Internet ontzettend langzaam...

• 

  Jonker

  01-03-2009 21:28

  Mijn internet is sinds enkele dagen ernstig langzaam, zou er iemand naar mijn log willen kijken? Alvast bedankt !

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 21:26:30, on 1-3-2009

  Platform: Windows Vista (WinNT 6.00.1904)

  MSIE: Internet Explorer v7.00 (7.00.6000.16809)

  Boot mode: Normal

  Running processes:

  C:\Windows\system32\taskeng.exe

  C:\Windows\system32\Dwm.exe

  C:\Windows\RtHDVCpl.exe

  C:\Program Files\Common Files\Symantec Shared\ccApp.exe

  C:\Windows\System32\SysMonitor.exe

  C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

  C:\Program Files\PageScript\PScript.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Windows\ehome\ehtray.exe

  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  C:\Program Files\Logitech\SetPoint\SetPoint.exe

  C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE

  C:\Windows\ehome\ehmsas.exe

  C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE

  C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE

  C:\Windows\system32\wuauclt.exe

  C:\Windows\explorer.exe

  C:\Program Files\Internet Explorer\ieuser.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Windows\system32\SearchFilterHost.exe

  C:\Windows\system32\Macromed\Flash\FlashUtil9b.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ycomp/defaults/sp/*http://uk.yahoo.com

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nl.intl.acer.yahoo.com

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://nl.intl.acer.yahoo.com

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

  O1 - Hosts: ::1 localhost

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

  O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O3 - Toolbar: Norton-werkbalk weergeven - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll

  O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll

  O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: “c:\Program Files\Common Files\Symantec Shared\ccApp.exe”

  O4 - HKLM\..\Run: “c:\Program Files\Norton Internet Security\osCheck.exe”

  O4 - HKLM\..\Run: C:\Windows\system32\SysMonitor.exe

  O4 - HKLM\..\Run: C:\Acer\WR_PopUp\WarReg_PopUp.exe

  O4 - HKLM\..\Run: C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

  O4 - HKLM\..\Run: C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe

  O4 - HKLM\..\Run: KHALMNPR.EXE

  O4 - HKLM\..\Run: C:\Progra~1\PageScript\PScript.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe” /a /m “C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll”

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  O4 - HKLM\..\RunOnce: C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

  O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

  O4 - HKCU\..\Run: ??????????????e

  O4 - HKCU\..\Run: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

  O4 - Global Startup: Empowering Technology Launcher.lnk = ?

  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

  O4 - Global Startup: Logitech SetPoint.lnk = ?

  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O13 - Gopher Prefix:

  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab

  O18 - Protocol: bw+0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw+0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw-0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw-0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw00 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw00s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw10 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw10s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw20 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw20s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw30 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw30s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw40 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw40s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw50 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw50s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw60 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw60s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw70 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw70s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw80 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw80s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw90 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw90s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwa0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwa0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwb0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwb0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwc0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwc0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwd0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwd0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwe0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwe0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwf0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwf0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

  O18 - Protocol: bwg0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwg0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwh0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwh0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwi0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwi0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwj0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwj0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwk0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwk0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwl0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwl0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwm0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwm0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwn0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwn0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwo0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwo0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwp0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwp0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwq0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwq0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwr0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwr0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bws0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bws0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwt0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwt0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwu0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwu0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwv0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwv0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bww0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bww0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwx0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwx0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwy0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwy0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwz0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwz0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: offline-8876480 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

  O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

  O23 - Service: Wachtwoordvalidatie voor Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

  O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

  O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

  –

  End of file - 20399 bytes

  Rapporteren
• 

  Huib

  01-03-2009 23:06

  Hoi Jonker,

  Om het eerst wat overzichtelijker te maken, doe het volgende:

  Verwijder indien aanwezig onder: Start - configuratiescherm - software:

  Logitech Desktop Messenger.

  Sluit alle vensters en start Hijack This, en klik op Do a Systemscan only.

  Zet een vinkje voor de volgende regels indien nog aanwezig:

  O18 - Protocol: bw+0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw+0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw-0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw-0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw00 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw00s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw10 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw10s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw20 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw20s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw30 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw30s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw40 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw40s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw50 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw50s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw60 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw60s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw70 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw70s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw80 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw80s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw90 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bw90s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwa0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwa0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwb0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwb0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwc0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwc0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwd0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwd0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwe0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwe0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwf0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwf0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

  O18 - Protocol: bwg0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwg0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwh0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwh0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwi0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwi0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwj0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwj0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwk0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwk0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwl0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwl0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwm0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwm0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwn0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwn0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwo0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwo0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwp0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwp0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwq0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwq0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwr0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwr0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bws0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bws0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwt0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwt0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwu0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwu0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwv0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwv0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bww0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bww0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwx0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwx0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwy0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwy0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwz0 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: bwz0s - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  O18 - Protocol: offline-8876480 - {BE1582CF-03E1-4459-975F-16B8E18AEFB6} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

  Sluit alle vensters, behalve HijackThis en klik op fix checked.

  Voer nu alle stappen uit van de volgende link:

  http://antivirus.startpagina.nl/prikbord/4625317/voer-dit-eerst-uit-voordat-je-de-logjes-plaatst!!#msg-4625317

  Plaats daarna de 2 gevraagde logjes van HijackThis en MBAM.

  Succes,

  Huib:)

  Rapporteren
• 

  Jonker

  02-03-2009 19:32

  Hierbij de logjes…..ik hoop dat u/je er wat mee kunt.

  MBAM:

  Malwarebytes' Anti-Malware 1.34

  Database versie: 1813

  Windows 6.0.6000

  2-3-2009 19:23:28

  mbam-log-2009-03-02 (19-23-28).txt

  Scan type: Volledige Scan (C:\|D:\|)

  Objecten gescand: 121683

  Verstreken tijd: 34 minute(s), 51 second(s)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 0

  Registersleutels geïnfecteerd: 0

  Registerwaarden geïnfecteerd: 0

  Registerdata bestanden geïnfecteerd: 0

  Mappen geïnfecteerd: 0

  Bestanden geïnfecteerd: 0

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Geheugenmodulen geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Registersleutels geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Registerwaarden geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Registerdata bestanden geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Mappen geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Bestanden geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Hijack:

  ogfile of Trend Micro HijackThis v2.0.2

  Scan saved at 19:30:23, on 2-3-2009

  Platform: Windows Vista (WinNT 6.00.1904)

  MSIE: Internet Explorer v7.00 (7.00.6000.16809)

  Boot mode: Normal

  Running processes:

  C:\Windows\system32\taskeng.exe

  C:\Windows\system32\Dwm.exe

  C:\Windows\RtHDVCpl.exe

  C:\Program Files\Common Files\Symantec Shared\ccApp.exe

  C:\Windows\System32\SysMonitor.exe

  C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

  C:\Program Files\PageScript\PScript.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Windows\ehome\ehtray.exe

  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  C:\Program Files\Logitech\SetPoint\SetPoint.exe

  C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE

  C:\Windows\ehome\ehmsas.exe

  C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE

  C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE

  C:\Windows\system32\wuauclt.exe

  C:\Windows\explorer.exe

  C:\Program Files\Internet Explorer\ieuser.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ycomp/defaults/sp/*http://uk.yahoo.com

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nl.intl.acer.yahoo.com

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://nl.intl.acer.yahoo.com

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

  O1 - Hosts: ::1 localhost

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

  O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O3 - Toolbar: Norton-werkbalk weergeven - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll

  O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll

  O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: “c:\Program Files\Common Files\Symantec Shared\ccApp.exe”

  O4 - HKLM\..\Run: “c:\Program Files\Norton Internet Security\osCheck.exe”

  O4 - HKLM\..\Run: C:\Windows\system32\SysMonitor.exe

  O4 - HKLM\..\Run: C:\Acer\WR_PopUp\WarReg_PopUp.exe

  O4 - HKLM\..\Run: C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

  O4 - HKLM\..\Run: C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe

  O4 - HKLM\..\Run: KHALMNPR.EXE

  O4 - HKLM\..\Run: C:\Progra~1\PageScript\PScript.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe” /a /m “C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll”

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  O4 - HKLM\..\RunOnce: C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

  O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

  O4 - HKCU\..\Run: ??????????????e

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

  O4 - Global Startup: Empowering Technology Launcher.lnk = ?

  O4 - Global Startup: Logitech SetPoint.lnk = ?

  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O13 - Gopher Prefix:

  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab

  O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

  O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

  O23 - Service: Wachtwoordvalidatie voor Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

  O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

  O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

  –

  End of file - 8149 bytes

  Rapporteren
• 

  Teaser

  03-03-2009 12:13

  Zet Teatimer van spybot even uit, omdat deze de fix in de weg kan zitten:

  - Start Spybot

  - Ga naar Mode > selecteer Advanced Mode

  - Ga naar Tools en klik op het Resident-icoon in de lijst

  - Haal het vinkje weg bij Resident TeaTimer en klik OK

  - Herstart de computer

  - Download vervolgens ResetTeaTimer.bat naar je Bureaublad.

  Dubbelklik op ResetTeaTimer.bat om alle entries in TeaTimer te verwijderen.

  Als de computer schoon is, kun je dezelfde stappen weer herhalen om hem weer aan te zetten.

  Plaats dan even een nieuw HJT log

  Rapporteren
• 

  Jonker

  03-03-2009 16:54

  Nieuwe log na reset…….

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 16:54:05, on 3-3-2009

  Platform: Windows Vista (WinNT 6.00.1904)

  MSIE: Internet Explorer v7.00 (7.00.6000.16809)

  Boot mode: Normal

  Running processes:

  C:\Windows\system32\Dwm.exe

  C:\Windows\system32\taskeng.exe

  C:\Windows\Explorer.EXE

  C:\Windows\RtHDVCpl.exe

  C:\Program Files\Common Files\Symantec Shared\ccApp.exe

  C:\Windows\System32\SysMonitor.exe

  C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

  C:\Program Files\PageScript\PScript.exe

  C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Windows\ehome\ehtray.exe

  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  C:\Program Files\Logitech\SetPoint\SetPoint.exe

  C:\Windows\ehome\ehmsas.exe

  C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE

  C:\Program Files\Internet Explorer\ieuser.exe

  C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE

  C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE

  C:\Windows\system32\conime.exe

  C:\Windows\system32\wuauclt.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nl.intl.acer.yahoo.com

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://nl.intl.acer.yahoo.com

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  O1 - Hosts: ::1 localhost

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

  O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O3 - Toolbar: Norton-werkbalk weergeven - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll

  O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll

  O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: “c:\Program Files\Common Files\Symantec Shared\ccApp.exe”

  O4 - HKLM\..\Run: “c:\Program Files\Norton Internet Security\osCheck.exe”

  O4 - HKLM\..\Run: C:\Windows\system32\SysMonitor.exe

  O4 - HKLM\..\Run: C:\Acer\WR_PopUp\WarReg_PopUp.exe

  O4 - HKLM\..\Run: C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

  O4 - HKLM\..\Run: C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe

  O4 - HKLM\..\Run: KHALMNPR.EXE

  O4 - HKLM\..\Run: C:\Progra~1\PageScript\PScript.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe” /a /m “C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll”

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

  O4 - HKCU\..\Run: ??????????????e

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

  O4 - Global Startup: Empowering Technology Launcher.lnk = ?

  O4 - Global Startup: Logitech SetPoint.lnk = ?

  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O13 - Gopher Prefix:

  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab

  O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

  O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

  O23 - Service: Wachtwoordvalidatie voor Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

  O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

  O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

  –

  End of file - 7835 bytes

  Rapporteren
• 

  Jonker

  06-03-2009 10:46

  Zou iemand mij nog even willen helpen?

  Ik wil het probleem heel graag opgelost hebben….

  Alvast bedankt!!

  Gr. Elvira

  Rapporteren
• 

  Teaser

  07-03-2009 12:39

  teatimer staat nog steeds aan.

  Voer de stappen uit die ik gegeven heb of verwijder spybot even helemaal.

  Plaats daarna nogmaals een HJT log

  Rapporteren
• 

  Jonker

  07-03-2009 19:05

  Ik heb spybot verwijderd, onderstaand de HJlog…

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 19:05:47, on 7-3-2009

  Platform: Windows Vista (WinNT 6.00.1904)

  MSIE: Internet Explorer v7.00 (7.00.6000.16809)

  Boot mode: Normal

  Running processes:

  C:\Windows\system32\taskeng.exe

  C:\Windows\system32\Dwm.exe

  C:\Windows\Explorer.EXE

  C:\Windows\RtHDVCpl.exe

  C:\Program Files\Common Files\Symantec Shared\ccApp.exe

  C:\Windows\System32\SysMonitor.exe

  C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

  C:\Program Files\PageScript\PScript.exe

  C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Windows\ehome\ehtray.exe

  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  C:\Program Files\Logitech\SetPoint\SetPoint.exe

  C:\Windows\ehome\ehmsas.exe

  C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE

  C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE

  C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE

  C:\Program Files\Internet Explorer\ieuser.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nl.intl.acer.yahoo.com

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://nl.intl.acer.yahoo.com

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  O1 - Hosts: ::1 localhost

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

  O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll

  O3 - Toolbar: Norton-werkbalk weergeven - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll

  O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll

  O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: “c:\Program Files\Common Files\Symantec Shared\ccApp.exe”

  O4 - HKLM\..\Run: “c:\Program Files\Norton Internet Security\osCheck.exe”

  O4 - HKLM\..\Run: C:\Windows\system32\SysMonitor.exe

  O4 - HKLM\..\Run: C:\Acer\WR_PopUp\WarReg_PopUp.exe

  O4 - HKLM\..\Run: C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

  O4 - HKLM\..\Run: C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe

  O4 - HKLM\..\Run: KHALMNPR.EXE

  O4 - HKLM\..\Run: C:\Progra~1\PageScript\PScript.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe” /a /m “C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll”

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

  O4 - HKCU\..\Run: ??????????????e

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

  O4 - Global Startup: Empowering Technology Launcher.lnk = ?

  O4 - Global Startup: Logitech SetPoint.lnk = ?

  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

  O13 - Gopher Prefix:

  O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

  O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab

  O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

  O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

  O23 - Service: Wachtwoordvalidatie voor Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

  O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

  O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

  –

  End of file - 7495 bytes

  Rapporteren
• 

  Teaser

  08-03-2009 09:38

  Sluit even alle vensters.

  Open alleen HJT en klik op “do a system scan only”

  Vink nu de volgende regels aan en klik op “fix checked”

  O4 - HKCU\..\Run: ??????????????e

  Plaats nogmaals een HJT log

  Rapporteren
• 

  Jonker

  08-03-2009 13:43

  Gedaan…ik heb het verwijderd, maar het is niet weg zie ik…..zie onderstaand:

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 13:43:33, on 8-3-2009

  Platform: Windows Vista (WinNT 6.00.1904)

  MSIE: Internet Explorer v7.00 (7.00.6000.16809)

  Boot mode: Normal

  Running processes:

  C:\Windows\system32\Dwm.exe

  C:\Windows\system32\taskeng.exe

  C:\Windows\Explorer.EXE

  C:\Windows\RtHDVCpl.exe

  C:\Program Files\Common Files\Symantec Shared\ccApp.exe

  C:\Windows\System32\SysMonitor.exe

  C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

  C:\Program Files\PageScript\PScript.exe

  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Windows\ehome\ehtray.exe

  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  C:\Program Files\Logitech\SetPoint\SetPoint.exe

  C:\Windows\ehome\ehmsas.exe

  C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE

  C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE

  C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE

  C:\Program Files\Internet Explorer\ieuser.exe

  C:\Windows\system32\wuauclt.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nl.intl.acer.yahoo.com

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://nl.intl.acer.yahoo.com

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  O1 - Hosts: ::1 localhost

  O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

  O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll

  O3 - Toolbar: Norton-werkbalk weergeven - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll

  O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll

  O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: “c:\Program Files\Common Files\Symantec Shared\ccApp.exe”

  O4 - HKLM\..\Run: “c:\Program Files\Norton Internet Security\osCheck.exe”

  O4 - HKLM\..\Run: C:\Windows\system32\SysMonitor.exe

  O4 - HKLM\..\Run: C:\Acer\WR_PopUp\WarReg_PopUp.exe

  O4 - HKLM\..\Run: C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

  O4 - HKLM\..\Run: C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe

  O4 - HKLM\..\Run: KHALMNPR.EXE

  O4 - HKLM\..\Run: C:\Progra~1\PageScript\PScript.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe” /a /m “C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll”

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

  O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

  O4 - HKCU\..\Run: ??????????????e

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

  O4 - Global Startup: Empowering Technology Launcher.lnk = ?

  O4 - Global Startup: Logitech SetPoint.lnk = ?

  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

  O13 - Gopher Prefix:

  O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

  O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab

  O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

  O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

  O23 - Service: Wachtwoordvalidatie voor Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

  O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

  O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

  O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

  –

  End of file - 7423 bytes

  Rapporteren