hijackthis controle aub

[cactusken]

Logfile of HijackThis v1.99.1
Scan saved at 23:19:44, on 27/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
C:\Program Files\Telenet EasyCare\bin\mpbtn.exe
C:\PROGRA~1\MESSEN~1\Msmsgs.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis_v199_1.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.be/0SENLBE/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6A87B991-A31F-4130-AE72-6D0C294BF082} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\nl-be\msntb.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\nl-be\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: (no name) - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Telenet EasyCare.lnk = C:\Program Files\Telenet EasyCare\bin\matcli.exe
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\nl-be\msntb.dll/search.htm
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Openen in een nieuwe achtergrondtab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\nl-be\msntabres.dll/229?564f45c1c28242ebb4769073b9e4d094
O8 - Extra context menu item: Openen in een nieuwe voorgrondtab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\nl-be\msntabres.dll/230?564f45c1c28242ebb4769073b9e4d094
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sonjadierickx55.spaces.live.c...d/MsnPUpld.cab
O16 - DPF: {638AF6A2-81A1-4655-9FFA-9FC09CDE22CF} (CScanner Object) - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1137202791984
O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro-europe.com/file...CallButton.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\wmfhotfix.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-service (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

[Juisterr]

Goedemiddag

Wil je onderstaande even doen aub.

Start Hijackthis op en kies voor 'Do a system scan only'
Selecteer alleen de items die hieronder zijn genoemd:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
O2 - BHO: (no name) - {6A87B991-A31F-4130-AE72-6D0C294BF082} - (no file)
O3 - Toolbar: (no name) - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)

Sluit alle vensters behalve Hijackthis
Klik op 'Fix checked' om de items te verwijderen.

start opnieuw op en maak een nieuw HJT logje ter controle en vertel erbij welke klachten je precies hebt.

bvd
Juisterr

[cactusken]

hallo,
ik wou alleen zeker zijn dat alles in orde is.
ik had 2 weken geleden een virus: trojaan dowloader via e-mail binnengekregen, alhoewel ik niets abnormaal ondervond aan de pc, tot het moment dat ik een melding kreeg van telenet dat ik aan mijn limiet zat, ik had de ganse maand geen grote downloads of uploads gedaan, na een online scan werd het virus gedetecteerd en kon ik een removaltool downloaden om dit te verwijderen; alhoewel alles terug ''normaal'' lijkt wou ik toch even jullie hulp inroepen om zeker te zijn dat er niets meer in het register zit
en al bedankt voor de vlugge reactie
mgv
sonja

Logfile of HijackThis v1.99.1
Scan saved at 14:32:43, on 28/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
C:\Program Files\Telenet EasyCare\bin\mpbtn.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\PROGRA~1\MESSEN~1\Msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\Sonja\LOCALS~1\Temp\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.be/0SENLBE/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\nl-be\msntb.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\nl-be\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Telenet EasyCare.lnk = C:\Program Files\Telenet EasyCare\bin\matcli.exe
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\nl-be\msntb.dll/search.htm
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Openen in een nieuwe achtergrondtab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\nl-be\msntabres.dll/229?564f45c1c28242ebb4769073b9e4d094
O8 - Extra context menu item: Openen in een nieuwe voorgrondtab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\nl-be\msntabres.dll/230?564f45c1c28242ebb4769073b9e4d094
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sonjadierickx55.spaces.live.c...d/MsnPUpld.cab
O16 - DPF: {638AF6A2-81A1-4655-9FFA-9FC09CDE22CF} (CScanner Object) - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1137202791984
O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro-europe.com/file...CallButton.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\wmfhotfix.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-service (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

[Juisterr]

Heb je hetvolgende bewust geïnstalleerd:

Dealio
Zo nee: probeer deze dan eens via Configuratiescherm -- Software te deïnstalleren.

zo te zien is het verder schoon, als je eraan twijfeld kan je deze scanner laten draaien.

Download Dr.Web CureIt naar je bureaublad:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Dubbelklik drweb-cureit.exe en sta het toe om de express scan te starten.
Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt, klik de Yes to all knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
Eenmaal de korte scan is beeïndigd, Klik Options > Change Settings
Kies de "Scan"-tab en verwijder het vinkje bij "Heuristic analyse"
Terug in het hoofdvenster kan je de drives selecteren die je wilt laten scannen.
Selecteer hier alle drives. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
Klik daarna de groene pijl rechts om de scan te starten.
Klik 'Yes to all' wanneer er gevraagd wordt om cure of move uit te voeren.
Wanneer de scan gedaan is, kijk of je volgende icoontje kan aanklikken dat staat naast hetgeen gevonden werd:
Indien wel, klik erop en daarna klik op het icoontje er net onder en kies: Move incurable zoals je zal zien in volgende afbeelding:

Dit zal de bestanden verplaatsen naar volgende map %userprofile%\DoctorWeb\quarantaine-folder indien het niet gedesinfecteerd kan worden. (dit in het geval dat we samples nodig hebben)
Na bovenstaande te selecteren, in het menu bovenaan van Dr.Web CureIt, klik file en kies save report list. Bewaar de log op je bureaublad.
Sluit daarna Dr.Web Cureit.

Herstart je computer!! Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.
Na het herstarten, Kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post.

[cactusken]

================================================== ===========================
Dr.Web(R) Scanner for Windows v4.33.2 (4.33.2.10060)
Copyright (c) Igor Daniloff, 1992-2006
Log generated on: 2007-03-30, 00:27:16 [Sonja]
Command-line: "C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\cureit.ex e" /lng /ini:cureit_XP.ini
Operating system:Windows XP Home Edition x86 (Build 2600), Service Pack 2
================================================== ===========================
Engine version: 4.33 (4.33.5.10110)
Engine API version: 2.01
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crwtoday.c db - 769 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43380.c db - 906 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43379.c db - 1485 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43378.c db - 2545 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43377.c db - 1031 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43376.c db - 1390 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43375.c db - 1633 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43374.c db - 2090 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43373.c db - 1252 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43372.c db - 1289 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43371.c db - 2370 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43370.c db - 2022 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43369.c db - 687 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43368.c db - 1099 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43367.c db - 1834 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43366.c db - 4015 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43365.c db - 1342 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43364.c db - 1335 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43363.c db - 1152 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43362.c db - 1006 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43361.c db - 878 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43360.c db - 988 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43359.c db - 1205 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43358.c db - 1139 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43357.c db - 1302 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43356.c db - 1332 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43355.c db - 2456 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43354.c db - 1283 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43353.c db - 795 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43352.c db - 2016 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43351.c db - 941 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43350.c db - 1020 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43349.c db - 1008 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43348.c db - 1096 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43347.c db - 707 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43346.c db - 1428 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43345.c db - 1358 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43344.c db - 694 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43343.c db - 1186 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43342.c db - 744 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43341.c db - 841 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43340.c db - 822 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43339.c db - 1071 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43338.c db - 989 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43337.c db - 855 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43336.c db - 1297 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43335.c db - 1195 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43334.c db - 900 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43333.c db - 1381 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43332.c db - 1340 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43331.c db - 2735 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43330.c db - 2078 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43329.c db - 2490 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43328.c db - 743 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43327.c db - 958 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43326.c db - 793 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43325.c db - 713 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43324.c db - 655 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43323.c db - 655 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43322.c db - 778 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43321.c db - 846 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43320.c db - 808 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43319.c db - 764 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43318.c db - 838 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43317.c db - 363 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43316.c db - 730 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43315.c db - 627 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43314.c db - 824 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43313.c db - 842 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43312.c db - 830 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43311.c db - 862 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43310.c db - 853 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43309.c db - 733 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43308.c db - 708 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43307.c db - 839 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43306.c db - 930 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43305.c db - 759 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43304.c db - 721 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43303.c db - 638 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43302.c db - 806 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43301.c db - 504 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crw43300.c db - 24 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crwebase.c db - 78674 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\cwrtoday.c db - 460 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\cwr43301.c db - 697 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crwrisky.c db - 1271 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\cwntoday.c db - 349 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\cwn43307.c db - 854 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\cwn43306.c db - 781 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\cwn43305.c db - 752 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\cwn43304.c db - 793 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\cwn43303.c db - 766 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\cwn43302.c db - 850 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\cwn43301.c db - 772 virus records
[Virus base] C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\crwnasty.c db - 4867 virus records
Total virus records: 185852
Key file: C:\DOCUME~1\Sonja\LOCALS~1\Temp\RarSFX0\cureit.key
License key number: 0010092936
Registered to: Dr.Web CureIt Project
License key activates: 2007-02-05
License key expires: 2010-02-11
-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 0
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 0 Kb/s
Scan time: 00:00:00
-----------------------------------------------------------------------------
[Scan path] c:\documents and settings\sonja\local settings\temp\rarsfx0\_start.exe
[Scan path] c:\documents and settings\sonja\local settings\temp\rarsfx0\cureit.exe
[Scan path] c:\documents and settings\sonja\local settings\temporary internet files\content.ie5\dlq25lhp\drweb-cureit[1].exe
[Scan path] c:\program files\adobe\acrobat 7.0\activex\acroiehelper.dll
[Scan path] c:\program files\adobe\acrobat 7.0\activex\pdfshell.dll
[Scan path] c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
[Scan path] c:\program files\common files\microsoft shared\information retrieval\msitss.dll
[Scan path] c:\program files\common files\microsoft shared\vs7debug\mdm.exe
[Scan path] c:\program files\common files\microsoft shared\web components\10\owc10.dll
[Scan path] c:\program files\common files\microsoft shared\web folders\msonsext.dll
[Scan path] c:\program files\common files\microsoft shared\web folders\pkmcdo.dll
[Scan path] c:\program files\common files\skype\skype4com.dll
[Scan path] c:\program files\google\common\google updater\googleupdaterservice.exe
[Scan path] c:\program files\google\googletoolbar3.dll
[Scan path] c:\program files\google\googletoolbarnotifier\1.2.1128.5462\g oogletoolbarnotifier.exe
[Scan path] c:\program files\grisoft\avg anti-spyware 7.5\guard.exe
[Scan path] c:\program files\grisoft\avg anti-spyware 7.5\guard.sys
[Scan path] c:\program files\grisoft\avg anti-spyware 7.5\shellexecutehook.dll
[Scan path] c:\program files\grisoft\avg free\avgamsvr.exe
[Scan path] c:\program files\grisoft\avg free\avgcc.exe
[Scan path] c:\program files\grisoft\avg free\avgemc.exe
[Scan path] c:\program files\grisoft\avg free\avgse.dll
[Scan path] c:\program files\grisoft\avg free\avgupsvc.exe
[Scan path] c:\program files\internet explorer\iexplore.exe
[Scan path] c:\program files\messenger\msmsgs.exe
[Scan path] c:\program files\msn messenger\msgrapp.dll
[Scan path] c:\program files\msn toolbar suite\db\02.05.0000.1105\nl-be\deskbar.dll
[Scan path] c:\program files\msn toolbar suite\ext\02.05.0001.1119\nl-be\msnlext.dll
[Scan path] c:\program files\msn toolbar suite\tb\02.05.0000.1105\nl-be\msntb.dll
[Scan path] c:\program files\outlook express\setup50.exe
[Scan path] c:\program files\spamfighter\sfagent.exe
[Scan path] c:\program files\spybot - search & destroy\sdhelper.dll
[Scan path] c:\program files\telenet easycare\bin\matcli.exe
[Scan path] c:\program files\telenet easycare\bin\mpbtn.exe
[Scan path] c:\program files\windows media connect 2\wmccds.exe
[Scan path] c:\program files\windows media connect\mswmccds.exe
[Scan path] c:\program files\windows media connect\mswmcls.exe
[Scan path] c:\windows\explorer.exe
[Scan path] c:\windows\inf\unregmp2.exe
[Scan path] c:\windows\microsoft.net\framework\v2.0.50727\aspn et_state.exe
[Scan path] c:\windows\microsoft.net\framework\v2.0.50727\msco rsvw.exe
[Scan path] c:\windows\system32\advapi32.dll
[Scan path] c:\windows\system32\advpack.dll
[Scan path] c:\windows\system32\alg.exe
[Scan path] c:\windows\system32\audiodev.dll
[Scan path] c:\windows\system32\autochk.exe
[Scan path] c:\windows\system32\browseui.dll
[Scan path] c:\windows\system32\cisvc.exe
[Scan path] c:\windows\system32\clipsrv.exe
[Scan path] c:\windows\system32\cnbjmon.dll
[Scan path] c:\windows\system32\comdlg32.dll
[Scan path] c:\windows\system32\crypt32.dll
[Scan path] c:\windows\system32\cryptnet.dll
[Scan path] c:\windows\system32\cscdll.dll
[Scan path] c:\windows\system32\csrss.exe
[Scan path] c:\windows\system32\ctfmon.exe
[Scan path] c:\windows\system32\dfshim.dll
[Scan path] c:\windows\system32\dllhost.exe
[Scan path] c:\windows\system32\dmadmin.exe
[Scan path] c:\windows\system32\drivers\acpi.sys
[Scan path] c:\windows\system32\drivers\aec.sys
[Scan path] c:\windows\system32\drivers\afd.sys
[Scan path] c:\windows\system32\drivers\amdk7.sys
[Scan path] c:\windows\system32\drivers\asyncmac.sys
[Scan path] c:\windows\system32\drivers\atapi.sys
[Scan path] c:\windows\system32\drivers\atmarpc.sys
[Scan path] c:\windows\system32\drivers\audstub.sys
[Scan path] c:\windows\system32\drivers\avg7core.sys
[Scan path] c:\windows\system32\drivers\avg7rsw.sys
[Scan path] c:\windows\system32\drivers\avg7rsxp.sys
[Scan path] c:\windows\system32\drivers\avgascln.sys
[Scan path] c:\windows\system32\drivers\avgclean.sys
[Scan path] c:\windows\system32\drivers\avgtdi.sys
[Scan path] c:\windows\system32\drivers\bsstor.sys
[Scan path] c:\windows\system32\drivers\ccdecode.sys
[Scan path] c:\windows\system32\drivers\cdrom.sys
[Scan path] c:\windows\system32\drivers\co_mon.sys
[Scan path] c:\windows\system32\drivers\disk.sys
[Scan path] c:\windows\system32\drivers\dmboot.sys
[Scan path] c:\windows\system32\drivers\dmio.sys
[Scan path] c:\windows\system32\drivers\dmload.sys
[Scan path] c:\windows\system32\drivers\dmusic.sys
[Scan path] c:\windows\system32\drivers\drmkaud.sys
[Scan path] c:\windows\system32\drivers\fdc.sys
[Scan path] c:\windows\system32\drivers\fetnd5.sys
[Scan path] c:\windows\system32\drivers\flpydisk.sys
[Scan path] c:\windows\system32\drivers\fltmgr.sys
[Scan path] c:\windows\system32\drivers\ftdisk.sys
[Scan path] c:\windows\system32\drivers\gameenum.sys
[Scan path] c:\windows\system32\drivers\gearaspiwdm.sys
[Scan path] c:\windows\system32\drivers\http.sys
[Scan path] c:\windows\system32\drivers\i8042prt.sys
[Scan path] c:\windows\system32\drivers\imapi.sys
[Scan path] c:\windows\system32\drivers\intelppm.sys
[Scan path] c:\windows\system32\drivers\ip6fw.sys
[Scan path] c:\windows\system32\drivers\ipfltdrv.sys
[Scan path] c:\windows\system32\drivers\ipinip.sys
[Scan path] c:\windows\system32\drivers\ipnat.sys
[Scan path] c:\windows\system32\drivers\ipsec.sys
[Scan path] c:\windows\system32\drivers\irenum.sys
[Scan path] c:\windows\system32\drivers\isapnp.sys
[Scan path] c:\windows\system32\drivers\kbdclass.sys
[Scan path] c:\windows\system32\drivers\kmixer.sys
[Scan path] c:\windows\system32\drivers\l8042pr2.sys
[Scan path] c:\windows\system32\drivers\lkbdflt2.sys
[Scan path] c:\windows\system32\drivers\lmouflt2.sys
[Scan path] c:\windows\system32\drivers\mouclass.sys
[Scan path] c:\windows\system32\drivers\mrxdav.sys
[Scan path] c:\windows\system32\drivers\mrxsmb.sys
[Scan path] c:\windows\system32\drivers\msgpc.sys
[Scan path] c:\windows\system32\drivers\mskssrv.sys
[Scan path] c:\windows\system32\drivers\mspclock.sys
[Scan path] c:\windows\system32\drivers\mspqm.sys
[Scan path] c:\windows\system32\drivers\mssmbios.sys
[Scan path] c:\windows\system32\drivers\mstee.sys
[Scan path] c:\windows\system32\drivers\nabtsfec.sys
[Scan path] c:\windows\system32\drivers\ndisip.sys
[Scan path] c:\windows\system32\drivers\ndistapi.sys
[Scan path] c:\windows\system32\drivers\ndisuio.sys
[Scan path] c:\windows\system32\drivers\ndiswan.sys
[Scan path] c:\windows\system32\drivers\netbios.sys
[Scan path] c:\windows\system32\drivers\netbt.sys
[Scan path] c:\windows\system32\drivers\nwlnkflt.sys
[Scan path] c:\windows\system32\drivers\nwlnkfwd.sys
[Scan path] c:\windows\system32\drivers\parport.sys
[Scan path] c:\windows\system32\drivers\pci.sys
[Scan path] c:\windows\system32\drivers\pciide.sys
[Scan path] c:\windows\system32\drivers\psched.sys
[Scan path] c:\windows\system32\drivers\ptilink.sys
[Scan path] c:\windows\system32\drivers\rasacd.sys
[Scan path] c:\windows\system32\drivers\rasl2tp.sys
[Scan path] c:\windows\system32\drivers\raspppoe.sys
[Scan path] c:\windows\system32\drivers\raspptp.sys
[Scan path] c:\windows\system32\drivers\raspti.sys
[Scan path] c:\windows\system32\drivers\rdbss.sys
[Scan path] c:\windows\system32\drivers\rdpcdd.sys
[Scan path] c:\windows\system32\drivers\redbook.sys
[Scan path] c:\windows\system32\drivers\scsiport.sys
[Scan path] c:\windows\system32\drivers\secdrv.sys
[Scan path] c:\windows\system32\drivers\serenum.sys
[Scan path] c:\windows\system32\drivers\serial.sys
[Scan path] c:\windows\system32\drivers\sermouse.sys
[Scan path] c:\windows\system32\drivers\serscan.sys
[Scan path] c:\windows\system32\drivers\sisv.sys
[Scan path] c:\windows\system32\drivers\slip.sys
[Scan path] c:\windows\system32\drivers\snpstd.sys
[Scan path] c:\windows\system32\drivers\splitter.sys
[Scan path] c:\windows\system32\drivers\sr.sys
[Scan path] c:\windows\system32\drivers\srv.sys
[Scan path] c:\windows\system32\drivers\streamip.sys
[Scan path] c:\windows\system32\drivers\swenum.sys
[Scan path] c:\windows\system32\drivers\swmidi.sys
[Scan path] c:\windows\system32\drivers\sysaudio.sys
[Scan path] c:\windows\system32\drivers\tcpip.sys
[Scan path] c:\windows\system32\drivers\teefer.sys
[Scan path] c:\windows\system32\drivers\termdd.sys
[Scan path] c:\windows\system32\drivers\update.sys
[Scan path] c:\windows\system32\drivers\usbehci.sys
[Scan path] c:\windows\system32\drivers\usbhub.sys
[Scan path] c:\windows\system32\drivers\usbscan.sys
[Scan path] c:\windows\system32\drivers\usbstor.sys
[Scan path] c:\windows\system32\drivers\usbuhci.sys
[Scan path] c:\windows\system32\drivers\vga.sys
[Scan path] c:\windows\system32\drivers\viaagp.sys
[Scan path] c:\windows\system32\drivers\viaagp1.sys
[Scan path] c:\windows\system32\drivers\viaide.sys
[Scan path] c:\windows\system32\drivers\viaudio.sys
[Scan path] c:\windows\system32\drivers\wanarp.sys
[Scan path] c:\windows\system32\drivers\wdmaud.sys
[Scan path] c:\windows\system32\drivers\wg3n.sys
[Scan path] c:\windows\system32\drivers\wpsdrvnt.sys
[Scan path] c:\windows\system32\drivers\ws2ifsl.sys
[Scan path] c:\windows\system32\drivers\wstcodec.sys
[Scan path] c:\windows\system32\drivers\wudfpf.sys
[Scan path] c:\windows\system32\drivers\wudfrd.sys
[Scan path] c:\windows\system32\extmgr.dll
[Scan path] c:\windows\system32\gdi32.dll
[Scan path] c:\windows\system32\ie4uinit.exe
[Scan path] c:\windows\system32\iedkcs32.dll
[Scan path] c:\windows\system32\ieframe.dll
[Scan path] c:\windows\system32\ieudinit.exe
[Scan path] c:\windows\system32\imagehlp.dll
[Scan path] c:\windows\system32\imapi.exe
[Scan path] c:\windows\system32\inetcomm.dll
[Scan path] c:\windows\system32\itss.dll
[Scan path] c:\windows\system32\kerberos.dll
[Scan path] c:\windows\system32\kernel32.dll
[Scan path] c:\windows\system32\localspl.dll
[Scan path] c:\windows\system32\locator.exe
[Scan path] c:\windows\system32\logonui.exe
[Scan path] c:\windows\system32\lsass.exe
[Scan path] c:\windows\system32\lz32.dll
[Scan path] c:\windows\system32\mnmsrvc.exe
[Scan path] c:\windows\system32\mscoree.dll
[Scan path] c:\windows\system32\mscories.dll
[Scan path] c:\windows\system32\msdtc.exe
[Scan path] c:\windows\system32\mshtml.dll
[Scan path] c:\windows\system32\msiexec.exe
[Scan path] c:\windows\system32\msv1_0.dll
[Scan path] c:\windows\system32\msvidctl.dll
[Scan path] c:\windows\system32\mswsock.dll
[Scan path] c:\windows\system32\nerocheck.exe
[Scan path] c:\windows\system32\netdde.exe
[Scan path] c:\windows\system32\ntsd.exe
[Scan path] c:\windows\system32\occache.dll
[Scan path] c:\windows\system32\ole32.dll
[Scan path] c:\windows\system32\oleaut32.dll
[Scan path] c:\windows\system32\olecli32.dll
[Scan path] c:\windows\system32\olecnv32.dll
[Scan path] c:\windows\system32\olesvr32.dll
[Scan path] c:\windows\system32\olethk32.dll
[Scan path] c:\windows\system32\pjlmon.dll
[Scan path] c:\windows\system32\psiservice.exe
[Scan path] c:\windows\system32\regsvr32.exe
[Scan path] c:\windows\system32\rpcrt4.dll
[Scan path] c:\windows\system32\rpcss.dll
[Scan path] c:\windows\system32\rsvp.exe
[Scan path] c:\windows\system32\rsvpsp.dll
[Scan path] c:\windows\system32\rundll32.exe
[Scan path] c:\windows\system32\scardsvr.exe
[Scan path] c:\windows\system32\scecli.dll
[Scan path] c:\windows\system32\schannel.dll
[Scan path] c:\windows\system32\sclgntfy.dll
[Scan path] c:\windows\system32\services.exe
[Scan path] c:\windows\system32\sessmgr.exe
[Scan path] c:\windows\system32\shell32.dll
[Scan path] c:\windows\system32\shmgrate.exe
[Scan path] c:\windows\system32\smlogsvc.exe
[Scan path] c:\windows\system32\smss.exe
[Scan path] c:\windows\system32\spoolsv.exe
[Scan path] c:\windows\system32\ssmypics.scr
[Scan path] c:\windows\system32\stobject.dll
[Scan path] c:\windows\system32\svchost.exe
[Scan path] c:\windows\system32\tcpmon.dll
[Scan path] c:\windows\system32\themeui.dll
[Scan path] c:\windows\system32\ups.exe
[Scan path] c:\windows\system32\url.dll
[Scan path] c:\windows\system32\urlmon.dll
[Scan path] c:\windows\system32\usbmon.dll
[Scan path] c:\windows\system32\user32.dll
[Scan path] c:\windows\system32\userinit.exe
[Scan path] c:\windows\system32\version.dll
[Scan path] c:\windows\system32\vssvc.exe
[Scan path] c:\windows\system32\wbem\wmiapsrv.exe
[Scan path] c:\windows\system32\wdfmgr.exe
[Scan path] c:\windows\system32\wdigest.dll
[Scan path] c:\windows\system32\webcheck.dll
[Scan path] c:\windows\system32\wgalogon.dll
[Scan path] c:\windows\system32\wiascr.dll
[Scan path] c:\windows\system32\wininet.dll
[Scan path] c:\windows\system32\winlogon.exe
[Scan path] c:\windows\system32\wldap32.dll
[Scan path] c:\windows\system32\wlnotify.dll
[Scan path] c:\windows\system32\wmfhotfix.dll
[Scan path] c:\windows\system32\wmpshell.dll
[Scan path] c:\windows\system32\wuaucpl.cpl
-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 265
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 5051 Kb/s
Scan time: 00:00:15
-----------------------------------------------------------------------------
================================================== ===========================
Total session statistics
================================================== ===========================
Objects scanned: 265
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 5051 Kb/s
Scan time: 00:00:15
================================================== ===========================
die dealio heb ik niet meer bij software gevonden, ik wist niet vanwaar dat programma kwam en had het al eerder verwijdert, maar blijkbaar is er registersleutel achtergebleven
het programma heeft blijkbaar niets gevonden,ik wacht nog jullie reactie af. mag ik dat programma en die bewaarde log verwijderen?

[Juisterr]

Ja dat kan je verwijderen, en heb je nu nog klachten?????

[cactusken]

geen klachten voor het moment
om die sleutel te verwijderen ga ik via start> programmas > uitvoeren en dan regedit intypen en waar vind ik dan de bewuste sleutels?
ik heb nog wel andere vragen maar zie direkt niet waar ik die hier kan stellen, het gaat over p2p programmas
maar toch al heeeel erg bedankt voor jullie hulp een geluk dat er forums zoals dit bestaan, spaart weeral wat kosten uit

[Juisterr]

Ja hoor die kan je daar vinden.

P2P programma's raad ik in principe af omdat ze gevoelig zijn om malware binnen te halen.

[cactusken]

bedankt aan iedereen van dit team voor de hulp