avg8 traymain wnd virus help me please

  • ricardo

    hoi argus

    ik krijg de melding nu niet meer hij is weg

    er staan geen 04 regels

    alleen een 03 regel toolbar no name no file

    ik al wel evenb een nieuw logje plaatsen

    ogfile of Trend Micro HijackThis v2.0.2

    Scan saved at 13:22:35, on 14-2-2010

    Platform: Windows Vista SP1 (WinNT 6.00.1905)

    MSIE: Internet Explorer v7.00 (7.00.6001.18385)

    Boot mode: Normal

    Running processes:

    C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

    C:\Windows\system32\Dwm.exe

    C:\Windows\system32\taskeng.exe

    C:\Windows\Explorer.EXE

    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

    C:\Program Files\Windows Defender\MSASCui.exe

    C:\Windows\WindowsMobile\wmdc.exe

    C:\Program Files\DAEMON Tools Pro\DTProAgent.exe

    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

    C:\Program Files\CyberLink\Shared files\brs.exe

    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

    C:\Windows\sttray.exe

    C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

    C:\Program Files\Logitech\QuickCam\Quickcam.exe

    C:\Program Files\AVG\AVG8\avgtray.exe

    C:\Windows\System32\rundll32.exe

    C:\Program Files\Java\jre6\bin\jusched.exe

    C:\Program Files\Windows Sidebar\sidebar.exe

    C:\Program Files\Windows Live\Messenger\msnmsgr.exe

    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

    C:\Program Files\FTD Watchdog\FtdMonitor.exe

    C:\Windows\ehome\ehtray.exe

    C:\Windows\system32\wbem\unsecapp.exe

    C:\Program Files\Windows Sidebar\sidebar.exe

    C:\Windows\ehome\ehmsas.exe

    C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe

    C:\Program Files\IncrediMail\bin\ImApp.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Windows\system32\SearchFilterHost.exe

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.startpagina.nl

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zeelandnet.nl/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.startpagina.nl

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer aangeboden door Unattended

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    O1 - Hosts: ::1 localhost

    O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

    O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

    O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

    O4 - HKLM\..\Run: %windir%\WindowsMobile\wmdc.exe

    O4 - HKLM\..\Run: “C:\Program Files\DAEMON Tools Pro\DTProAgent.exe” /f

    O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”

    O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\Language\Language.exe”

    O4 - HKLM\..\Run: C:\Program Files\Cyberlink\Shared Files\brs.exe

    O4 - HKLM\..\Run: “C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe”

    O4 - HKLM\..\Run: sttray.exe

    O4 - HKLM\..\Run: “C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe”

    O4 - HKLM\..\Run: “C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe”

    O4 - HKLM\..\Run: “C:\Program Files\Logitech\QuickCam\Quickcam.exe” /hide

    O4 - HKLM\..\Run: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\AVG\AVG8\avgtray.exe

    O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

    O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

    O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

    O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

    O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe” /background

    O4 - HKCU\..\Run: “C:\Program Files\DAEMON Tools Pro\DTProAgent.exe”

    O4 - HKCU\..\Run: “C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe” ASO-616B5711-6DAE-4795-A05F-39A1E5104020

    O4 - HKCU\..\Run: G:\Program Files\Download Direct\DLD.exe

    O4 - HKCU\..\Run: “C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe” /NoDialog

    O4 - HKCU\..\Run: “C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe” -onlytray

    O4 - HKCU\..\Run: “C:\Program Files\Electronic Arts\EADM\Core.exe” -silent

    O4 - HKCU\..\Run: “C:\Program Files\FTD Watchdog\FtdMonitor.exe”

    O4 - HKCU\..\Run: C:\Program Files\IncrediMail\bin\IncMail.exe /c

    O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

    O4 - HKCU\..\Run: “L:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe” -s

    O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

    O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

    O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

    O4 - HKUS\S-1-5-18\..\Run: C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User ‘SYSTEEM’)

    O4 - HKUS\.DEFAULT\..\Run: C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User ‘Default user’)

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

    O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

    O9 - Extra ‘Tools’ menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

    O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

    O9 - Extra ‘Tools’ menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

    O9 - Extra button: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO (file missing)

    O9 - Extra ‘Tools’ menuitem: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO (file missing)

    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

    O9 - Extra ‘Tools’ menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

    O13 - Gopher Prefix:

    O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/en-Us/wlscctrl2.cab

    O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab

    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game.zylom.com/activex/zylomgamesplayer.cab

    O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697517} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_aac.cab

    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

    O20 - AppInit_DLLs: avgrsstx.dll

    O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll

    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

    O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

    O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe

    O23 - Service: TomTomHOMEService - TomTom - l:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

    End of file - 10924 bytes

    ik hoop dat het ergste probleem nu opgelost is

    en hoe ziet het logje er voor de rest uit dan?

    en welk deel van de opstart items is niet aanwezig dan???

  • Argus

    Hijack This

    Klik met de rechtermuis op het programma Hijackthis en Kies voor uitvoeren als administrator en dan

    'Do a system scan only'

    Selecteer alleen de items die hieronder zijn genoemd:

    O9 - Extra button: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - (file missing)

    O9 - Extra ‘Tools’ menuitem: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - (file missing)

    Klik op 'Fix checked' om de items te verwijderen.

    Internet Explorer moet gesloten zijn als je Fix Checked klikt

    Tip

    Verwijder Ad-aware en Spybot s&d en vervang deze door SUPERAntiSpyware

    SUPERAntiSpyware en Malwarebytes Antimalware passen heel goed bij elkaar

  • ricardo

    hoi argus

    ok ik moet nu gaan werken

  • Argus

    De Log van Hijack This was nu Completer :)

    Zowel Ad-aware als Spybot s&d zijn Spyware scanners,als Spybot b.v. een Trojan vind dan vind het de signatures van het Virus

    Tweede nadeel is dat bij installatie de Guards ook worden geïnstalleerd Ad-Watch(Ad-aware) Teatimer(Spybot)

    Vista gebruikers hebben sowieso Windows Defender die ook een Guard heeft

    En op een PC hoort één Guard actief te zijn,het vertraagd je PC

    Verwijderen via Configuratie>>Software

  • ricardo

    hoi argus

    bedankt voor de info en de hulp (tu) (:P) hij draait weer super hoor ik ga even spybot en ad aware er af gooien

    en superantispyware erbij zetten

    mvg ricardo

  • mike

    hallo,download het programmatje malwarebytes run de scan en lkaaaaaar problemen?? email met even

  • Jos H

    Mike ga je winterslaap houden, je bent er aan toe.

    Topic is bijna een jaar oud. :D

  • Teaser

    Is u archeoloog :S:S

  • fazantje

    Nee, denk holbewonerX(