Geachte,

Hieronder een Hijack logje.
Het probleem is het volgende: Als er connectie is met het internet opent IE7 zich steeds met daarin ADS voor allerlei prullen en andere reclame.

HEt betreft een windows VISTA bussiness-systeem.
Ik ben zelf niet helemaal thuis in de processen die draaien op VISTA, dus wil er zelf ook geen verkeer vantussen halen en het systeem onstabiel maken.

Grtz en dank bij voorbaat!

GOldie

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:56:58, on 5/04/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\CA\eTrustITM\Realmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\UGent\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.28.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\s wg.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "c:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Realtime Monitor] "c:\Program Files\CA\eTrustITM\realmon.exe" -s
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [mess frag body that] "C:\ProgramData\Ref Road Scr.s1konx3"
O4 - HKCU\..\Run: [Compdash] "C:\ProgramData\seek drv drv.297xym6"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: QuickSet.lnk = ?
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = UGent.be
O17 - HKLM\Software\..\Telephony: DomainName = UGent.be
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2738303-93D0-4DF0-9F2B-CE25B2FD1780}: Domain = UGent.be
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = UGent.be
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = UGent.be
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = UGent.be
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = UGent.be
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = UGent.be
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762# # (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe
O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - c:\Program Files\CA\eTrustITM\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Service (InoRT) - CA - c:\Program Files\CA\eTrustITM\InoRT.exe
O23 - Service: eTrust ITM Job Service (InoTask) - CA - c:\Program Files\CA\eTrustITM\InoTask.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 6422 bytes

Klik met je rechter muisknop op Hijackthis en kies voor 'Uitvoeren als Administator'.
Kies vervolgens voor 'Do a system scan only' en vink onderstaande regels aan:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKCU\..\Run: [mess frag body that] "C:\ProgramData\Ref Road Scr.s1konx3"
O4 - HKCU\..\Run: [Compdash] "C:\ProgramData\seek drv drv.297xym6"

Sluit nu alle openstaande vensters, behalve Hijackthis en klik op 'Fix checked'

Download Deljob.exe (http://home.hetnet.nl/~stefsmeenk/deljob) (mirror (http://members.lycos.nl/deljob/)) naar je Bureaublad.
Indien je virusscanner de download van deljob.exe blokkeert,
schakel dan tijdelijk je virusscanner uit of download de zip-versie deljob.zip (http://members.lycos.nl/deljob/deljob.zip) en pak deze uit naar je Bureaublad.

Dubbelklik op Deljob.exe.
Een logje(logit.txt) zal openen, het bestandje kan je ook terugvinden op je Bureaublad.
Post de inhoud van logit.txt in je volgende bericht.

Hallo,

Alvast bedankt voor de reeds verleende hulp, hieronder het logje van deljob

--------------------------------------------------------
No LOP job-files found
--------------------------------------------------------
Files in Windows Tasks folder

--------------------------------------------------------
Export App Data folders
--------------------------------------------------------
Het volume in station C heeft geen naam.
Het volumenummer is F4B8-F968

Map van C:\ProgramData

06/11/2007 12:47 <DIR> Adobe
09/03/2008 23:47 <DIR> APPLEC~1 Apple Computer
21/10/2007 18:11 <DIR> CYBERL~1 CyberLink
16/10/2007 16:46 <DIR> Dell
05/03/2008 23:01 32 ezsid.dat
06/11/2007 12:46 <DIR> FLEXnet
11/02/2008 14:11 <DIR> Google
05/04/2008 14:10 <DIR> GOOGLE~1 Google Updater
16/10/2007 16:55 <DIR> INSTAL~1 InstallShield
20/11/2007 22:39 282.640 LOCKSB~1.UEQ locks bib second.ueqcup
09/12/2007 14:51 <DIR> LOGSOA~1 Log soap film
11/02/2008 14:09 <DIR> Mozilla
09/12/2007 14:51 208.912 REFROA~1.S1K Ref Road Scr.s1konx3
20/10/2007 14:19 <DIR> Roxio
10/12/2007 13:15 94.224 SEEKDR~1.0GS seek drv drv.0gs18p1
10/12/2007 11:26 344.080 SEEKDR~1.0N1 seek drv drv.0n19l
10/12/2007 13:59 86.032 SEEKDR~1.1R5 seek drv drv.1r5ar
10/12/2007 18:22 81.936 SEEKDR~1.297 seek drv drv.297xym6
10/12/2007 23:28 397.328 SEEKDR~1.36H seek drv drv.36hk4
10/12/2007 15:48 159.760 SEEKDR~1.389 seek drv drv.3897x6o
10/12/2007 11:48 20.496 SEEKDR~1.3CG seek drv drv.3cg2hgw
09/12/2007 14:51 86.032 SEEKDR~1.3W5 seek drv drv.3w5ysv
10/12/2007 21:17 163.856 SEEKDR~1.4PW seek drv drv.4pw2hov
09/12/2007 14:51 184.336 SEEKDR~1.94X seek drv drv.94xweil
10/12/2007 20:33 352.272 SEEKDR~1.B6S seek drv drv.b6sk54
10/12/2007 17:16 364.560 SEEKDR~1.DIR seek drv drv.direo
10/12/2007 22:44 307.216 SEEKDR~1.EGH seek drv drv.egh376
10/12/2007 19:49 16 SEEKDR~1.EZA seek drv drv.ezamh
10/12/2007 22:22 16 SEEKDR~1.EZG seek drv drv.ezg20da
10/12/2007 18:00 94.224 SEEKDR~1.FHC seek drv drv.fhcuggn
10/12/2007 16:54 282.640 SEEKDR~1.FQD seek drv drv.fqdhu
10/12/2007 15:26 106.512 SEEKDR~1.HBC seek drv drv.hbc8dd
10/12/2007 19:05 200.720 SEEKDR~1.HBY seek drv drv.hbyfn
10/12/2007 21:39 4.112 SEEKDR~1.IUO seek drv drv.iuolv
10/12/2007 20:11 61.456 SEEKDR~1.K1P seek drv drv.k1pnc
10/12/2007 16:10 163.856 SEEKDR~1.KRY seek drv drv.kryy9q
10/12/2007 23:06 229.392 SEEKDR~1.LRR seek drv drv.lrras7
10/12/2007 16:32 106.512 SEEKDR~1.NT0 seek drv drv.nt018
10/12/2007 18:43 217.104 SEEKDR~1.ORX seek drv drv.orx0j2
10/12/2007 12:53 237.584 SEEKDR~1.RKS seek drv drv.rksgy
10/12/2007 12:09 380.944 SEEKDR~1.RVB seek drv drv.rvbo4
10/12/2007 20:55 94.224 SEEKDR~1.S7N seek drv drv.s7nfe
10/12/2007 15:05 118.800 SEEKDR~1.SO0 seek drv drv.so0pvk
10/12/2007 14:21 188.432 SEEKDR~1.TQA seek drv drv.tqai9rr
10/12/2007 13:37 16.400 SEEKDR~1.U2U seek drv drv.u2uvxmn
10/12/2007 14:43 114.704 SEEKDR~1.UBF seek drv drv.ubfj5
20/11/2007 22:38 344.080 SEEKDR~1.UXC seek drv drv.uxcvwr
10/12/2007 22:00 249.872 SEEKDR~1.XAD seek drv drv.xadj5q
10/12/2007 17:38 126.992 SEEKDR~1.XP6 seek drv drv.xp65ub
10/12/2007 19:27 102.416 SEEKDR~1.YU4 seek drv drv.yu4dcx
10/12/2007 12:31 397.328 SEEKDR~1.ZKV seek drv drv.zkvdbmo
19/10/2007 17:39 <DIR> Skype
16/10/2007 16:52 <DIR> Sonic
09/12/2007 14:51 <DIR> TRANSO~1 Trans Once Mess Frag
40 bestand(en) 6.972.048 bytes
14 map(pen) 3.465.027.584 bytes beschikbaar
--------------------------------------------------------
All User Accounts
--------------------------------------------------------
Administrator
Public
UGent
--------------------------------------------------------

Open een leeg kladblok venster en kopieer/plak onderstaande dikgedrukte tekst daarin:


@ECHO OFF
CD \
CD C:\ProgramData
IF EXIST log.txt DEL log.txt
ECHO Deleting files>>log.txt
FOR %%g in (
"Ref Road Scr.*"
"seek drv drv.*"
) DO (
IF EXIST %%g (
ATTRIB -r -s -h %%g
DEL %%g
IF EXIST %%g (
ECHO %%g not deleted>>log.txt
) ELSE (
ECHO %%g deleted>>log.txt)
) ELSE (
ECHO %%g not found>>log.txt))
START NOTEPAD.EXE log.txt


Sla het vervolgens op als fix.bat op je Bureaublad
Kies bij Opslaan als type voor Alle bestanden.
Klik met je rechter muisknop op fix.bat en kies voor 'Uitvoeren als Administrator'

Post de inhoud van log.txt samen met een nieuw deljob logje in je volgende bericht.
Heb je nog problemen?

Geachte,

Bedankt voor de gedane moeite.

Ik heb het bat file-tje gerunned en dit is de log:

Deleting files
Ref Road Scr.s1konx3 not deleted
seek drv drv.0gs18p1 not deleted
seek drv drv.0n19l not deleted
seek drv drv.1r5ar not deleted
seek drv drv.297xym6 not deleted
seek drv drv.36hk4 not deleted
seek drv drv.3897x6o not deleted
seek drv drv.3cg2hgw not deleted
seek drv drv.3w5ysv not deleted
seek drv drv.4pw2hov not deleted
seek drv drv.94xweil not deleted
seek drv drv.b6sk54 not deleted
seek drv drv.direo not deleted
seek drv drv.egh376 not deleted
seek drv drv.ezamh not deleted
seek drv drv.ezg20da not deleted
seek drv drv.fhcuggn not deleted
seek drv drv.fqdhu not deleted
seek drv drv.hbc8dd not deleted
seek drv drv.hbyfn not deleted
seek drv drv.iuolv not deleted
seek drv drv.k1pnc not deleted
seek drv drv.kryy9q not deleted
seek drv drv.lrras7 not deleted
seek drv drv.nt018 not deleted
seek drv drv.orx0j2 not deleted
seek drv drv.rksgy not deleted
seek drv drv.rvbo4 not deleted
seek drv drv.s7nfe not deleted
seek drv drv.so0pvk not deleted
seek drv drv.tqai9rr not deleted
seek drv drv.u2uvxmn not deleted
seek drv drv.ubfj5 not deleted
seek drv drv.uxcvwr not deleted
seek drv drv.xadj5q not deleted
seek drv drv.xp65ub not deleted
seek drv drv.yu4dcx not deleted
seek drv drv.zkvdbmo not deleted

En dan de nwe logit van Deljob:

--------------------------------------------------------
No LOP job-files found
--------------------------------------------------------
Files in Windows Tasks folder

--------------------------------------------------------
Export App Data folders
--------------------------------------------------------
Het volume in station C heeft geen naam.
Het volumenummer is F4B8-F968

Map van C:\ProgramData

06/11/2007 12:47 <DIR> Adobe
09/03/2008 23:47 <DIR> APPLEC~1 Apple Computer
21/10/2007 18:11 <DIR> CYBERL~1 CyberLink
16/10/2007 16:46 <DIR> Dell
05/03/2008 23:01 32 ezsid.dat
06/11/2007 12:46 <DIR> FLEXnet
11/02/2008 14:11 <DIR> Google
06/04/2008 16:18 <DIR> GOOGLE~1 Google Updater
16/10/2007 16:55 <DIR> INSTAL~1 InstallShield
20/11/2007 22:39 282.640 LOCKSB~1.UEQ locks bib second.ueqcup
09/12/2007 14:51 <DIR> LOGSOA~1 Log soap film
07/04/2008 13:37 1.268 log.txt
11/02/2008 14:09 <DIR> Mozilla
09/12/2007 14:51 208.912 REFROA~1.S1K Ref Road Scr.s1konx3
20/10/2007 14:19 <DIR> Roxio
10/12/2007 13:15 94.224 SEEKDR~1.0GS seek drv drv.0gs18p1
10/12/2007 11:26 344.080 SEEKDR~1.0N1 seek drv drv.0n19l
10/12/2007 13:59 86.032 SEEKDR~1.1R5 seek drv drv.1r5ar
10/12/2007 18:22 81.936 SEEKDR~1.297 seek drv drv.297xym6
10/12/2007 23:28 397.328 SEEKDR~1.36H seek drv drv.36hk4
10/12/2007 15:48 159.760 SEEKDR~1.389 seek drv drv.3897x6o
10/12/2007 11:48 20.496 SEEKDR~1.3CG seek drv drv.3cg2hgw
09/12/2007 14:51 86.032 SEEKDR~1.3W5 seek drv drv.3w5ysv
10/12/2007 21:17 163.856 SEEKDR~1.4PW seek drv drv.4pw2hov
09/12/2007 14:51 184.336 SEEKDR~1.94X seek drv drv.94xweil
10/12/2007 20:33 352.272 SEEKDR~1.B6S seek drv drv.b6sk54
10/12/2007 17:16 364.560 SEEKDR~1.DIR seek drv drv.direo
10/12/2007 22:44 307.216 SEEKDR~1.EGH seek drv drv.egh376
10/12/2007 19:49 16 SEEKDR~1.EZA seek drv drv.ezamh
10/12/2007 22:22 16 SEEKDR~1.EZG seek drv drv.ezg20da
10/12/2007 18:00 94.224 SEEKDR~1.FHC seek drv drv.fhcuggn
10/12/2007 16:54 282.640 SEEKDR~1.FQD seek drv drv.fqdhu
10/12/2007 15:26 106.512 SEEKDR~1.HBC seek drv drv.hbc8dd
10/12/2007 19:05 200.720 SEEKDR~1.HBY seek drv drv.hbyfn
10/12/2007 21:39 4.112 SEEKDR~1.IUO seek drv drv.iuolv
10/12/2007 20:11 61.456 SEEKDR~1.K1P seek drv drv.k1pnc
10/12/2007 16:10 163.856 SEEKDR~1.KRY seek drv drv.kryy9q
10/12/2007 23:06 229.392 SEEKDR~1.LRR seek drv drv.lrras7
10/12/2007 16:32 106.512 SEEKDR~1.NT0 seek drv drv.nt018
10/12/2007 18:43 217.104 SEEKDR~1.ORX seek drv drv.orx0j2
10/12/2007 12:53 237.584 SEEKDR~1.RKS seek drv drv.rksgy
10/12/2007 12:09 380.944 SEEKDR~1.RVB seek drv drv.rvbo4
10/12/2007 20:55 94.224 SEEKDR~1.S7N seek drv drv.s7nfe
10/12/2007 15:05 118.800 SEEKDR~1.SO0 seek drv drv.so0pvk
10/12/2007 14:21 188.432 SEEKDR~1.TQA seek drv drv.tqai9rr
10/12/2007 13:37 16.400 SEEKDR~1.U2U seek drv drv.u2uvxmn
10/12/2007 14:43 114.704 SEEKDR~1.UBF seek drv drv.ubfj5
20/11/2007 22:38 344.080 SEEKDR~1.UXC seek drv drv.uxcvwr
10/12/2007 22:00 249.872 SEEKDR~1.XAD seek drv drv.xadj5q
10/12/2007 17:38 126.992 SEEKDR~1.XP6 seek drv drv.xp65ub
10/12/2007 19:27 102.416 SEEKDR~1.YU4 seek drv drv.yu4dcx
10/12/2007 12:31 397.328 SEEKDR~1.ZKV seek drv drv.zkvdbmo
19/10/2007 17:39 <DIR> Skype
16/10/2007 16:52 <DIR> Sonic
09/12/2007 14:51 <DIR> TRANSO~1 Trans Once Mess Frag
41 bestand(en) 6.973.316 bytes
14 map(pen) 3.429.445.632 bytes beschikbaar
--------------------------------------------------------
All User Accounts
--------------------------------------------------------
Administrator
Public
UGent
--------------------------------------------------------

Ik heb wel de indruk dat de frequentie van de popups flink is afgenomen. Ik meen nog 1 popup te hebben gehad sinds de vorige instructies.

Met vriendelijke groet,

Goldie

Ze staan er helaas nog steeds :(

Kan je de batfile eens in veilige modus runnen:
http://users.telenet.be/marcvn/spyware/1378056.htm

Zorg dat je dit ook doet:


Klik met je rechter muisknop op fix.bat en kies voor 'Uitvoeren als Administrator'


Post ook een nieuw deljob logje.

Geachte,

Sorry voor het lange wachten, maar het is een beetje moeilijk communiceren met mijn zus die op kot zit. HEt is op haar laptop dat het probleem zich voor doet.
Ze heeft de stappen uitgevoerd zoals laatst gevraagd:

Deleting files
Ref Road Scr.s1konx3 not deleted
seek drv drv.0gs18p1 not deleted
seek drv drv.0n19l not deleted
seek drv drv.1r5ar not deleted
seek drv drv.297xym6 not deleted
seek drv drv.36hk4 not deleted
seek drv drv.3897x6o not deleted
seek drv drv.3cg2hgw not deleted
seek drv drv.3w5ysv not deleted
seek drv drv.4pw2hov not deleted
seek drv drv.94xweil not deleted
seek drv drv.b6sk54 not deleted
seek drv drv.direo not deleted
seek drv drv.egh376 not deleted
seek drv drv.ezamh not deleted
seek drv drv.ezg20da not deleted
seek drv drv.fhcuggn not deleted
seek drv drv.fqdhu not deleted
seek drv drv.hbc8dd not deleted
seek drv drv.hbyfn not deleted
seek drv drv.iuolv not deleted
seek drv drv.k1pnc not deleted
seek drv drv.kryy9q not deleted
seek drv drv.lrras7 not deleted
seek drv drv.nt018 not deleted
seek drv drv.orx0j2 not deleted
seek drv drv.rksgy not deleted
seek drv drv.rvbo4 not deleted
seek drv drv.s7nfe not deleted
seek drv drv.so0pvk not deleted
seek drv drv.tqai9rr not deleted
seek drv drv.u2uvxmn not deleted
seek drv drv.ubfj5 not deleted
seek drv drv.uxcvwr not deleted
seek drv drv.xadj5q not deleted
seek drv drv.xp65ub not deleted
seek drv drv.yu4dcx not deleted
seek drv drv.zkvdbmo not deleted


--------------------------------------------------------
No LOP job-files found
--------------------------------------------------------
Files in Windows Tasks folder

--------------------------------------------------------
Export App Data folders
--------------------------------------------------------
Het volume in station C heeft geen naam.
Het volumenummer is F4B8-F968

Map van C:\ProgramData

06/11/2007 12:47 <DIR> Adobe
09/03/2008 23:47 <DIR> APPLEC~1 Apple Computer
21/10/2007 18:11 <DIR> CYBERL~1 CyberLink
16/10/2007 16:46 <DIR> Dell
05/03/2008 23:01 32 ezsid.dat
06/11/2007 12:46 <DIR> FLEXnet
11/02/2008 14:11 <DIR> Google
09/04/2008 14:56 <DIR> GOOGLE~1 Google Updater
16/10/2007 16:55 <DIR> INSTAL~1 InstallShield
20/11/2007 22:39 282.640 LOCKSB~1.UEQ locks bib second.ueqcup
09/12/2007 14:51 <DIR> LOGSOA~1 Log soap film
10/04/2008 10:20 1.268 log.txt
11/02/2008 14:09 <DIR> Mozilla
09/12/2007 14:51 208.912 REFROA~1.S1K Ref Road Scr.s1konx3
20/10/2007 14:19 <DIR> Roxio
10/12/2007 13:15 94.224 SEEKDR~1.0GS seek drv drv.0gs18p1
10/12/2007 11:26 344.080 SEEKDR~1.0N1 seek drv drv.0n19l
10/12/2007 13:59 86.032 SEEKDR~1.1R5 seek drv drv.1r5ar
10/12/2007 18:22 81.936 SEEKDR~1.297 seek drv drv.297xym6
10/12/2007 23:28 397.328 SEEKDR~1.36H seek drv drv.36hk4
10/12/2007 15:48 159.760 SEEKDR~1.389 seek drv drv.3897x6o
10/12/2007 11:48 20.496 SEEKDR~1.3CG seek drv drv.3cg2hgw
09/12/2007 14:51 86.032 SEEKDR~1.3W5 seek drv drv.3w5ysv
10/12/2007 21:17 163.856 SEEKDR~1.4PW seek drv drv.4pw2hov
09/12/2007 14:51 184.336 SEEKDR~1.94X seek drv drv.94xweil
10/12/2007 20:33 352.272 SEEKDR~1.B6S seek drv drv.b6sk54
10/12/2007 17:16 364.560 SEEKDR~1.DIR seek drv drv.direo
10/12/2007 22:44 307.216 SEEKDR~1.EGH seek drv drv.egh376
10/12/2007 19:49 16 SEEKDR~1.EZA seek drv drv.ezamh
10/12/2007 22:22 16 SEEKDR~1.EZG seek drv drv.ezg20da
10/12/2007 18:00 94.224 SEEKDR~1.FHC seek drv drv.fhcuggn
10/12/2007 16:54 282.640 SEEKDR~1.FQD seek drv drv.fqdhu
10/12/2007 15:26 106.512 SEEKDR~1.HBC seek drv drv.hbc8dd
10/12/2007 19:05 200.720 SEEKDR~1.HBY seek drv drv.hbyfn
10/12/2007 21:39 4.112 SEEKDR~1.IUO seek drv drv.iuolv
10/12/2007 20:11 61.456 SEEKDR~1.K1P seek drv drv.k1pnc
10/12/2007 16:10 163.856 SEEKDR~1.KRY seek drv drv.kryy9q
10/12/2007 23:06 229.392 SEEKDR~1.LRR seek drv drv.lrras7
10/12/2007 16:32 106.512 SEEKDR~1.NT0 seek drv drv.nt018
10/12/2007 18:43 217.104 SEEKDR~1.ORX seek drv drv.orx0j2
10/12/2007 12:53 237.584 SEEKDR~1.RKS seek drv drv.rksgy
10/12/2007 12:09 380.944 SEEKDR~1.RVB seek drv drv.rvbo4
10/12/2007 20:55 94.224 SEEKDR~1.S7N seek drv drv.s7nfe
10/12/2007 15:05 118.800 SEEKDR~1.SO0 seek drv drv.so0pvk
10/12/2007 14:21 188.432 SEEKDR~1.TQA seek drv drv.tqai9rr
10/12/2007 13:37 16.400 SEEKDR~1.U2U seek drv drv.u2uvxmn
10/12/2007 14:43 114.704 SEEKDR~1.UBF seek drv drv.ubfj5
20/11/2007 22:38 344.080 SEEKDR~1.UXC seek drv drv.uxcvwr
10/12/2007 22:00 249.872 SEEKDR~1.XAD seek drv drv.xadj5q
10/12/2007 17:38 126.992 SEEKDR~1.XP6 seek drv drv.xp65ub
10/12/2007 19:27 102.416 SEEKDR~1.YU4 seek drv drv.yu4dcx
10/12/2007 12:31 397.328 SEEKDR~1.ZKV seek drv drv.zkvdbmo
19/10/2007 17:39 <DIR> Skype
16/10/2007 16:52 <DIR> Sonic
09/12/2007 14:51 <DIR> TRANSO~1 Trans Once Mess Frag
41 bestand(en) 6.973.316 bytes
14 map(pen) 1.127.063.552 bytes beschikbaar
--------------------------------------------------------
All User Accounts
--------------------------------------------------------
Administrator
Public
UGent
--------------------------------------------------------


Ze heeft sinds vorige post wel geen popups meer.

Dank u

Mvg

Toch is nog niet alles weg hoor.

Download OTMoveIt2 (http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe) (by OldTimer) naar je Bureaublad.
* Dubbelklik op OTMoveIt2.exe om de tool te starten.
* Kopiëer (selecteren en druk Ctrl-C) alle onderstaande, vetgedrukte tekst :

C:\ProgramData\seek drv drv.0gs18p1
C:\ProgramData\seek drv drv.0n19l
C:\ProgramData\seek drv drv.1r5ar
C:\ProgramData\seek drv drv.297xym6
C:\ProgramData\seek drv drv.36hk4
C:\ProgramData\seek drv drv.3897x6o
C:\ProgramData\seek drv drv.3cg2hgw
C:\ProgramData\seek drv drv.3w5ysv
C:\ProgramData\seek drv drv.4pw2hov
C:\ProgramData\seek drv drv.94xweil
C:\ProgramData\seek drv drv.b6sk54
C:\ProgramData\seek drv drv.direo
C:\ProgramData\seek drv drv.egh376
C:\ProgramData\seek drv drv.ezamh
C:\ProgramData\seek drv drv.ezg20da
C:\ProgramData\seek drv drv.fhcuggn
C:\ProgramData\seek drv drv.fqdhu
C:\ProgramData\seek drv drv.hbc8dd
C:\ProgramData\seek drv drv.hbyfn
C:\ProgramData\seek drv drv.iuolv
C:\ProgramData\seek drv drv.k1pnc
C:\ProgramData\seek drv drv.kryy9q
C:\ProgramData\seek drv drv.lrras7
C:\ProgramData\seek drv drv.nt018
C:\ProgramData\seek drv drv.orx0j2
C:\ProgramData\seek drv drv.rksgy
C:\ProgramData\seek drv drv.rvbo4
C:\ProgramData\seek drv drv.s7nfe
C:\ProgramData\seek drv drv.so0pvk
C:\ProgramData\seek drv drv.tqai9rr
C:\ProgramData\seek drv drv.u2uvxmn
C:\ProgramData\seek drv drv.ubfj5
C:\ProgramData\seek drv drv.uxcvwr
C:\ProgramData\seek drv drv.xadj5q
C:\ProgramData\seek drv drv.xp65ub
C:\ProgramData\seek drv drv.yu4dcx
C:\ProgramData\seek drv drv.zkvdbmo
C:\ProgramData\Trans Once Mess Frag

* Plak de gekopiëerde tekst (druk Ctrl-V) in het "Paste List of Files/Folders to be moved" venster
* Klik op de rode MoveIt! knop
* Kopiëer en plak de inhoud van het rechter resultaat-venster in je volgende antwoord,
(of het logje dat je terugvindt als C:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log).
* Sluit OTMoveIt2

Indien een bestand of map niet onmiddellijk kan verplaatst worden,
kun je gevraagd worden om de PC te herstarten teneinde het verplaatsen te beeïndigen.
Klik dan op Ja/Yes.

Hallo,

Hier de logfile:

C:\ProgramData\seek drv drv.0gs18p1 moved successfully.
C:\ProgramData\seek drv drv.0n19l moved successfully.
C:\ProgramData\seek drv drv.1r5ar moved successfully.
C:\ProgramData\seek drv drv.297xym6 moved successfully.
C:\ProgramData\seek drv drv.36hk4 moved successfully.
C:\ProgramData\seek drv drv.3897x6o moved successfully.
C:\ProgramData\seek drv drv.3cg2hgw moved successfully.
C:\ProgramData\seek drv drv.3w5ysv moved successfully.
C:\ProgramData\seek drv drv.4pw2hov moved successfully.
C:\ProgramData\seek drv drv.94xweil moved successfully.
C:\ProgramData\seek drv drv.b6sk54 moved successfully.
C:\ProgramData\seek drv drv.direo moved successfully.
C:\ProgramData\seek drv drv.egh376 moved successfully.
C:\ProgramData\seek drv drv.ezamh moved successfully.
C:\ProgramData\seek drv drv.ezg20da moved successfully.
C:\ProgramData\seek drv drv.fhcuggn moved successfully.
C:\ProgramData\seek drv drv.fqdhu moved successfully.
C:\ProgramData\seek drv drv.hbc8dd moved successfully.
C:\ProgramData\seek drv drv.hbyfn moved successfully.
C:\ProgramData\seek drv drv.iuolv moved successfully.
C:\ProgramData\seek drv drv.k1pnc moved successfully.
C:\ProgramData\seek drv drv.kryy9q moved successfully.
C:\ProgramData\seek drv drv.lrras7 moved successfully.
C:\ProgramData\seek drv drv.nt018 moved successfully.
C:\ProgramData\seek drv drv.orx0j2 moved successfully.
C:\ProgramData\seek drv drv.rksgy moved successfully.
C:\ProgramData\seek drv drv.rvbo4 moved successfully.
C:\ProgramData\seek drv drv.s7nfe moved successfully.
C:\ProgramData\seek drv drv.so0pvk moved successfully.
C:\ProgramData\seek drv drv.tqai9rr moved successfully.
C:\ProgramData\seek drv drv.u2uvxmn moved successfully.
C:\ProgramData\seek drv drv.ubfj5 moved successfully.
C:\ProgramData\seek drv drv.uxcvwr moved successfully.
C:\ProgramData\seek drv drv.xadj5q moved successfully.
C:\ProgramData\seek drv drv.xp65ub moved successfully.
C:\ProgramData\seek drv drv.yu4dcx moved successfully.
C:\ProgramData\seek drv drv.zkvdbmo moved successfully.
C:\ProgramData\Trans Once Mess Frag moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04122008_100430

Heb wel nog 2 popups ontvangen. Was wel voor de removal...

Mvg

Dat ziet er al beter uit :)
Kijk het even aan en vermeldt over een paar dagen hoe het met je problemen is.