\Panda Platinum 2006 Internet Security\\APVXDWIN.EXE\" /s"
"SCANINICIO"="\"C:\\Program Files\\Panda Software\\Panda Platinum 2006 Internet Security\\Inicio.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Completion time: Sat 16/09/2006 20:08:16.31
ComboFix.txt



En hier nog een logje van HijackThis:

Logfile of HijackThis v1.99.1
Scan saved at 20:11:17, on 16/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\psimsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\apvxdwin.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\SRVLOAD.EXE
c:\program files\panda software\panda platinum 2006 internet security\WebProxy.exe
C:\WINDOWS\system32\wpabaln.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\psimreal.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Progs\Hijack This\HijackThis.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PlaTasks.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158369077140
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1158369066906
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\psimsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe

Toen ik Combofix opstartte dan stond er dat het de computer ging herstarten als er iets gevonden werd om het gevondene terwijl te verwijderen. Maar hij startte niet opnieuw op dus ik vermoed dat het niets gevonden heeft.
J

Jurgenv1

Legacy Member
Download VundoFix.exe naar je bureaublad.
  • Dubbelklik VundoFix.exe om het te starten.
  • Klik de Scan for Vundo knop.
  • Eenmaal gedaan met scannen, klik de Remove Vundo knop.
  • Je zal een melding krijgen of je de bestanden wilt laten verwijderen, klik YES
  • Nadat je Yes hebt geklikt, zullen de icoontjes op je bureaublad verdwijnen tijdens het verwijderen van Vundo.
  • Wanneer voltooid zal je de melding krijgen dat het je PC zal afsluiten, klik OK.
  • Start je pc terug opnieuw op.
  • Post de inhoud van C:\vundofix.txt en een nieuwe hijackthislog in je volgende post.
Note: Het is mogelijk dat vundofix een bestand gevonden heeft dat niet kon verwijderd worden.
In dit geval zal VundoFix na het heropstarten van je pc nog eens opstarten. Dan moet je de instructies van hierboven nog eens uitvoeren vanaf: "Click the Scan for Vundo."
W

Weelieman

Legacy Member
Hier is het logje van VundoFix:


VundoFix V6.1.5

Checking Java version...

Java version is 1.5.0.8

Scan started at 13:51:32 17/09/2006

Listing files found while scanning....

No infected files were found.


En een nieuw HijackThis logje:

Logfile of HijackThis v1.99.1
Scan saved at 14:01:05, on 17/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\psimsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\SRVLOAD.EXE
c:\program files\panda software\panda platinum 2006 internet security\WebProxy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\wpabaln.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\psimreal.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Progs\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\npjpi150_08.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\npjpi150_08.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158369077140
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1158369066906
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\psimsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe

De computer startte niet opnieuw op omdat er niets gevonden was.
J

Jurgenv1

Legacy Member
Open Kladblok.
Kopieer de onderstaande vetgedrukte tekst en plak deze in een nieuw document.

Code: 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=-

Kies Bestand -> Opslaan
Selecteer bij "Opslaan in": Bureaublad
Vul bij "Bestandsnaam" in: fix.reg
Selecteer bij "Opslaan als type": Alle bestanden
Klik op "Opslaan".

Dubbelklik op fix.reg, dat nu op je bureaublad staat.
Ga ermee akkoord dat deze gegevens aan het register worden toegevoegd.
Start de pc opnieuw op en post een nieuw hijackthis logje hier en vertel hoe alles verder werkt.
W

Weelieman

Legacy Member
HijackThis logje:

Logfile of HijackThis v1.99.1
Scan saved at 23:11:34, on 17/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\psimsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\apvxdwin.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\SRVLOAD.EXE
c:\program files\panda software\panda platinum 2006 internet security\WebProxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wpabaln.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PAVJOBS.EXE
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\psimreal.exe
D:\Progs\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158369077140
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1158369066906
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\psimsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe


Op het ogenblik werkt alles nog hetzelfde buiten dan dat het 'blokkeermoment' precies wat langer geworden is. Maar dit was de vorige keer ook zo dus ik weet niet of dat dit door de laatste handeling komt. Maar ik vraag mij wel een beetje af waarvoor dat ik die 'fix.reg' heb moeten doen. Zelf heb ik van dit computergebied heel weinig kaas gegeten, een beetje uitleg is meer dan welkom. Maar voor alle duidelijkheid, ik twijfel zeker niet aan hetgeen ik heb gedaan, ik heb er echt nog alle vertrouwen in. Alleen weet ik niet of het echt aan een spyware/virus probleem ligt, misschien is het wel een stom conflict tussen een bepaalde instelling van iets. Het is maar een stomme gok want ik heb er echt geen flauw idee van. Ik kijk alleszins uit naar de volgende stap.

Nogis merci eh!!
J

Jurgenv1

Legacy Member
Die fix.reg was om een restandje van virtumonde op te ruimen. :) Ik denk ook eerder dat de traagheid niet aan malware te wijten is. Probeer anders nog eens schijfopruiming en schijfdefragmentatie.
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan