antivirus.startpagina.nl

w32\bagle.dk

  • Anonymous avatar

    ferry

    Hallo,

    ik heb een probleem. Laptop is erg langzaam geworden. Norton doet het niet meer, kan 'm ook niet verwijderen.Een ander krijg ik er niet op. Windows update werkt ook niet. Heb de rest van wat staat in LEES DIT EERST wel gedaan. Ik hoop dat iemand mij kan helpen.

    Alvast bedankt, hier is mijn logfile.

    Logfile of HijackThis v1.99.1

    Scan saved at 14:47:40, on 6-11-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\S24EvMon.exe

    C:\WINDOWS\system32\ZCfgSvc.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\Explorer.EXE

    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

    C:\WINDOWS\System32\RegSrvc.exe

    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    C:\WINDOWS\AGRSMMSG.exe

    C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Intel\NCS\Sync\NetSvc.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    D:\hijackthis\hijackthis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILEOi+Vh7AfA98Gm4Me69ZMbubcDmYReEEaH4pXyBnm0HPWfPT5BiMqEDt3XLcVaoflnZ7YAQOgt7Ns7Ln/+Ba2w9kwvnSdAG3l7K5QecNSriSQOe34xnJLmbnd0xWuhOnDsNX+Nu9Ol1AdhsALwpLkOtGR+6HJdK8MXb5Kq2oPhJS5HKa9NTiNtHSsoXErYJMl10pw=

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    R3 - Default URLSearchHook is missing

    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)

    O2 - BHO: Starware - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - C:\Program Files\Starware\bin\Starware.dll

    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)

    O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\nl\msntb.dll

    O3 - Toolbar: Starware - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - C:\Program Files\Starware\bin\Starware.dll

    O4 - HKLM\..\Run: Ati2mdxx.exe

    O4 - HKLM\..\Run: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    O4 - HKLM\..\Run: AGRSMMSG.exe

    O4 - HKLM\..\Run: C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE

    O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

    O4 - HKLM\..\Run: C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\hloader_exe.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\antiav_exe.exe

    O4 - HKLM\..\Run: Rundll32.exe “C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll”,VerifyStatus

    O4 - HKLM\..\Run: “C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe” -k

    O4 - HKLM\..\Run: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: C:\WINDOWS\system32\hloader_exe.exe

    O4 - HKCU\..\Run: C:\WINDOWS\system32\antiav_exe.exe

    O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {DE591B16-A452-11D6-AED1-0001030A4E46} (PBGNX Control) - https://gto.postbank.nl/GTO/PBGNX.cab

    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4618/mcfscan.cab

    O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll

    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

    O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

    O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe

    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe

    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  • Anonymous avatar

    Erik

    Vink in HJT alleen de volgende regels aan:

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = as.starware.com/dp/search?x=wKX1ILEOi+Vh7AfA98Gm4Me69ZMbubcDmYReEEaH4pXyBnm0HPWfPT5BiMqEDt3XLcVaoflnZ7YAQOgt7Ns7Ln/+Ba2w9kwvnSdAG3l7K5QecNSriSQOe34xnJLmbnd0xWuhOnDsNX+Nu9Ol1AdhsALwpLkOtGR+6HJdK8MXb5Kq2oPhJS5HKa9NTiNtHSsoXErYJMl10pw=

    R3 - Default URLSearchHook is missing

    O2 - BHO: Starware - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - C:\Program Files\Starware\bin\Starware.dll

    O3 - Toolbar: Starware - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - C:\Program Files\Starware\bin\Starware.dll

    O4 - HKLM\..\Run: C:\WINDOWS\system32\hloader_exe.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\antiav_exe.exe

    O4 - HKLM\..\Run: Rundll32.exe “C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll”,VerifyStatus

    O4 - HKLM\..\Run: “C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe” -k

    O4 - HKCU\..\Run: C:\WINDOWS\system32\hloader_exe.exe

    O4 - HKCU\..\Run: C:\WINDOWS\system32\antiav_exe.exe

    Klik op fix checked.

    Stopsign is geen goede scanner die kan je er beter helemaal af halen.

    http://www.spywarewarrior.com/rogue_anti-spyware.htm#ss_note

    Download KillBox van OptionExplicit http://www.bleepingcomputer.com/files/spyware/KillBox.zip

    -Unzip Killbox het naar je buroblad.

    -Dubbelklik het icoontje.

    -Zet een vinkje bij “delete on reboot”

    -Kopieer de volgende text:

    C:\WINDOWS\system32\antiav_exe.exe

    C:\WINDOWS\system32\hloader_exe.exe

    C:\WINDOWS\system32\HLEADER_DLL.DLL

    C:\WINDOWS\system32\HLOADER_DLL.DLL

    C:\WINDOWS\system32\antiav_dll.dll

    In killbox ga naar File>>paste from clipboard.

    Killbox geeft alleen de files weer die ook daadwerkelijk bestaan.

    Klik op het Rode rondje met wit kruis

    Antwoord JA JA, als je een melding krijgt svp handmatig rebooten

    Doe een onlinescan bij Panda en bewaar het logje: www.pandasoftware.com/products/activescan.htm

    Plaats daarna een nieuw HJT logje en het logje van Panda svp

  • Anonymous avatar

    ferry

    Hallo

    hier ben ik dan. Bedankt voor je reactie. hier zijn mijn logs.

    alvast weer bedankt

    Ferry

    Logfile of HijackThis v1.99.1

    Scan saved at 18:20:57, on 6-11-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\S24EvMon.exe

    C:\WINDOWS\system32\ZCfgSvc.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

    C:\WINDOWS\System32\RegSrvc.exe

    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    C:\WINDOWS\AGRSMMSG.exe

    C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\WINDOWS\System32\svchost.exe

    D:\hijackthis\hijackthis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILEOi+Vh7AfA98Gm4Me69ZMbubcDmYReEEaH4pXyBnm0HPWfPT5BiMqEDt3XLcVaoflnZ7YAQOgt7Ns7Ln/+Ba2w9kwvnSdAG3l7K5QecNSriSQOe34xnJLmbnd0xWuhOnDsNX+Nu9Ol1AdhsALwpLkOtGR+6HJdK8MXb5Kq2oPhJS5HKa9NTiNtHSsoXErYJMl10pw=

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    R3 - Default URLSearchHook is missing

    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)

    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)

    O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\nl\msntb.dll

    O4 - HKLM\..\Run: Ati2mdxx.exe

    O4 - HKLM\..\Run: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    O4 - HKLM\..\Run: AGRSMMSG.exe

    O4 - HKLM\..\Run: C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE

    O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

    O4 - HKLM\..\Run: C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

    O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

    O16 - DPF: {DE591B16-A452-11D6-AED1-0001030A4E46} (PBGNX Control) - https://gto.postbank.nl/GTO/PBGNX.cab

    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4618/mcfscan.cab

    O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll

    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

    O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

    O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe

    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe

    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    Incident Status Location

    Virus:trj/mitglieder.fp Disinfected Operating system

    Adware:adware/comet No disinfected C:\PROGRAM FILES\Starware

    Virus:Trj/Mitglieder.FP Disinfected C:\!KillBox\antiav_exe.exe

    Virus:Trj/Mitglieder.FK Disinfected C:\!KillBox\hloader_exe.exe

    Adware:Adware/Comet No disinfected C:\Program Files\Starware\bin\Starware.dll

    Virus:Trj/Mitglieder.FP Disinfected C:\WINDOWS\exefld\234607.exe

    Virus:Trj/Mitglieder.FK Disinfected C:\WINDOWS\system32\hleader_dll.dll

    Adware:Adware/Comet No disinfected D:\hijackthis\backups\backup-20051106-171335-545.dll

  • Anonymous avatar

    ferry

    Hallo,

    is er niemand die even kan kijken?

    Alvast bedankt

    Ferry

  • Anonymous avatar

    Piet

    denk dat de meesten al slapen.

    Morgen weer een nieuwe ronde met nieuwe kansen.:+:+

  • Anonymous avatar

    Avondsmurf

    Volgens mij heb je geen werkende virusscanner op je computer………… Smurfie :)

  • Anonymous avatar

    Erik

    Vink in Hijackthis deze regels aan:

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = as.starware.com/dp/search?x=wKX1ILEOi+Vh7AfA98Gm4Me69ZMbubcDmYReEEaH4pXyBnm0HPWfPT5BiMqEDt3XLcVaoflnZ7YAQOgt7Ns7Ln/+Ba2w9kwvnSdAG3l7K5QecNSriSQOe34xnJLmbnd0xWuhOnDsNX+Nu9Ol1AdhsALwpLkOtGR+6HJdK8MXb5Kq2oPhJS5HKa9NTiNtHSsoXErYJMl10pw=

    R3 - Default URLSearchHook is missing

    Sluit alle vensters behalve HJT en klik op fix checked.

    Download registry search tool hier: Registry Search Tool

    Zet het op je buroblad.

    Dubbelklik op het icoontje.

    Kopieer de volgende vette text en plak dat in het venster:

    Eerst:

    antiav

    Bewaar de text file als antiav.txt

    Daarna deze invoeren:

    hloader

    Bewaar de text file als hloader.txt

    Als laatste:

    hleader

    Bewaar als hleader.txt

    Klik OK, als je virusscanner gaat piepen mag je het script toelaten :-)

    Post alle logjes hier nog svp

  • Anonymous avatar

    Erik

    Zoveel haast heb je nu ook niet :+

  • Anonymous avatar

    Ferry

    Hallo,

    Bedankt voor jullie inzet, maar als ik moet werken kan ik niet internetten. En inderdaad, de virusscanner deed het niet meer, en kon hem ook niet verwijderen en als ik bijvoorbeeld avast erop wilde zetten deed hij dat ook niet. Een echt drama dus. Met de eerste reactie van Eric kwam ik een stuk verder. Heb daarna avast kunnen installeren. Had nog een paar problemen omdat het ook in de backup bestanden zat. Toen systemherstel uitgezet waardoor alle backups wegwaren en daarna weer aangezet en toen was het weer dik voor elkaar.

    Nogmaals, bedankt voor jullie inzet.

    P.S. De laptop is weer terug naar de eigenaar. De tweede reactie van erik moet ik nog uitvoeren.

    Ferry

  • Anonymous avatar

    ferry

    Hallo,

    hier ben ik weer. Ik hoop dat het logje schoon is. Weer alvast bedankt voor de inzet.

    Logfile of HijackThis v1.99.1

    Scan saved at 9:09:26, on 10-11-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\S24EvMon.exe

    C:\WINDOWS\system32\ZCfgSvc.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    C:\Program Files\Alwil Software\Avast4\ashServ.exe

    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

    C:\WINDOWS\System32\RegSrvc.exe

    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    C:\WINDOWS\AGRSMMSG.exe

    C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

    C:\WINDOWS\system32\wuauclt.exe

    D:\virus\hijackthis\hijackthis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)

    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)

    O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\nl\msntb.dll

    O4 - HKLM\..\Run: Ati2mdxx.exe

    O4 - HKLM\..\Run: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    O4 - HKLM\..\Run: AGRSMMSG.exe

    O4 - HKLM\..\Run: C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE

    O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

    O4 - HKLM\..\Run: C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

    O16 - DPF: {DE591B16-A452-11D6-AED1-0001030A4E46} (PBGNX Control) - https://gto.postbank.nl/GTO/PBGNX.cab

    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4618/mcfscan.cab

    O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll

    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

    O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

    O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe

    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe

    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    Groetjes

    Ferry