C:\WINDOWS\CONFIG\CSRSS.EXE

Ga naar het laatste bericht

januari 2009

• nickk
  Daar hebben wij wat aan!!
  
  Misschien een virus/spyware? Scan daar eens op.
  Download Malwarebytes AntiMalware eens en laat een volledige scan doen (eerst updaten)
  Download Hijackthis eens. Installeren op hardeschijf (geen temp) en "Do a system scan and save a logfile" en post deze 3 dingen als je bijv. een virushebt. Post zeker even de uitkomst van Hijackthis.
  25 januari 2009 21:34
• swollufjuh
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 21:37:13, on 25-1-2009
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v8.00 (8.00.6001.18241)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  E:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  E:\program files\avast\aswUpdSv.exe
  E:\program files\avast\ashServ.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.exe
  E:\PROGRA~1\avast\ashDisp.exe
  C:\Program Files\Analog Devices\Core\smax4pnp.exe
  C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
  C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
  C:\Program Files\Acer Display\eDisplay Management\DTHtml.exe
  C:\Program Files\Java\jre6\bin\jusched.exe
  C:\WINDOWS\vVX1000.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
  C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe
  E:\Program Files\Windows Defender\MSASCui.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  E:\Program Files\filehippo.com\UpdateChecker.exe
  C:\Program Files\DNA\btdna.exe
  E:\program files\logitech\SetPoint\SetPoint.exe
  C:\Program Files\Portrait Displays\Pivot Software\floater.exe
  E:\program files\netgear\wlancfg5.exe
  E:\program files\RocketDock\RocketDock.exe
  C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
  C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  E:\program files\NERO\Nero\Nero8\InCD\InCDsrv.exe
  C:\Program Files\Java\jre6\bin\jqs.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
  C:\Program Files\Microsoft LifeCam\MSCamS32.exe
  E:\program files\NERO\Nero\Nero8\Nero BackItUp\NBService.exe
  E:\program files\NERO\Nero\Nero8\InCD\NBHRegInCDSrv.exe
  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\SearchIndexer.exe
  E:\program files\avast\ashMaiSv.exe
  E:\program files\avast\ashWebSv.exe
  C:\Program Files\Mozilla Firefox 3.1 Beta 1\firefox.exe
  E:\program files\NERO\Nero\Nero8\Nero PhotoSnap\PhotoSnapViewer.exe
  C:\WINDOWS\system32\SearchProtocolHost.exe
  E:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
  F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\csrss.exe
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - E:\program files\real\rpbrowserrecordplugin.dll
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
  O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
  O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
  O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
  O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
  O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\avast\ashDisp.exe
  O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
  O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
  O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
  O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
  O4 - HKLM\..\Run: [AsusStartupHelp] C:\Program Files\ASUS\AASP\1.00.16\AsRunHelp.exe
  O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
  O4 - HKLM\..\Run: [DT ACR] C:\Program Files\Acer Display\eDisplay Management\DTHtml.exe -startup_folder
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
  O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
  O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
  O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [Windows Defender] "E:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [R-Crypto] E:\Program Files\R-Crypto\EDiskCall.exe Startup
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [filehippo.com] "E:\Program Files\filehippo.com\UpdateChecker.exe" /background
  O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
  O4 - Startup: RocketDock.lnk = E:\program files\RocketDock\RocketDock.exe
  O4 - Global Startup: Logitech SetPoint.lnk = E:\program files\logitech\SetPoint\SetPoint.exe
  O4 - Global Startup: NETGEAR WG311v3 Smart Wizard.lnk = E:\program files\netgear\wlancfg5.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
  O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
  O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229948203484
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1229948273394
  O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?AuthParam=1230042826_9068c9e09536874f8fd64953b5384068&GroupName=JSC&BHost=javadl.sun.com&FilePath=/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab&File=jinstall-6u11-windows-i586-jc.cab
  O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
  O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
  O23 - Service: Asset Management Daemon - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\program files\avast\aswUpdSv.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: avast! Antivirus - ALWIL Software - E:\program files\avast\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - E:\program files\avast\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - E:\program files\avast\ashWebSv.exe
  O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
  O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\program files\NERO\Nero\Nero8\InCD\InCDsrv.exe
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
  O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - E:\program files\NERO\Nero\Nero8\Nero BackItUp\NBService.exe
  O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Nero AG - E:\program files\NERO\Nero\Nero8\InCD\NBHRegInCDSrv.exe
  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
  25 januari 2009 21:38
• nickk
  Uploaden bij rapidshare/megaupload bijv.
  Je hebt een virus. Start Hijackthis weer op doe de functie "Do only a system scan" en fix (vinkje ervoor en op fix klikken) de volgende item's (wees voorzichtig met wat je aanvinkt)
  
  [b]- F2 - REGystem.ini: Shell=Explorer.exe C:\WINDOWS\Config\csrss.exe
  - O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
  - O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
  - O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
  - O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
  - O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
  - O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)[/b]
  
  Opnieuw opstarten, probleem verholpen?
  25 januari 2009 21:39
• blacksorcerer
  [color=blue]Swollufjuh, het is niet de bedoeling dat je hier zomaar een bestandnaam neergooid en wij mogen gaan uitpuzzelen wat het probleem is en hoe het opgelost kan worden.
  Daarnaast betreft het normaal gezien een systeembestand, en daar je een illegaal besturingssysteem draait kan daar vanalles mee mis zijn en helpen wij dus ook geen personen met illegale software.
  
  Lees de regels eens goed door voordat je een volgend bericht of topic plaatst, om misverstanden en topiclocks te voorkomen en te zorgen dat we je wel op een goede manier kunnen helpen.[/color]
  25 januari 2009 21:44