Beveilingscertificaat

• 

  lg

  11-06-2012 14:55

  Op de ze pc verschijn regelmatig de melding beveilingscertificaat is verlopen bv. bij marktplaats.

  De datum en tijd staan correct op deze pc.

  MS essentials heeft niets gevonden

  Malwarebytes Anti-Malware 1.61.0.1400

  www.malwarebytes.org

  Databaseversie: v2012.06.11.04

  Windows XP Service Pack 3 x86 NTFS

  Internet Explorer 8.0.6001.18702

  Maria :: MARIA-935D2BA78

  11-6-2012 13:26:35

  mbam-log-2012-06-11 (13-26-35).txt

  Scantype: Volledige scan

  Ingeschakelde scanopties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM

  Uitgeschakelde scanopties: P2P

  Objecten gescand: 260339

  Verstreken tijd: 40 minuut/minuten, 16 seconde(n)

  Geheugenprocessen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registerwaarden gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registerdata gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Mappen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Bestanden gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  (einde)

  Logfile of HijackThis v1.99.1

  Scan saved at 14:44:52, on 11-6-2012

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  c:\Program Files\Microsoft Security Client\MsMpEng.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

  C:\WINDOWS\RTHDCPL.EXE

  C:\WINDOWS\system32\RUNDLL32.EXE

  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  C:\Program Files\Microsoft Security Client\msseces.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\nvsvc32.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Thomson\TG122n\WlanCU.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Documents and Settings\Maria\Local Settings\Temporary Internet Files\Content.IE5\C5ABWPQN\hijackthis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll

  O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\Language\Language.exe”

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: nwiz.exe /install

  O4 - HKLM\..\Run: RTHDCPL.EXE

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  O4 - HKLM\..\Run: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  O4 - HKLM\..\Run: “c:\Program Files\Microsoft Security Client\msseces.exe” -hide -runkey

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  O4 - Global Startup: Wireless Configuration Utility.lnk = C:\Program Files\Thomson\TG122n\WlanCU.exe

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

  O8 - Extra context menu item: Zoeken op eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O11 - Options group: International

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -

  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

  O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

  O20 - Winlogon Notify: igfxcui - igfxdev.dll (file missing)

  O23 - Service: ATK Keyboard Service (ATKKeyboardService) - Unknown owner - C:\WINDOWS\ATKKBService.exe (file missing)

  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe“ -service -config ”C:\Program Files\Oracle\JavaFX 2.1 Runtime\lib\deploy\jqs\jqs.conf (file missing)

  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: WLSVC - Unknown owner - C:\Program Files\Thomson\TG122n\WLSVC.exe

  Rapporteren
• 

  Ben

  11-06-2012 15:59

  Hallo lg,

  Je heb een oude versie van HijackThis v1.99.1 gebruikt we zitten al aan Hijackthis versie (2.0.4)

  Verwijder de oude en maak een nieuw logje met de versie (2.0.4)

  Gr.Ben

  

  Antivirusprikbord.nl

  Rapporteren
• 

  lg

  11-06-2012 16:03

  Kan kloppen de link op op het stappenplan werkt niet.

  Moest even een noodgreep toepassen, heb intussen(via eigen pc) de juiste op een stick gezet zodat(ik op die pc) de juiste kan installeren en de log kan posten.

  LG

  Rapporteren
• 

  lg

  13-06-2012 12:45

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 11:17:53, on 13-6-2012

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  c:\Program Files\Microsoft Security Client\MsMpEng.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\nvsvc32.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

  C:\WINDOWS\RTHDCPL.EXE

  C:\WINDOWS\system32\RUNDLL32.EXE

  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  C:\Program Files\Microsoft Security Client\msseces.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  C:\Program Files\Thomson\TG122n\WlanCU.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

  C:\WINDOWS\system32\sol.exe

  C:\WINDOWS\system32\msiexec.exe

  C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.shareware-ne.com/nl/index.php?rvs=hompag

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll

  O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\Language\Language.exe”

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: nwiz.exe /install

  O4 - HKLM\..\Run: RTHDCPL.EXE

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  O4 - HKLM\..\Run: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  O4 - HKLM\..\Run: “c:\Program Files\Microsoft Security Client\msseces.exe” -hide -runkey

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Lokale service’)

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Netwerkservice’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  O4 - Global Startup: Wireless Configuration Utility.lnk = C:\Program Files\Thomson\TG122n\WlanCU.exe

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

  O8 - Extra context menu item: Zoeken op eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

  O23 - Service: ATK Keyboard Service (ATKKeyboardService) - Unknown owner - C:\WINDOWS\ATKKBService.exe (file missing)

  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: WLSVC - Unknown owner - C:\Program Files\Thomson\TG122n\WLSVC.exe

  –

  End of file - 7110 bytes

  Rapporteren
• 

  Jos H

  13-06-2012 17:20

  Lees het volgende eens.LG: http://windows.microsoft.com/nl-NL/windows-vista/About-certificate-errors

  Rapporteren
• 

  lg

  13-06-2012 19:17

  Die link had ik reeds gelezen en geeft geen oplossing.

  Ik heb mijn eiegen laptop meegenomen en alle instellingen vergeleken beide win XP.

  Geen verschil, wel ben ik dit probleem eerder tegen gekomen toen bleek de datum en tijd ven de pc niet correct te zijn ingesteld.

  LG

  Rapporteren
• 

  Jos H

  13-06-2012 19:26

  Dat klopt, alle meerdere meldingen gehad op het soft en hardware die door verkeerde datum of tijd deze melding kregen.

  Vooral bij inloggen op banksites.

  Rapporteren
• 

  fazantje

  14-06-2012 09:07

  Hoi LG,

  lg Schreef:

  ——————————————————-

  > Kan kloppen de link op op het stappenplan werkt

  > niet.

  > Moest even een noodgreep toepassen, heb

  > intussen(via eigen pc) de juiste op een stick

  > gezet zodat(ik op die pc) de juiste kan

  > installeren en de log kan posten.

  >

  > LG

  Ik heb de linkjes van HJT gecontroleerd, maar kan geen afwijking zien, m.a.w. zowel voor XP als voor Vista en Windows 7 werken naar behoren.

  Groetjes Huib;)

  

  Rapporteren
• 

  fazantje

  14-06-2012 09:14

  Hoi LG,

  Ik denk toch dat het iets softwarematig is, maar wil voor de zekerheid toch even dat je combofix gaat uitvoeren.

  Bedenk goed, je helpt anderen, dat je combofix nooit op eigen houtje gaat uitvoeren, want alleen het draaien van combo wil niet zeggen dat het probleem over is.

  Schakel eerst even jou virusscanner uit, dit doe je rechts onderin jou taakbalk.

  Download combofix hier en plaats het op jou bureaublad.

  Indien je Combofix al eerder hebt gebruikt, gelieve die versie te verwijderen en Combofix opnieuw te downloaden via bovenstaande link,

  want Combofix wordt dagelijks geupdate.

  OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus- of een andere realtime scanner,

  schakel dan deze scanner uit en download Combofix opnieuw.

  Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

  Dubbelklik op Combofix.exe

  Volg de instructies, aanvaard de disclaimer.

  Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

  Het kan enige tijd duren voordat het logje van combofix komt, dus denk niet van hij is op tilt.

  Wanneer de fix voltooid is en na herstart, zal de log combofix.txt openen.

  De scan werkt met een cijferreeks en gaat tot 50, dan heb je een idee hoever de scan ongeveer is.

  Ook het log aanmaken kan de nodige minuten in beslag nemen.

  Start de computer niet uit zichzelf op, dan handmatig opnieuw opstarten.

  Plaats het combofix logje samen met een nieuw HijackThis logje in jou volgende post.

  Succes,

  Huib;)

  

  Rapporteren
• 

  lg

  18-06-2012 17:58

  Zoals gevraagd

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 17:55:10, on 18-6-2012

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  c:\Program Files\Microsoft Security Client\MsMpEng.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\nvsvc32.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\system32\wuauclt.exe

  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

  C:\WINDOWS\RTHDCPL.EXE

  C:\WINDOWS\system32\RUNDLL32.EXE

  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  C:\Program Files\Microsoft Security Client\msseces.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  C:\Program Files\Thomson\TG122n\WlanCU.exe

  C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll

  O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\Language\Language.exe”

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: nwiz.exe /install

  O4 - HKLM\..\Run: RTHDCPL.EXE

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  O4 - HKLM\..\Run: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

  O4 - HKLM\..\Run: “c:\Program Files\Microsoft Security Client\msseces.exe” -hide -runkey

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\S-1-5-18\..\Run: “c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe” -t (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  O4 - Global Startup: Wireless Configuration Utility.lnk = C:\Program Files\Thomson\TG122n\WlanCU.exe

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

  O8 - Extra context menu item: Zoeken op eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

  O23 - Service: ATK Keyboard Service (ATKKeyboardService) - Unknown owner - C:\WINDOWS\ATKKBService.exe (file missing)

  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: WLSVC - Unknown owner - C:\Program Files\Thomson\TG122n\WLSVC.exe

  –

  End of file - 6942 bytes

  ComboFix 12-06-16.02 - Maria 18-06-2012 17:43:40.1.2 - x86

  Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1023.602

  Gestart vanuit: c:\documents and settings\Maria\Bureaublad\ComboFix.exe

  AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

  .

  .

  (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

  .

  .

  c:\windows\system32\dllcache\dlimport.exe

  c:\windows\wiaservim.log

  .

  .

  (((((((((((((((((((( Bestanden Gemaakt van 2012-05-18 to 2012-06-18 ))))))))))))))))))))))))))))))

  .

  .

  2012-06-18 15:37 . 2012-06-18 15:37 29904 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{83285816-F978-4567-89F7-EAED65567DF1}\MpKsl3adea0ff.sys

  2012-06-18 15:37 . 2012-06-18 15:37 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{83285816-F978-4567-89F7-EAED65567DF1}\offreg.dll

  2012-06-18 08:04 . 2012-05-08 16:40 6737808 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{83285816-F978-4567-89F7-EAED65567DF1}\mpengine.dll

  2012-06-17 05:23 . 2012-05-08 16:40 6737808 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

  2012-06-14 07:31 . 2012-05-11 14:44 521728 -c—-w- c:\windows\system32\dllcache\jsdbgui.dll

  2012-06-13 09:17 . 2012-06-13 09:17 388096 —-a-r- c:\documents and settings\Maria\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

  2012-06-13 09:17 . 2012-06-13 09:17 ——– d—–w- c:\program files\Trend Micro

  2012-06-11 12:18 . 2012-06-11 12:18 ——– d—–w- c:\documents and settings\Maria\Local Settings\Application Data\Sun

  2012-06-11 11:25 . 2012-06-11 11:25 ——– d—–w- c:\program files\Common Files\Java

  2012-06-11 11:25 . 2012-06-11 11:25 ——– d—–w- c:\program files\Oracle

  2012-06-11 11:24 . 2012-06-11 11:24 ——– d—–w- c:\documents and settings\Maria\Application Data\Oracle

  2012-06-11 11:24 . 2012-04-04 16:47 143872 —-a-w- c:\windows\system32\javacpl.cpl

  2012-06-11 11:24 . 2012-04-04 16:47 772504 —-a-w- c:\windows\system32\npDeployJava1.dll

  2012-06-11 11:24 . 2012-06-11 11:24 ——– d—–w- c:\program files\Java

  .

  .

  .

  ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

  .

  2012-05-31 13:22 . 2006-03-02 12:00 602624 —-a-w- c:\windows\system32\crypt32.dll

  2012-05-16 15:09 . 2006-03-02 12:00 916992 —-a-w- c:\windows\system32\wininet.dll

  2012-05-15 13:55 . 2006-03-02 12:00 1863296 —-a-w- c:\windows\system32\win32k.sys

  2012-05-11 14:44 . 2006-03-02 12:00 43520 —-a-w- c:\windows\system32\licmgr10.dll

  2012-05-11 14:44 . 2006-03-02 12:00 1469440 ——w- c:\windows\system32\inetcpl.cpl

  2012-05-11 11:39 . 2006-03-02 12:00 385024 —-a-w- c:\windows\system32\html.iec

  2012-05-05 03:15 . 2006-03-02 12:00 2152960 —-a-w- c:\windows\system32\ntoskrnl.exe

  2012-05-05 03:14 . 2004-08-04 00:58 2031104 —-a-w- c:\windows\system32\ntkrnlpa.exe

  2012-05-02 13:47 . 2008-02-22 15:09 139656 —-a-w- c:\windows\system32\drivers\rdpwd.sys

  2012-04-04 13:56 . 2012-03-28 09:48 22344 —-a-w- c:\windows\system32\drivers\mbam.sys

  2012-03-20 18:44 . 2011-04-18 11:18 171064 —-a-w- c:\windows\system32\drivers\MpFilter.sys

  .

  .

  ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

  .

  .

  *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

  REGEDIT4

  .

  “RemoteControl”=“c:\program files\CyberLink\PowerDVD\PDVDServ.exe”

  “LanguageShortcut”=“c:\program files\CyberLink\PowerDVD\Language\Language.exe”

  “NeroFilterCheck”=“c:\windows\system32\NeroCheck.exe”

  “NvCplDaemon”=“c:\windows\system32\NvCpl.dll”

  “nwiz”=“nwiz.exe”

  “RTHDCPL”=“RTHDCPL.EXE”

  “NvMediaCenter”=“c:\windows\system32\NvMcTray.dll”

  “Adobe ARM”=“c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  “HP Software Update”=“c:\program files\HP\HP Software Update\HPWuSchd2.exe”

  “MSC”=“c:\program files\Microsoft Security Client\msseces.exe”

  “SunJavaUpdateSched”=“c:\program files\Common Files\Java\Java Update\jusched.exe”

  .

  “CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE”

  “DWQueuedReporting”=“c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe”

  .

  c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\

  HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe

  Wireless Configuration Utility.lnk - c:\program files\Thomson\TG122n\WlanCU.exe

  .

  @=“Service”

  .

  2005-05-03 10:43 69632 —-a-r- c:\windows\Alcmtr.exe

  .

  2011-08-18 15:22 33560288 —-a-w- c:\program files\KPN\KPN Assistent\KPN_Assistent.exe

  .

  2007-04-04 09:22 1822720 —-a-r- c:\windows\SkyTel.exe

  .

  “AntiVirusOverride”=dword:00000001

  .

  “%windir%\\system32\\sessmgr.exe”=

  “c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe”=

  “c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe”=

  “c:\\Program Files\\Messenger\\msmsgs.exe”=

  “c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe”=

  “%windir%\\Network Diagnostic\\xpnetdiag.exe”=

  “c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe”=

  “c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe”=

  “c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe”=

  “c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe”=

  “c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe”=

  “c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe”=

  “c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe”=

  “c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe”=

  “c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe”=

  “c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe”=

  “c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe”=

  “c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe”=

  “c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe”=

  “c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe”=

  “c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe”=

  “c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe”=

  “c:\\Program Files\\KPN\\KPN Assistent\\KPN_Assistent.exe”=

  .

  R1 MpKsl3adea0ff;MpKsl3adea0ff;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{83285816-F978-4567-89F7-EAED65567DF1}\MpKsl3adea0ff.sys

  R2 WLNdis50;Wireless Lan NDIS Protocol I/O Control;c:\windows\system32\drivers\WLNdis50.sys

  R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys

  R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8192su.sys

  S1 etkmpepa;etkmpepa;\??\c:\windows\system32\drivers\etkmpepa.sys –> c:\windows\system32\drivers\etkmpepa.sys

  S1 hbdylrfx;hbdylrfx;\??\c:\windows\system32\drivers\hbdylrfx.sys –> c:\windows\system32\drivers\hbdylrfx.sys

  S1 ndqiptjm;ndqiptjm;\??\c:\windows\system32\drivers\ndqiptjm.sys –> c:\windows\system32\drivers\ndqiptjm.sys

  S2 WLSVC;WLSVC;c:\program files\Thomson\TG122n\WLSVC.exe

  .

  — Andere Services/Drivers In Geheugen —

  .

  *NewlyCreated* - MPKSL3ADEA0FF

  .

  HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

  hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

  .

  Inhoud van de ‘Gedeelde Taken’ map

  .

  2012-06-18 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job

  - c:\program files\Microsoft Security Client\MpCmdRun.exe

  .

  2012-06-18 c:\windows\Tasks\User_Feed_Synchronization-{1AA305CD-F4B5-4973-A3F0-A3618169467F}.job

  - c:\windows\system32\msfeedssync.exe

  .

  .

  ——- Bijkomende Scan ——-

  .

  uStart Page = hxxp://www.startpagina.nl/

  IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

  IE: Zoeken op eBay - c:\program files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html

  TCP: DhcpNameServer = 192.168.2.254

  .

  - - - - ORPHANS VERWIJDERD - - - -

  .

  WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

  AddRemove-HijackThis - c:\documents and settings\Maria\Local Settings\Temporary Internet Files\Content.IE5\C5ABWPQN\HijackThis.exe

  .

  .

  .

  **************************************************************************

  .

  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

  Rootkit scan 2012-06-18 17:50

  Windows 5.1.2600 Service Pack 3 NTFS

  .

  scannen van verborgen processen …

  .

  scannen van verborgen autostart items …

  .

  scannen van verborgen bestanden …

  .

  Scan succesvol afgerond

  verborgen bestanden: 0

  .

  **************************************************************************

  .

  ——————— VERGRENDELDE REGISTER SLEUTELS ———————

  .

  “3140110900063D11C8EF10054038389C”=“C?\\WINDOWS\\system32\\FM20ENU.DLL”

  .

  Voltooingstijd: 2012-06-18 17:51:25

  ComboFix-quarantined-files.txt 2012-06-18 15:51

  .

  Pre-Run: 143.727.484.928 bytes beschikbaar

  Post-Run: 145.706.450.944 bytes beschikbaar

  .

  WindowsXP-KB310994-SP2-Home-BootDisk-NLD.exe

  timeout=2

  default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

  c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons

  UnsupportedDebug=“do not select this” /debug

  multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=“Microsoft Windows XP Home Edition” /noexecute=optin /fastdetect

  .

  - - End Of File - - 3D50492C18E75118A732FDB6589096D2

  Rapporteren

Dit topic is gesloten, er kunnen geen reacties meer worden geplaatst.