Goeimiddag,

Ik heb hier een PC die geen internet verbinding meer heeft.
In apparaatbeheer zie ik dat het een driver probleem is.
Als ik de drivers herinstalleer blijft er nog steeds een geel uitroepteken bij de netwerkkaart staan.

Dit is de foutmelding:

Windows kan het apparaatstuurprogramma voor dit apparaat niet in het geheugen laden code 39 netwerk adapter

Als ik hierop google zie ik dat het iets met mailware te maken kan hebben.
Ik heb de stappen op deze pagina uitgevoerd:

http://www.hijackthis.nl/forum/viewtopic.php?f=86&t=24197

MailwareBytes heeft 23 objecten gevonden.
Log:



Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Databaseversie: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

28-8-2010 11:52:17
mbam-log-2010-08-28 (11-52-17).txt

Scantype: Snelle scan
Objecten gescand: 117746
Verstreken tijd: 4 minuut/minuten, 33 seconde(n)

Geheugenprocessen geÔnfecteerd: 0
Geheugenmodulen geÔnfecteerd: 0
Registersleutels geÔnfecteerd: 2
Registerwaarden geÔnfecteerd: 3
Registerdata geÔnfecteerd: 2
Mappen geÔnfecteerd: 7
Bestanden geÔnfecteerd: 13

Geheugenprocessen geÔnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geÔnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registersleutels geÔnfecteerd:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> No action taken.

Registerwaarden geÔnfecteerd:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.Zango) -> No action taken.

Registerdata geÔnfecteerd:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Mappen geÔnfecteerd:
C:\Documents and Settings\LocalService\Application Data\ShoppingReport (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\db (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\dwld (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\report (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\res1 (Adware.ShopperReports) -> No action taken.
C:\Program Files\Ecobar (Adware.Ecobar) -> No action taken.

Bestanden geÔnfecteerd:
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\Config.xml (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\report\aggr_storage.xml (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\report\send_storage.xml (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\LocalService\Application Data\ShoppingReport\cs\res1\WhiteList.dbs (Adware.ShopperReports) -> No action taken.
C:\Program Files\Ecobar\basis.xml (Adware.Ecobar) -> No action taken.
C:\Program Files\Ecobar\icons.bmp (Adware.Ecobar) -> No action taken.
C:\Program Files\Ecobar\info.txt (Adware.Ecobar) -> No action taken.
C:\Program Files\Ecobar\version.txt (Adware.Ecobar) -> No action taken.
C:\Program Files\Ecobar\your_logo.png (Adware.Ecobar) -> No action taken.
C:\WINDOWS\system32\H8SRTuyktlevuoh.dat (Rootkit.TDSS) -> No action taken.


Vervolgens heb ik weer even geprobeerd of ik nu de netwerk drivers wel kan instaleren maar dit lukt nog steeds niet:
Hierbij een Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:15:11, on 28-8-2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\program files\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\McAfee.com\Agent\mcregwiz.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Citrix\ICA Client\concentr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Citrix\ICA Client\wfcrun32.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\mcregwiz.exe /autorun
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" –auto-start
O4 - HKLM\..\Run: [ConnectionCenter] "C:\Program Files\Citrix\ICA Client\concentr.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150596.exe -Update -1150596 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; AskTB5.6)" -"http://www.spele.nl/game/ping_pong/ping_pong_2.html"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {3E90FFF5-1347-45B9-91F6-DA47926E9697} (PlaNet SysInfo Agent) - http://www.ziggo.nl/f-secure/systemcheck/PlaNetSysInfo.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-NL/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1208852963781
O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://www.playwhat.com/solidPlugin/solidstateion.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://www.ziggo.nl/f-secure/ols/fscax.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieÎn - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - D:\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

–
End of file - 9865 bytes

Netwerk:
Rtl8139 RealTek 8139/8100/8110s LAN driver.

Bedankt.

Je log ziet er niet slecht uit!

Download de [b:a5746b728b]ASK Toolbar Remover[/b:a5746b728b] om deze dubieuze toolbar te de-installeren!
http://www.chip.de/downloads/ASK-Toolbar-Remover_43117721.html

En dan herstart je MBAM voor een nieuwe scan - maar eerst zorg je ervoor, dat je MBAM upate (tab Update)
De huidige versie van MBAM is 4493!

[quote:f7639bf4be="Abraham54"]Je log ziet er niet slecht uit!

Download de [b:f7639bf4be]ASK Toolbar Remover[/b:f7639bf4be] om deze dubieuze toolbar te de-installeren!
http://www.chip.de/downloads/ASK-Toolbar-Remover_43117721.html

En dan herstart je MBAM voor een nieuwe scan - maar eerst zorg je ervoor, dat je MBAM upate (tab Update)
De huidige versie van MBAM is 4493![/quote:f7639bf4be]

Ok ik zal dat even doen.
Alleen kan ik MBAM niet updaten omdat ik geen internet verbinding heb.

Doe het volgende:

[b:73781b5e21]de proxie-instellingen van Internet Explorer herstellen:[/b:73781b5e21]
[list:73781b5e21][*:73781b5e21] Ga via Start naar Configuratiescherm en klik op Internetopties; alternatief klik je inde menubalk van Internet Explorer op "Extra" in da

kies je in het uitklapmenu voor Internetopties.
[*:73781b5e21] Klik vervolgens op de tab "Verbindingen" en klik daar op de knop "Lan-instellingen
[*:73781b5e21] Verwijder het vinkje bij "Een proxyserver voor het LAN-netwerk gebruiken"
[*:73781b5e21] Klik achtereenvolgens tweemaal op de knop "OK"; heb je deze instellingen via Internet Explorer veranderd, dan de browser afsluiten.[/list:u:73781b5e21]

[quote:fe69551197="Abraham54"]Doe het volgende:
Verwijder het vinkje bij "Een proxyserver voor het LAN-netwerk gebruiken"
[/quote:fe69551197]

Dit staat al niet aangevinkt.
Enige vinkje wat er staat is "instellingen automatisch detecteren".

Bij: internetopties > tab: verbindingen
Zie ik dit:

Instellingen voor inbelverbinding en virtuele particuliere netwerken

* directe verbinding
* virtuele particuliere verbinding (standaard)

Bij mijn windows 7 is dit venstertje leeg.

Het vinkje bij "instellingen automatisch detecteren" mag je weghalen.

Driverlink: http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=6&PFid=6&Level=5&Conn=4&DownTypeID=3&GetDown=false

Nee, het wil niet lukken.
Ik had de installatie afgerond maar krijg dan dit:

[img:7af7088dc7]http://www.xup.in/pic,81605890/dfsdf.PNG[/img:7af7088dc7]

Weer die (Code 39) als je daarop google kom je weer uit op dat mailware.
Maar ik kan MailwareBytes niet updaten. :?

Doe het volgende: [b:ea1cfdcdcb]laat Combofix jouw Windows scannen (klik)[/b:ea1cfdcdcb].
[b:ea1cfdcdcb]Hoe Combofix goed te gebruiken (klik)[/b:ea1cfdcdcb]
[list:ea1cfdcdcb][*:ea1cfdcdcb][b:ea1cfdcdcb] Om Combofix te kunnen gebruiken geldt het volgende:[/b:ea1cfdcdcb]
[*:ea1cfdcdcb]

Owk ik heb gescanned, alleen kan ik recovery console niet instaleren omdat ik nog geen internet heb denk vermeld het er even bij.

Hoi - CombofFx is vanuit een verkeerde lokatie gestart,

ComboFix dient absoluut vanaf het bureaublad gestart te worden!

Dus verplaats ComboFix daarnaar toe en doe dan nogmaals een scan en post het log aansluitend in de standaard letterkleur!

Want dat lichtgroen is echt lastig!

ComboFix 10-08-27.03 - H. Schouten 28-08-2010 17:49:21.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.2047.1568 [GMT 2:00]
Gestart vanuit: d:\h. schouten\Bureaublad\ComboFix.exe

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((( Bestanden Gemaakt van 2010-07-28 to 2010-08-28 ))))))))))))))))))))))))))))))
.

2010-08-28 13:11 . 2009-03-03 18:18 73728 —-a-w- c:\windows\system32\RtNicProp32.dll
2010-08-28 11:20 . 2008-04-14 15:39 14720 -c–a-w- c:\windows\system32\dllcache\kbdhid.sys
2010-08-28 11:20 . 2008-04-14 15:39 14720 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2010-08-28 11:20 . 2008-04-13 17:45 32128 -c–a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-08-28 11:20 . 2008-04-13 17:45 32128 —-a-w- c:\windows\system32\drivers\usbccgp.sys
2010-08-28 10:14 . 2010-08-28 10:14 388096 —-a-r- c:\documents and settings\H. Schouten\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-08-28 10:14 . 2010-08-28 10:14 ——– d—–w- c:\program files\Trend Micro
2010-08-28 09:58 . 2010-08-28 09:58 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-08-28 09:58 . 2010-08-28 09:58 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2010-08-28 09:45 . 2010-08-28 09:45 ——– d—–w- c:\documents and settings\H. Schouten\Application Data\Malwarebytes
2010-08-28 09:45 . 2010-04-29 13:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-28 09:45 . 2010-08-28 09:45 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-08-28 09:45 . 2010-08-28 09:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-28 09:45 . 2010-04-29 13:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-08-28 09:36 . 2010-08-28 14:24 ——– d–h–r- c:\documents and settings\H. Schouten\Onlangs geopend
2010-08-28 09:16 . 2010-08-28 09:30 ——– d—–w- c:\program files\CCleaner
2010-08-28 08:55 . 2010-08-28 08:55 ——– d—–w- c:\program files\Lavalys
2010-08-28 08:49 . 2010-08-28 08:49 ——– d—–w- C:\Bas
2010-08-28 08:48 . 2010-08-28 08:48 ——– d—–w- C:\giglan
2010-08-28 08:47 . 2010-08-28 08:47 ——– d—–w- C:\Gig
2010-08-27 13:55 . 2010-08-28 14:13 15600 —-a-w- c:\windows\gdrv.sys
2010-08-14 10:42 . 2010-08-14 10:42 ——– d—–w- c:\documents and settings\H. Schouten\Local Settings\Application Data\Help
2010-08-13 08:51 . 2010-08-13 08:51 ——– d—–w- c:\windows\system32\MpEngineStore
2010-08-06 13:47 . 2010-08-06 13:47 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-08-04 14:32 . 2010-08-04 14:32 ——– d—–w- c:\windows\system32\wbem\Repository

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-28 14:10 . 2009-07-24 10:58 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee.com
2010-08-28 13:11 . 2008-04-22 07:58 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-08-28 13:10 . 2008-04-22 07:58 ——– d—–w- c:\program files\Realtek
2010-08-28 13:09 . 2009-05-15 17:24 ——– d—–w- c:\program files\Google
2010-08-28 08:31 . 2006-03-02 12:00 554884 —-a-w- c:\windows\system32\perfh013.dat
2010-08-28 08:31 . 2006-03-02 12:00 105060 —-a-w- c:\windows\system32\perfc013.dat
2010-08-13 10:08 . 2008-04-30 08:43 ——– d—–w- c:\documents and settings\H. Schouten\Application Data\LimeWire
2010-07-29 12:35 . 2010-07-29 12:35 ——– d—–w- c:\documents and settings\H. Schouten\Application Data\Toolbar4
2010-07-29 12:26 . 2010-07-29 12:26 ——– d—–w- c:\program files\Ubisoft
2010-06-30 12:33 . 2006-03-02 12:00 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-24 12:27 . 2006-03-02 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2006-03-02 12:00 1852032 —-a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2006-03-02 12:00 354304 —-a-w- c:\windows\system32\drivers\srv.sys
2010-06-20 13:07 . 2010-06-20 13:07 98304 —-a-w- c:\documents and settings\H. Schouten\Application Data\LimeWire\browser\xulrunner
ssdbm3.dll
2010-06-17 14:03 . 2006-03-02 12:00 80384 —-a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2008-04-21 14:04 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:43 . 2006-03-02 12:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2006-10-11 08:04 . 2008-08-02 13:33 61036 -c–a-w- c:\program files\mozilla firefox\components\jar50.dll
2006-10-11 08:04 . 2008-08-02 13:33 48742 -c–a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-11 08:05 . 2008-08-02 13:33 29313 -c–a-w- c:\program files\mozilla firefox\components\myspell.dll
2006-10-11 08:05 . 2008-08-02 13:33 41082 -c–a-w- c:\program files\mozilla firefox\components\spellchk.dll
2006-10-11 08:04 . 2008-08-02 13:33 166510 -c–a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2010-03-10 22:01 . 2010-03-10 22:01 124272 -c–a-w- c:\program files\mozilla firefox\plugins\CCMSDK.dll
2010-03-10 22:40 . 2010-03-10 22:40 13168 -c–a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2010-03-10 22:02 . 2010-03-10 22:02 70512 -c–a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2010-03-10 22:01 . 2010-03-10 22:01 91504 -c–a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2010-03-10 22:01 . 2010-03-10 22:01 22384 -c–a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
2010-03-10 22:00 . 2010-03-10 22:00 255344 -c–a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2010-03-10 22:01 . 2010-03-10 22:01 31088 -c–a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2010-03-10 22:01 . 2010-03-10 22:01 40304 -c–a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2009-10-05 11:49 . 2009-10-05 11:49 652640 -c–a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2010-03-10 22:02 . 2010-03-10 22:02 23920 -c–a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
.

——- Sigcheck ——-

[-] 2010-07-29 12:35 . 476098883D83981C2CC860FD8DEF66F9 . 210816 . . [——] . . c:\windows\system32\dllcache
dis.sys
[7] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386
dis.sys
[7] 2006-03-02 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$
dis.sys


c:\windows\System32\drivers
dis.sys … is niet aanwezig !!
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150596.exe" [2009-04-29 468408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2006-06-16 53248]
"S3Trayp"="S3trayp.exe" [2005-11-01 163840]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-11 16264192]
"SkyTel"="SkyTel.EXE" [2006-05-15 2879488]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-11 13666408]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-11 110696]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2010-03-30 1820040]
"ConnectionCenter"="c:\program files\Citrix\ICA Client\concentr.exe" [2010-03-10 300400]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Snelle start.lnk]
path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\Adobe Reader Snelle start.lnk
backup=c:\windows\pss\Adobe Reader Snelle start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Menu Start\Programma's\Opstarten\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-12-11 08:56 286720 -c–a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-02-22 02:25 144784 -c–a-w- c:\program files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2006-11-03 17:20 866584 -c–a-w- c:\program files\Windows Defender\MSASCui.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"d:\\Dragon Age\\bin_ship\\daorigins.exe"=
"d:\\Dragon Age\\DAOriginsLauncher.exe"=
"d:\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"50621:TCP"= 50621:TCP:*isabled:SolidNetworkManager
"50621:UDP"= 50621:UDP:*isabled:SolidNetworkManager

R1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\drivers\ctxusbm.sys [5-10-2009 10:08 65584]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [30-3-2010 11:16 1107336]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3-11-2006 19:19 13592]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:\dragon age\bin_ship\daupdatersvc.service.exe [21-5-2010 16:51 25832]
.
Inhoud van de 'Gedeelde Taken' map

2010-08-28 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
——- Bijkomende Scan ——-
.
uStart Page = hxxp://www.google.nl/
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
DPF: {3E90FFF5-1347-45B9-91F6-DA47926E9697} - hxxp://www.ziggo.nl/f-secure/systemcheck/PlaNetSysInfo.cab
FF - ProfilePath - c:\documents and settings\H. Schouten\Application Data\Mozilla\Firefox\Profiles\fqjbpox8.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - GoogleCOM
FF - prefs.js: browser.startup.homepage - hxxp://www.google.nl/
FF - prefs.js: keyword.URL - hxxp://www.google-searchbar.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-

FF - user.js: browser.search.selectedEngine - GoogleCOM
FF - user.js: keyword.URL - hxxp://www.google-searchbar.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-28 17:50
Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen …

scannen van verborgen autostart items …

scannen van verborgen bestanden …

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
——————— VERGRENDELDE REGISTER SLEUTELS ———————

[HKEY_USERS\S-1-5-21-1957994488-1844823847-839522115-1002\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:01,b8,38,48,3f,b3,1c,e0,71,26,30,eb,5b,fb,13,1f,e0,55,ad,5a,68,85,67,
cf,92,55,8b,d0,f1,a3,55,89,22,e4,42,0b,22,31,8f,6d,c7,10,ff,dc,0a,00,dd,0a,\
"??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d

[HKEY_USERS\S-1-5-21-1957994488-1844823847-839522115-1002\Software\SecuROM\License information*]
"datasecu"=hex:38,8f,3d,f5,6b,93,18,f8,09,82,26,bd,fa,a8,97,1a,b9,a7,17,8a,ff,
52,61,59,dd,71,2a,90,12,e3,f0,99,8e,27,a0,f1,91,bf,c5,6f,eb,64,0c,7f,de,65,\
"rkeysecu"=hex:82,c3,15,4f,bb,1d,3b,7f,84,f5,53,93,76,d6,d1,ff

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•¤|ÿÿÿÿ•¤|ù•9~*]
"3140111900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
——————— DLLs Geladen Onder Lopende Processen ———————

- - - - - - - > 'explorer.exe'(1380)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Voltooingstijd: 2010-08-28 17:51:41
ComboFix-quarantined-files.txt 2010-08-28 15:51
ComboFix2.txt 2010-08-28 14:18

Pre-Run: 20.004.564.992 bytes beschikbaar
Post-Run: 19.991.494.656 bytes beschikbaar

- - End Of File - - 831708C4548B4F660750140842E89274

Hallo TeR, ComboFix meldt het volgende:

[-] 2010-07-29 12:35 . 476098883D83981C2CC860FD8DEF66F9 . 210816 . . [——] . . c:\windows\system32\dllcache
dis.sys
[7] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386
dis.sys
[7] 2006-03-02 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$
dis.sys


[b:12388dda1c]c:\windows\System32\drivers
dis.sys … is niet aanwezig !! [/b:12388dda1c]

Je zal handmatig uit een van de andere lokaties, ik denk het best vanuit de [b:12388dda1c]

Het wordt er nog niet beter op.
Heb nu dat bestandje ndis.sys vanaf de system32\dllcache gekopieerd naar system32\drivers

En vervolgens de pc herstart. Nu krijg ik het volgende blauwe scherm, kom dus niet in windows.

[img:12c17953a4]http://www.xup.in/pic,16227170/IMAG0004.jpg[/img:12c17953a4]

Het kan gewoon stom toeval zijn, maar controleer het werkgeheugen op fouten!

[quote:931a97fb88="Abraham54"]Het kan gewoon stom toeval zijn, maar controleer het werkgeheugen op fouten![/quote:931a97fb88]

Kom er niet uit, ben naar deze site gegaan: http://www.memtest.org/#downiso

deze gedownload: Download - Pre-Compiled Bootable ISO (.zip)

En die gebrand via m'n macbook. maar als ik de pc herstart laadt ie de cd niet.

Boot volgorde:
Floppy
CD-Rom
HD

Probeer het nogmaals via een verse download.

Je screenshot had scherper gekund. Maar als ik het goed heb gelezen staat er: Stop 0x0000007E
Info daarover zou je kunnen vinden op de site van Microsoft in artikel 330182 Probleemoplossing voor het foutbericht 'Stop 0x0000007E' in Windows XP.

[quote:5f9d312a7a="-TeR-"] Kom er niet uit, ben naar deze site gegaan: http://www.memtest.org/#downiso deze gedownload: Download - Pre-Compiled Bootable ISO (.zip) En die gebrand via m'n macbook. maar als ik de pc herstart laadt ie de cd niet. [/quote:5f9d312a7a] Had je die ISO wel gebrand als image/beeldbestand? Zie je tijdens het booten een foutmelding?

[quote:f0e824948c="jolo"]Je screenshot had scherper gekund.[/quote:f0e824948c]
Is met me mobiel gemaakt, je kan het lezen daar gaat het om lijkt me.

[quote:f0e824948c] Had je die ISO wel gebrand als image/beeldbestand? Zie je tijdens het booten een foutmelding?[/quote:f0e824948c]

Ik heb gewoon rechtermuisknop op de image geklikt en dan branden naar schijf.
Ik zie geen foutmelding.

Als je die zojuist gebrande memtest86 CD-R(W) weer in de DVD speler van je macbook plaatst, zie je daarop dan wel een readme.txt en een boot map? En werkt deze dan wel op een andere PC?

[quote:90db084d9f="-TeR-"]Ik zie geen foutmelding.[/quote:90db084d9f] Zie je tijdens het booten nog wel een melding, die lijkt op: Boot from CD? Disable eventueel het BIOS logo.

Owk memtest werkt nu geen errors:

[img:89e89b9d92]http://www.xup.in/pic,21130423/IMAG0005.jpg[/img:89e89b9d92]