Mededeling

**smeenk** · 05-02-08, 08:44

Download: RVAXO.exe

Sla het bestand op je bureaublad op, dubbelklik het en kies voor "Unzip" om het uit te pakken.
Start de computer in veilige modus.
Open nu de map RVAXO op je bureaublad en dubbeklik RunMe.cmd
Er zal een cmd-schermpje openen, daarin zullen snel enkele regels over niet gevonden bestanden voorbijkomen, dit is normaal.
Mogelijk start er ook een uninstaller van een rogue scanner op, sluit deze niet af maar volg eventuele aanwijzingen en laat deze gewoon zijn werk doen.
Daarna zal je PC herstarten naar normale modus, na de herstart opent het cmd-venster van RVAXO opnieuw.
Laat deze lopen en wacht tot er een logfile opent: C:\RVAXO-results.log
Herstart je computer niet vanzelf, of start de tool niet na de reboot, doe dit dan handmatig.
Post de inhoud van de logfile in je volgende bericht.

Download Deckard's System Scanner naar je Bureaublad.

Sluit alle toepassingen en vensters.
Dubbelklik op dss.exe om het te activeren, en volg de aanwijzingen.
Wanneer de scan volledig is, zal een tekstbestand - main.txt - openen.
Kopiëer (Ctrl+A gevolgd door Ctrl+C) en plak (Ctrl+V) de inhoud van main.txt in je volgende antwoord.

Opmerking: Sommige firewalls kunnen waarschuwen dat sigcheck.exe probeert verbinding te maken met het internet
- zorg dat sigcheck.exe toestemming krijgt om dit te doen !
Tevens kan het gebeuren dat je Antivirus DSS als verdacht aangeeft, of zelfs probeert te verwijderen.
Laat je Antivirus dit niet verwijderen ! (In dit geval is het misschien beter om tijdens de scan van DSS je Antivirus even uit te schakelen)

**bladibla** · 05-02-08, 13:10

Bedankt voor ej snelle reactie! Na RVAXO in veilig modus kon ik weer mijn contro l panel en display settings openen!! Heel erg bedankt.
Het rare is dat ie in de log aangeeft niks te hebben gevonden.
Nogmaals dank!!

De log van DSS:

Deckard's System Scanner v20071014.68
Run by Administrator on 2008-02-05 13:07:11
Computer is in Normal Mode.
--------------------------------------------------------------------------------

System Drive C: has 1.87 GiB (less than 15%) free.

-- HijackThis (run as Administrator.exe) ---------------------------------------

Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-02-05 13:08:23
Platform: Windows 2003 Service Pack 2 (5.02.3790)
MSIE: Internet Explorer (6.0.3790.3959)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\WINDOWS\SysWOW64\CTSVCCDA.EXE
C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe
C:\Program Files (x86)\Common Files\Protexis\License Service\PSIService.exe
C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
C:\Program Files (x86)\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files (x86)\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\SysWOW64\vmnat.exe
C:\WINDOWS\SysWOW64\vmnetdhcp.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\SysWOW64\ctfmon.exe
C:\Program Files (x86)\MSN Messenger\msnmsgr.exe
C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\Microsoft ActiveSync\rapimgr.exe
C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files (x86)\Java\jre1.6.0_03\bin\jusched.exe
D:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe
C:\WINDOWS\SysWOW64\CTXFISPI.EXE
C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
D:\Program Files (x86)\PokerOffice\bin\javaw.exe
C:\Program Files (x86)\QuickTime\qttask.exe
C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe
C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_SL.exe
D:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe
C:\Program Files (x86)\VMware\VMware Workstation\hqtray.exe
C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe
C:\Program Files (x86)\Creative\ShareDLL\CADI\NotiMan.exe
C:\Program Files (x86)\MSN Messenger\usnsvc.exe
D:\Internet downloads\dss(3).exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [RCSystem] "C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files (x86)\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [POEngine] "D:\Program Files (x86)\PokerOffice\POEngine.exe" D:\Program Files (x86)\PokerOffice
O4 - HKLM\..\Run: [CloneCDTray] "D:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] "D:\Program Files (x86)\PowerISO\PWRISOVM.EXE"
O4 - HKLM\..\Run: [TerraTec Remote Control] "C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe"
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files (x86)\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [vmware-tray] "C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe"
O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files (x86)\VMware\VMware Workstation\hqtray.exe"
O4 - HKLM\..\Run: [Amok Eggs Four Web] C:\Documents and Settings\All Users\Application Data\part dead amok eggs\Chic Live.exe
O4 - HKLM\..\Run: [Norton Ghost 12.0] "C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe"
O4 - HKLM\..\Run: [MSDrive] rundll32.exe C:\WINDOWS\system32\drvkah.dll,startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files (x86)\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Steam] "c:\program files (x86)\steam\steam.exe" -silent
O4 - HKCU\..\Run: [THE USER] C:\DOCUME~1\ADMINI~1\APPLIC~1\BONESA~1\MixProgramExit.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BBC Alerts] "C:\Program Files (x86)\BBC Alerts\BBC_Alerts.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (file missing)
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{A39F736C-3F6D-4FF1-AEBB-97CA39438ABD}: NameServer = 192.168.2.254
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: ScCertProp - C:\WINDOWS\system32\wlnotify.dll (file missing)
O20 - Winlogon Notify: Schedule - C:\WINDOWS\system32\wlnotify.dll (file missing)
O20 - Winlogon Notify: SensLogn - C:\WINDOWS\system32\WlNotify.dll (file missing)
O20 - Winlogon Notify: wincqt32 - C:\WINDOWS\system32\wincqt32.dll (file missing)
O20 - Winlogon Notify: wlballoon - C:\WINDOWS\system32\wlnotify.dll (file missing)
O23 - Service: Apache2.2 - Apache Software Foundation - C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSVCCDA.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe /com
O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\lsass.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_2.EXE
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe
O23 - Service: NBService - Unknown owner - C:\Program Files
O23 - Service: Net Logon (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe
O23 - Service: NLCS Agent (NLCSAgent) - Unknown owner - C:\Program Files
O23 - Service: NLRemCmd Service (NLRemCmdSvc) - Unknown owner - C:\WINDOWS\system32\NLRemCmdSvc.exe
O23 - Service: Norton Ghost - Unknown owner - C:\Program Files
O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc64.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files (x86)\Common Files\Protexis\License Service\PSIService.exe
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - C:\Program Files
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Unknown owner - C:\Program Files
O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\system32\tlntsvr.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - C:\Program Files
O23 - Service: Virtual Disk Service (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - Unknown owner - C:\Program Files
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files (x86)\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\winvnc4.exe
O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

--
End of file - 13509 bytes

-- Files created between 2008-01-05 and 2008-02-05 -----------------------------

2008-02-05 13:01:33 0 d-------- C:\RVAXO
2008-02-05 00:29:20 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-05 00:28:47 0 d-------- C:\Program Files (x86)\SUPERAntiSpyware
2008-02-05 00:28:47 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-02-05 00:28:27 0 d-------- C:\Program Files (x86)\Common Files\Wise Installation Wizard
2008-02-05 00:22:54 0 d-------- C:\Documents and Settings\Administrator\DoctorWeb
2008-02-04 23:03:48 0 d-------- C:\Program Files (x86)\Apache Software Foundation
2008-02-02 01:40:55 0 d-------- C:\Documents and Settings\Administrator\Application Data\BBC Alerts
2008-02-02 01:40:51 0 d-------- C:\Program Files (x86)\BBC Alerts
2008-01-30 15:09:41 0 d-------- C:\Documents and Settings\Guest\Application Data\SystemDefender
2008-01-29 23:55:35 0 d-------- C:\Program Files (x86)\Amara - Flash News Ticker
2008-01-29 23:42:29 256 ---hs---- C:\SYSJR22.SYS
2008-01-29 23:41:10 29184 --a------ C:\WINDOWS\system32\jesterrun.dll
2008-01-29 23:41:00 0 d-------- C:\Program Files (x86)\FlashJester
2008-01-29 21:45:08 0 d-------- C:\Program Files (x86)\Common Files\Cisco Systems
2008-01-29 21:44:57 0 d-------- C:\Program Files (x86)\Sophos
2008-01-29 21:44:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Sophos
2008-01-29 21:44:09 0 d-------- C:\savwsa
2008-01-29 18:23:56 0 d-------- C:\Program Files (x86)\NoAdware5.0
2008-01-29 17:59:24 51200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-29 17:59:22 53248 --a------ C:\WINDOWS\PSEXESVC.EXE <Not Verified; Sysinternals; Sysinternals PsExec>
2008-01-29 17:37:10 0 d-------- C:\Documents and Settings\Administrator\SDFix
2008-01-29 13:45:07 98709 --a------ C:\Documents and Settings\Administrator\Application Data\sysdefender.exe
2008-01-29 13:25:08 2 --a------ C:\1686138110
2008-01-29 13:00:36 0 d-------- C:\Program Files (x86)\MDM
2008-01-24 23:30:27 0 d-------- C:\Program Files (x86)\Bonjour
2008-01-19 17:53:34 0 d-------- C:\Program Files (x86)\Common Files\SWF Studio
2008-01-19 17:25:10 0 d-------- C:\Program Files (x86)\Northcode
2008-01-18 20:22:18 0 d-------- C:\Program Files (x86)\Amara - News Ticker
2008-01-18 20:10:07 0 d-------- C:\Documents and Settings\Administrator\Application Data\Feedreader
2008-01-15 23:58:15 0 d-------- C:\Program Files (x86)\T6
2008-01-15 23:58:15 0 d-------- C:\Documents and Settings\All Users\Application Data\T6
2008-01-15 23:32:20 0 d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-01-15 23:27:39 0 d-------- C:\Program Files (x86)\Norton Ghost
2008-01-15 23:26:38 0 d-------- C:\Program Files (x86)\Symantec
2008-01-15 23:26:38 0 d-------- C:\Program Files (x86)\Common Files\Symantec Shared
2008-01-15 23:26:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-15 15:02:09 0 d-------- C:\SoftPaqDownloadDirectory
2008-01-15 14:52:54 0 d-------- C:\Program Files (x86)\HP
2008-01-15 14:52:29 0 d-------- C:\SWSETUP
2008-01-15 14:05:51 0 d-------- C:\Program Files (x86)\Crimson Editor
2008-01-13 22:48:05 0 d-------- C:\Program Files (x86)\Ashkon Technology
2008-01-13 20:51:34 0 d-------- C:\Program Files (x86)\rebol
2008-01-13 20:51:34 0 d-------- C:\Documents and Settings\Administrator\Application Data\rebol
2008-01-13 18:27:44 0 d-------- C:\Program Files (x86)\Camtech
2008-01-13 12:46:47 0 d-------- C:\Documents and Settings\Administrator\Application Data\InstallShield

-- Find3M Report ---------------------------------------------------------------

2008-02-05 13:06:29 0 d-------- C:\Program Files (x86)\Steam
2008-02-05 13:05:49 0 d-------- C:\Documents and Settings\Administrator\Application Data\VMware
2008-02-05 13:05:22 0 d-------- C:\Documents and Settings\Administrator\Application Data\Skype
2008-02-05 01:26:43 0 d-------- C:\Program Files (x86)\Common Files\Adobe
2008-02-05 00:30:04 0 d-------- C:\Documents and Settings\Administrator\Application Data\Azureus
2008-02-05 00:28:27 0 d-------- C:\Program Files (x86)\Common Files
2008-02-04 23:25:58 0 d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
2008-02-04 21:19:08 0 d-------- C:\Program Files (x86)\PacificPoker
2008-01-31 00:05:07 0 d-------- C:\Program Files (x86)\HyperSnap 6
2008-01-31 00:05:06 0 d-------- C:\Program Files (x86)\SoftPerfect Network Protocol Analyzer
2008-01-31 00:00:02 0 d-------- C:\Program Files (x86)\Hitman Pro
2008-01-30 22:06:21 0 d-------- C:\Program Files (x86)\Windows Live Safety Center
2008-01-29 23:00:49 0 d-------- C:\Program Files (x86)\Spyware Doctor
2008-01-29 22:44:10 0 d-------- C:\Program Files (x86)\SpywareBlaster
2008-01-29 22:08:39 0 d-------- C:\Program Files (x86)\GameSpy Arcade
2008-01-27 23:52:06 3558 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2008-01-24 23:23:55 0 d-------- C:\Program Files (x86)\Microsoft.NET
2008-01-24 23:01:50 0 d-------- C:\Program Files (x86)\MSBuild
2008-01-22 18:36:08 0 d-------- C:\Program Files (x86)\Intel
2008-01-20 19:24:26 0 d-------- C:\Program Files (x86)\PartyGaming
2008-01-19 13:39:03 9368 --a------ C:\Documents and Settings\Administrator\Application Data\Comma Separated Values (DOS).EML
2008-01-15 20:27:37 0 d-------- C:\Documents and Settings\Administrator\Application Data\bonesavetype
2008-01-13 12:46:48 0 d--h----- C:\Program Files (x86)\InstallShield Installation Information
2008-01-03 00:19:07 0 d-------- C:\Program Files (x86)\Smart Projects
2008-01-02 23:21:27 0 d-------- C:\Program Files (x86)\MagicISO
2008-01-01 19:46:00 0 d-------- C:\Program Files (x86)\Common Files\PCSuite
2008-01-01 19:44:57 0 d-------- C:\Program Files (x86)\DAEMON Tools
2007-12-17 23:14:15 0 d-------- C:\Program Files (x86)\PopGun
2007-12-17 23:13:58 286720 -----n--- C:\WINDOWS\Setup1.exe <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Windows>
2007-12-17 23:13:57 73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2007-12-16 18:22:15 0 d-------- C:\Documents and Settings\Administrator\Application Data\TeamViewer
2007-12-16 15:55:39 0 d-------- C:\Program Files (x86)\TeamViewer3
2007-12-16 15:16:14 0 d-------- C:\Program Files (x86)\Full Tilt Poker
2007-12-16 11:49:15 0 d-------- C:\Program Files (x86)\Classroom Spy Pro
2007-12-15 19:44:15 0 d-------- C:\Program Files (x86)\Advanced Port Scanner
2007-12-15 19:42:08 0 d-------- C:\Program Files (x86)\DScaler
2007-12-13 13:00:27 0 d-------- C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
2007-12-13 00:24:23 0 d-------- C:\Program Files (x86)\Common Files\TerraTec
2007-12-13 00:24:13 0 d-------- C:\Program Files (x86)\TerraTec
2007-12-12 23:11:38 0 d-------- C:\Program Files (x86)\VMware
2007-12-12 23:11:38 0 d-------- C:\Program Files (x86)\Common Files\VMware
2007-12-12 23:00:40 0 d-------- C:\Program Files (x86)\CamStudio
2007-12-12 22:41:33 0 d-------- C:\Program Files (x86)\Zeallsoft
2007-12-12 21:34:09 0 d-------- C:\Program Files (x86)\Creative
2007-12-11 19:09:06 0 d-------- C:\Program Files (x86)\Azureus
2007-12-11 18:50:58 0 d-------- C:\Program Files (x86)\Microsoft Works
2007-12-11 16:54:45 0 d-------- C:\Documents and Settings\Administrator\Application Data\Nokia
2007-12-11 15:22:26 0 d-------- C:\Documents and Settings\Administrator\Application Data\Datalayer
2007-12-11 15:19:44 0 d-------- C:\Documents and Settings\Administrator\Application Data\PC Suite
2007-12-11 15:01:06 0 d-------- C:\Program Files (x86)\Nokia
2007-12-08 17:33:28 56904 --a------ C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2007-12-08 03:00:25 0 d-------- C:\Program Files (x86)\PokerStars

-- Registry Dump ---------------------------------------------------------------

-- End of Deckard's System Scanner: finished at 2008-02-05 13:08:36 ------------

**smeenk** · 05-02-08, 13:27

Open een kladblokbestand.
Kopieer onderstaande (alles wat vetgedrukt is) in dit kladblokbestand.

@ECHO OFF
IF EXIST log.txt DEL log.txt
ECHO Deleting files>>log.txt
FOR %%g in (
C:\SYSJR22.SYS
"C:\Documents and Settings\Administrator\Application Data\sysdefender.exe"
C:\1686138110
C:\WINDOWS\system32\drvkah.dll
C:\WINDOWS\shell.exe) DO (
IF EXIST %%g (
ATTRIB -r -s -h %%g
DEL %%g
IF EXIST %%g (
ECHO %%g not deleted>>log.txt
) ELSE (
ECHO %%g deleted>>log.txt)
) ELSE (
ECHO %%g not found>>log.txt))
ECHO Deleting folders>>log.txt
FOR %%I in (
"C:\Documents and Settings\Guest\Application Data\SystemDefender"
"C:\Documents and Settings\All Users\Application Data\part dead amok eggs"
C:\DOCUME~1\ADMINI~1\APPLIC~1\BONESA~1
C:\PROGRA~1\BONESA~1) DO (
IF EXIST %%I (
RD /S /Q %%I
IF EXIST %%I (
ECHO %%I not deleted>>log.txt
) ELSE (
ECHO %%I deleted>>log.txt)
) ELSE (
ECHO %%I not found>>log.txt))
START NOTEPAD.EXE log.txt

Ga naar Bestand - Opslaan als.
Bij "Opslaan in" kies je: Bureaublad
Bij "Bestandsnaam" zet je: del.bat
Bij "Opslaan als type" selecteer je: Alle bestanden (*.*).
Klik op de knop Opslaan.

Dubbelklik op del.bat en post de inhoud van de logfile die opent.

**bladibla** · 05-02-08, 14:46

Hoi, bedankt! Top weer dingen gebeurd:

Deleting files
C:\SYSJR22.SYS deleted
"C:\Documents and Settings\Administrator\Application Data\sysdefender.exe" deleted
C:\1686138110 deleted
C:\WINDOWS\system32\drvkah.dll not found
C:\WINDOWS\shell.exe not found
Deleting folders
"C:\Documents and Settings\Guest\Application Data\SystemDefender" deleted
"C:\Documents and Settings\All Users\Application Data\part dead amok eggs" deleted
C:\DOCUME~1\ADMINI~1\APPLIC~1\BONESA~1 deleted
C:\PROGRA~1\BONESA~1 not found

**smeenk** · 05-02-08, 14:54

Start Hijackthis en plaats een vinkje voor de volgende regels:
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Amok Eggs Four Web] C:\Documents and Settings\All Users\Application Data\part dead amok eggs\Chic Live.exe
O4 - HKLM\..\Run: [MSDrive] rundll32.exe C:\WINDOWS\system32\drvkah.dll,startup
O4 - HKCU\..\Run: [THE USER] C:\DOCUME~1\ADMINI~1\APPLIC~1\BONESA~1\MixProgramExit.exe
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (file missing)
O20 - Winlogon Notify: wincqt32 - C:\WINDOWS\system32\wincqt32.dll (file missing)
Sluit alle open vensters(behalve Hijackthis) en klik op "Fix checked".

Herstart je PC en post een nieuw logje van Hijackthis, vertel meteen of er nog problemen zijn

**bladibla** · 05-02-08, 15:20

Heel erg bedankt!. De computer draait voorlopig erg goed!! geen problemen.

Hier de Hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 15:19, on 2008-02-05
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Microsoft ActiveSync\wcescomm.exe
C:\Program Files (x86)\MSN Messenger\msnmsgr.exe
C:\WINDOWS\SysWOW64\ctfmon.exe
C:\PROGRA~2\MICROS~3\rapimgr.exe
C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
C:\Program Files (x86)\Skype\Plugin Manager\SkypePM.exe
C:\Program Files (x86)\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\WINDOWS\SysWOW64\CTsvcCDA.EXE
C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe
C:\Program Files (x86)\Common Files\Protexis\License Service\PSIService.exe
C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
C:\Program Files (x86)\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files (x86)\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\SysWOW64\vmnat.exe
C:\WINDOWS\SysWOW64\vmnetdhcp.exe
C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\WINDOWS\SysWOW64\CTXFISPI.EXE
C:\Program Files (x86)\Java\jre1.6.0_03\bin\jusched.exe
D:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe
D:\Program Files (x86)\PokerOffice\bin\javaw.exe
C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files (x86)\QuickTime\qttask.exe
C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe
C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe
D:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe
C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe
C:\Program Files (x86)\VMware\VMware Workstation\hqtray.exe
C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe
C:\Program Files (x86)\Creative\ShareDLL\CADI\NotiMan.exe
C:\Program Files (x86)\MSN Messenger\usnsvc.exe
D:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [RCSystem] "C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files (x86)\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [POEngine] "D:\Program Files (x86)\PokerOffice\POEngine.exe" D:\Program Files (x86)\PokerOffice
O4 - HKLM\..\Run: [CloneCDTray] "D:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] "D:\Program Files (x86)\PowerISO\PWRISOVM.EXE"
O4 - HKLM\..\Run: [TerraTec Remote Control] "C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe"
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files (x86)\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [vmware-tray] "C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe"
O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files (x86)\VMware\VMware Workstation\hqtray.exe"
O4 - HKLM\..\Run: [Norton Ghost 12.0] "C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files (x86)\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Steam] "c:\program files (x86)\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BBC Alerts] "C:\Program Files (x86)\BBC Alerts\BBC_Alerts.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O10 - Unknown file in Winsock LSP: c:\program files (x86)\bonjour\mdnsnsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{A39F736C-3F6D-4FF1-AEBB-97CA39438ABD}: NameServer = 192.168.2.254
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dll
O20 - Winlogon Notify: EFS - C:\WINDOWS\SYSTEM32\sclgntfy.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Apache2.2 - Unknown owner - C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe" -k runservice (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files (x86)\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Net Logon (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NLCS Agent (NLCSAgent) - Unknown owner - C:\Program Files (x86)\Classroom Spy Pro\bin\csagtprosvc.exe (file missing)
O23 - Service: NLRemCmd Service (NLRemCmdSvc) - Unknown owner - C:\WINDOWS\system32\NLRemCmdSvc.exe (file missing)
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe
O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc64.exe (file missing)
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files (x86)\Common Files\Protexis\License Service\PSIService.exe
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files (x86)\Spyware Doctor\sdhelp.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files (x86)\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: VMware Agent Service (ufad-ws60) - Unknown owner - C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe" -d "C:\Program Files (x86)\VMware\VMware Workstation\\" -s ufad-p2v.xml (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Virtual Disk Service (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files (x86)\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)

**smeenk** · 05-02-08, 15:25

Open de map RVAXO op je bureaublad en dubbelklik Uninstall.cmd
Dit zal alles van RVAXO doen verwijderen.

Download ATF cleaner (mirror)(gemaakt door Atribune)

Belangrijk: Sluit al je browservensters(IE en/of Firefox en/of Opera) om de tool goed te kunnen laten werken.

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Het volgende doen als je ook FireFox als browser hebt:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit haalt het vinkje weer weg bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Het volgende doen als je ook Opera als browser hebt:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

Ga naar Start - Uitvoeren en geef hier het volgende in:
Combofix /U
Druk daarna op OK.
Let op: Er moet een spatie tussen Combofix en /U zitten.

Dit zal Combofix deïnstalleren.

Schakel Systeemherstel uit. Herstart de computer. Schakel Systeemherstel weer in.
Kijk hier hoe je je systeemherstel moet uitschakelen.
Hiermee verwijder je eventuele restanten van de infecties uit je systeemherstel.

Dan denk ik dat alles weer OK is

**bladibla** · 05-02-08, 16:29

Het lijkt allemaal goed te werken. Smeenk, hartelijk bedankt voor de moeite en goeie service!! Top!
Hoihoi!

**smeenk** · 05-02-08, 16:38

Graag gedaan hoor

Mededeling

geen configuratiescherm, geen beeldschermeigenschappen...

geen configuratiescherm, geen beeldschermeigenschappen...

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment