google crome werkt niet meer

• 

  mar

  11-10-2010 19:49

  Goedenavond

  Google crome werkt niet meer. Heb het verwijderd en opnieuw er op gezet maar de pagina's willen niet opstarten meer. He de scans erover gehaald heeft wel wat weg gehaald maar nog steeds niet

  Alvast bedankt voor het mee denken

  Ik heb voor u mijn hijackloge

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 19:09:32, on 11-10-2010

  Platform: Windows Vista SP2 (WinNT 6.00.1906)

  MSIE: Internet Explorer v8.00 (8.00.6001.18943)

  Boot mode: Normal

  Running processes:

  C:\Windows\System32\smss.exe

  C:\Windows\system32\csrss.exe

  C:\Windows\system32\csrss.exe

  C:\Windows\system32\wininit.exe

  C:\Windows\system32\services.exe

  C:\Windows\system32\lsass.exe

  C:\Windows\system32\lsm.exe

  C:\Windows\system32\winlogon.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\nvvsvc.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\SLsvc.exe

  C:\Windows\system32\nvvsvc.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\Dwm.exe

  C:\Windows\System32\spoolsv.exe

  C:\Windows\Explorer.EXE

  C:\Windows\system32\taskeng.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\taskeng.exe

  C:\Windows\system32\svchost.exe

  C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

  c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

  C:\Windows\system32\rundll32.exe

  C:\Program Files\McAfee\MPF\MPFSrv.exe

  C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\system32\svchost.exe

  C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

  C:\Windows\System32\svchost.exe

  C:\Program Files\McAfee.com\Agent\mcagent.exe

  C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe

  C:\Windows\system32\SearchIndexer.exe

  C:\Windows\system32\WUDFHost.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

  C:\Program Files\Windows Live\Messenger\msnmsgr.exe

  C:\Program Files\Windows Media Player\wmpnscfg.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

  C:\Windows\System32\mobsync.exe

  C:\Program Files\Windows Media Player\wmpnetwk.exe

  C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

  C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

  c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

  C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

  C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe

  C:\Program Files\Windows Live\Contacts\wlcomm.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Mozilla Firefox\firefox.exe

  C:\Program Files\Mozilla Firefox\plugin-container.exe

  C:\Windows\system32\NOTEPAD.EXE

  C:\Users\hansenmarjo\AppData\Local\Google\Chrome\Application\chrome.exe

  C:\Users\hansenmarjo\AppData\Local\Temp\Shd.exe

  E:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

  C:\Windows\system32\SearchProtocolHost.exe

  c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe

  C:\Windows\system32\SearchFilterHost.exe

  c:\PROGRA~1\mcafee\VIRUSS~1\mcvsmap.exe

  C:\Windows\system32\wbem\wmiprvse.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  O1 - Hosts: ::1 localhost

  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll

  O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: (no name) - {E586A961-08E6-4D33-A6E6-16AE14441595} - c:\windows\system32\dlod562.dll

  O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

  O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

  O4 - HKLM\..\Run: “C:\Program Files\McAfee.com\Agent\mcagent.exe” /runkey

  O4 - HKLM\..\Run: C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe

  O4 - HKLM\..\Run: “E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

  O4 - HKCU\..\Run: “C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background

  O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

  O4 - HKCU\..\Run: C:\Users\hansenmarjo\AppData\Local\Temp\Shd.exe

  O4 - HKCU\..\Run: “C:\Users\hansenmarjo\AppData\Local\Google\Update\GoogleUpdate.exe” /c

  O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  O4 - Global Startup: McAfee Security Scan Plus.lnk = ?

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

  O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) -

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -

  O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

  O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\Belkin\F5D7000v8\jswpsapi.exe

  O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

  O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

  O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

  O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

  O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

  O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

  O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

  O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

  O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

  O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: @C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe

  O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

  –

  End of file - 10432 bytes

  en mijn mbam log

  Malwarebytes' Anti-Malware 1.46

  www.malwarebytes.org

  Databaseversie: 4160

  Windows 6.0.6002 Service Pack 2

  Internet Explorer 8.0.6001.18943

  11-10-2010 18:52:04

  mbam-log-2010-10-11 (18-52-04).txt

  Scantype: Snelle scan

  Objecten gescand: 124213

  Verstreken tijd: 8 minuut/minuten, 13 seconde(n)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 0

  Registersleutels geïnfecteerd: 1

  Registerwaarden geïnfecteerd: 0

  Registerdata geïnfecteerd: 0

  Mappen geïnfecteerd: 0

  Bestanden geïnfecteerd: 0

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels geïnfecteerd:

  HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

  Registerwaarden geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registerdata geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Mappen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Bestanden geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Rapporteren
• 

  fazantje

  11-10-2010 20:26

  Hoi Marjo,

  Had je het volledige stappenplan uitgevoerd:S

  Dit had je nog niet gedaan, doe dit alsnog!

  Start HijackThis en klik op “Do a scan only” en vink de volgende regels aan:

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

  O2 - BHO: (no name) - {E586A961-08E6-4D33-A6E6-16AE14441595} - c:\windows\system32\dlod562.dll

  O4 - HKCU\..\Run: C:\Users\hansenmarjo\AppData\Local\Temp\Shd.exe

  Sluit alle vensters, behalve HijackThis en klik op fix checked.

  Verwijder, indien nog aanwezig het volgende vet gedrukte bestand: c:\windows\system32\dlod562.dll<—— Dit bestand.

  Start je computer opnieuw op, plaats een nieuw HijackThis logje en vertel hoe het met de problemen zijn.

  Succes,

  Huib:)

  

  Rapporteren
• 

  Piet

  11-10-2010 22:00

  http://onecare.live.com/site/nl-NL/center/whatsnew.htm graag deze uitvoeren.

  Rapporteren
• 

  mar

  12-10-2010 09:21

  Goedenmorgen

  Ik heb gedaan wat u op geschreven heb.

  Ik kan weer op google crome komen.

  hier is mijn hijack loge

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 9:21:03, on 12-10-2010

  Platform: Windows Vista SP2 (WinNT 6.00.1906)

  MSIE: Internet Explorer v8.00 (8.00.6001.18943)

  Boot mode: Normal

  Running processes:

  C:\Windows\system32\Dwm.exe

  C:\Windows\system32\taskeng.exe

  C:\Windows\Explorer.EXE

  C:\Program Files\McAfee.com\Agent\mcagent.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

  C:\Program Files\Windows Live\Messenger\msnmsgr.exe

  C:\Program Files\Windows Media Player\wmpnscfg.exe

  C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

  C:\Users\hansenmarjo\AppData\Roaming\Dropbox\bin\Dropbox.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Windows\System32\mobsync.exe

  C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

  C:\Program Files\GrabIt\GrabIt.exe

  C:\Windows\system32\conime.exe

  C:\Users\hansenmarjo\AppData\Local\Temp\Shd.exe

  E:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

  C:\Users\hansenmarjo\AppData\Local\Google\Chrome\Application\chrome.exe

  C:\Users\hansenmarjo\AppData\Local\Google\Chrome\Application\chrome.exe

  C:\Users\hansenmarjo\AppData\Local\Google\Chrome\Application\chrome.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  O1 - Hosts: ::1 localhost

  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll

  O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: (no name) - {E586A961-08E6-4D33-A6E6-16AE14441595} - c:\windows\system32\dlod562.dll

  O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

  O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

  O4 - HKLM\..\Run: “C:\Program Files\McAfee.com\Agent\mcagent.exe” /runkey

  O4 - HKLM\..\Run: C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe

  O4 - HKLM\..\Run: “E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

  O4 - HKCU\..\Run: “C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background

  O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

  O4 - HKCU\..\Run: “C:\Users\hansenmarjo\AppData\Local\Google\Update\GoogleUpdate.exe” /c

  O4 - HKCU\..\Run: C:\Users\hansenmarjo\AppData\Local\Temp\Shd.exe

  O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

  O4 - Startup: Dropbox.lnk = hansenmarjo\AppData\Roaming\Dropbox\bin\Dropbox.exe

  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  O4 - Global Startup: McAfee Security Scan Plus.lnk = ?

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

  O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/nl-NL/wlscctrl2.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

  O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\Belkin\F5D7000v8\jswpsapi.exe

  O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

  O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

  O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

  O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

  O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

  O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

  O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

  O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

  O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

  O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: @C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe

  O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

  –

  End of file - 8391 bytes

  Gr Mar

  Rapporteren
• 

  fazantje

  12-10-2010 20:25

  Hoi Marjo,

  Laat MBAM nog eens draaien (nu een volledige scan) en plaats dat logje samen met een nieuw HijackThis logje.

  Groetjes Huib:)

  

  Rapporteren
• 

  mar

  14-10-2010 08:24

  goedenmorgen

  Hier is het mbam log en hijack log

  Malwarebytes' Anti-Malware 1.46

  www.malwarebytes.org

  Databaseversie: 4160

  Windows 6.0.6002 Service Pack 2

  Internet Explorer 8.0.6001.18943

  13-10-2010 12:35:25

  mbam-log-2010-10-13 (12-35-25).txt

  Scantype: Volledige scan (C:\|D:\|E:\|)

  Objecten gescand: 501284

  Verstreken tijd: 3 uur/uren, 24 minuut/minuten, 19 seconde(n)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 0

  Registersleutels geïnfecteerd: 1

  Registerwaarden geïnfecteerd: 0

  Registerdata geïnfecteerd: 0

  Mappen geïnfecteerd: 0

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels geïnfecteerd:

  HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

  Registerwaarden geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registerdata geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Mappen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Bestanden geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 8:24:14, on 14-10-2010

  Platform: Windows Vista SP2 (WinNT 6.00.1906)

  MSIE: Internet Explorer v8.00 (8.00.6001.18975)

  Boot mode: Normal

  Running processes:

  C:\Windows\System32\smss.exe

  C:\Windows\system32\csrss.exe

  C:\Windows\system32\wininit.exe

  C:\Windows\system32\csrss.exe

  C:\Windows\system32\services.exe

  C:\Windows\system32\lsass.exe

  C:\Windows\system32\lsm.exe

  C:\Windows\system32\winlogon.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\nvvsvc.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\SLsvc.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\nvvsvc.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\System32\spoolsv.exe

  C:\Windows\system32\taskeng.exe

  C:\Windows\system32\Dwm.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\Explorer.EXE

  C:\Windows\system32\taskeng.exe

  C:\Users\hansenmarjo\AppData\Local\Temp\Shd.exe

  C:\Windows\system32\svchost.exe

  C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

  c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

  C:\Windows\system32\rundll32.exe

  C:\Program Files\McAfee\MPF\MPFSrv.exe

  C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\system32\svchost.exe

  C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\system32\SearchIndexer.exe

  C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe

  C:\Program Files\McAfee.com\Agent\mcagent.exe

  C:\Windows\system32\WUDFHost.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

  C:\Program Files\Windows Live\Messenger\msnmsgr.exe

  C:\Program Files\Windows Media Player\wmpnscfg.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

  C:\Users\hansenmarjo\AppData\Roaming\Dropbox\bin\Dropbox.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Program Files\Windows Media Player\wmpnetwk.exe

  C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

  C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

  C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe

  C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

  c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

  C:\Windows\servicing\TrustedInstaller.exe

  C:\Users\hansenmarjo\AppData\Local\Google\Chrome\Application\chrome.exe

  C:\Users\hansenmarjo\AppData\Local\Google\Chrome\Application\chrome.exe

  C:\Users\hansenmarjo\AppData\Local\Google\Chrome\Application\chrome.exe

  C:\Windows\system32\SearchProtocolHost.exe

  C:\Windows\system32\SearchFilterHost.exe

  E:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

  C:\Windows\system32\wbem\wmiprvse.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  O1 - Hosts: ::1 localhost

  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll

  O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: (no name) - {E586A961-08E6-4D33-A6E6-16AE14441595} - c:\windows\system32\dlod562.dll

  O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

  O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

  O4 - HKLM\..\Run: “C:\Program Files\McAfee.com\Agent\mcagent.exe” /runkey

  O4 - HKLM\..\Run: C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe

  O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

  O4 - HKCU\..\Run: “C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background

  O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

  O4 - HKCU\..\Run: C:\Users\hansenmarjo\AppData\Local\Temp\Shd.exe

  O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

  O4 - Startup: Dropbox.lnk = hansenmarjo\AppData\Roaming\Dropbox\bin\Dropbox.exe

  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  O4 - Global Startup: McAfee Security Scan Plus.lnk = ?

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

  O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/nl-NL/wlscctrl2.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

  O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\Belkin\F5D7000v8\jswpsapi.exe

  O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

  O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

  O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

  O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

  O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

  O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

  O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

  O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

  O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

  O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: @C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe

  O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

  –

  End of file - 9804 bytes

  alvast bedankt voor het mee denken

  mar

  Rapporteren
• 

  fazantje

  14-10-2010 08:58

  Hoi Marjo,

  Je hebt MBAM nog steeds niet up to date8-)

  Jij draait met versie:

  Malwarebytes' Anti-Malware 1.46

  www.malwarebytes.org

  Databaseversie: 4160 terwijl MBAM nu al versie: 4818 heeft.

  Dus update deze en voer nogmaals de scan uit.

  Succes,

  Huib;)

  

  Rapporteren
• 

  mar

  14-10-2010 18:01

  Goedeavon

  Hopelijk is het nu de goede

  Bedankt alvast

  Malwarebytes' Anti-Malware 1.46

  www.malwarebytes.org

  Databaseversie: 4819

  Windows 6.0.6002 Service Pack 2

  Internet Explorer 8.0.6001.18975

  14-10-2010 17:21:44

  mbam-log-2010-10-14 (17-21-44).txt

  Scantype: Volledige scan (C:\|D:\|E:\|)

  Objecten gescand: 519213

  Verstreken tijd: 2 uur/uren, 59 minuut/minuten, 52 seconde(n)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 0

  Registersleutels geïnfecteerd: 3

  Registerwaarden geïnfecteerd: 1

  Registerdata geïnfecteerd: 0

  Mappen geïnfecteerd: 0

  Bestanden geïnfecteerd: 9

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels geïnfecteerd:

  HKEY_CURRENT_USER\SOFTWARE\KOO9RV9K4Z (Trojan.FakeAlert) -> Quarantined and deleted successfully.

  HKEY_CURRENT_USER\SOFTWARE\SMH2B46TDP (Trojan.FakeAlert) -> Quarantined and deleted successfully.

  HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

  Registerwaarden geïnfecteerd:

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koo9rv9k4z (Trojan.FakeAlert) -> Quarantined and deleted successfully.

  Registerdata geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Mappen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Bestanden geïnfecteerd:

  C:\Users\hansenmarjo\AppData\Local\Temp\3.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Users\hansenmarjo\AppData\Local\Temp\CB2C.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

  C:\Users\hansenmarjo\AppData\Local\Temp\Shb.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Users\hansenmarjo\AppData\Local\Temp\Shc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Windows\Szurea.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Users\hansenmarjo\AppData\Local\Temp\Shd.exe (Trojan.FakeAlert) -> Delete on reboot.

  C:\Users\hansenmarjo\AppData\Roaming\chrtmp (Malware.Trace) -> Quarantined and deleted successfully.

  C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

  C:\Users\hansenmarjo\AppData\Roaming\dsfsds.bat (Malware.Trace) -> Quarantined and deleted successfully.

  en een hijack loge

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 17:59:54, on 14-10-2010

  Platform: Windows Vista SP2 (WinNT 6.00.1906)

  MSIE: Internet Explorer v8.00 (8.00.6001.18975)

  Boot mode: Normal

  Running processes:

  C:\Windows\System32\smss.exe

  C:\Windows\system32\csrss.exe

  C:\Windows\system32\wininit.exe

  C:\Windows\system32\csrss.exe

  C:\Windows\system32\services.exe

  C:\Windows\system32\lsass.exe

  C:\Windows\system32\lsm.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\winlogon.exe

  C:\Windows\system32\nvvsvc.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\SLsvc.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\nvvsvc.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\System32\spoolsv.exe

  C:\Windows\system32\taskeng.exe

  C:\Windows\system32\svchost.exe

  C:\Windows\system32\Dwm.exe

  C:\Windows\Explorer.EXE

  C:\Windows\system32\taskeng.exe

  C:\Windows\system32\svchost.exe

  C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

  c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

  C:\Windows\system32\rundll32.exe

  C:\Program Files\McAfee\MPF\MPFSrv.exe

  C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\system32\svchost.exe

  C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

  C:\Windows\System32\svchost.exe

  C:\Windows\system32\SearchIndexer.exe

  C:\Program Files\McAfee.com\Agent\mcagent.exe

  C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe

  C:\Windows\system32\WUDFHost.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

  C:\Program Files\Windows Live\Messenger\msnmsgr.exe

  C:\Program Files\Windows Media Player\wmpnscfg.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

  C:\Users\hansenmarjo\AppData\Roaming\Dropbox\bin\Dropbox.exe

  C:\Program Files\Windows Sidebar\sidebar.exe

  C:\Windows\System32\mobsync.exe

  C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

  C:\Program Files\Windows Media Player\wmpnetwk.exe

  C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

  C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

  C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

  c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

  C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

  C:\Users\hansenmarjo\AppData\Local\Google\Chrome\Application\chrome.exe

  C:\Users\hansenmarjo\AppData\Local\Google\Chrome\Application\chrome.exe

  C:\Users\hansenmarjo\AppData\Local\Google\Chrome\Application\chrome.exe

  C:\Windows\system32\SearchProtocolHost.exe

  C:\Windows\system32\SearchFilterHost.exe

  E:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

  C:\Windows\system32\wbem\wmiprvse.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  O1 - Hosts: ::1 localhost

  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll

  O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: (no name) - {E586A961-08E6-4D33-A6E6-16AE14441595} - c:\windows\system32\dlod562.dll

  O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

  O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

  O4 - HKLM\..\Run: “C:\Program Files\McAfee.com\Agent\mcagent.exe” /runkey

  O4 - HKLM\..\Run: C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe

  O4 - HKCU\..\Run: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

  O4 - HKCU\..\Run: “C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background

  O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

  O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

  O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

  O4 - Startup: Dropbox.lnk = hansenmarjo\AppData\Roaming\Dropbox\bin\Dropbox.exe

  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

  O4 - Global Startup: McAfee Security Scan Plus.lnk = ?

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

  O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

  O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/nl-NL/wlscctrl2.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

  O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\Belkin\F5D7000v8\jswpsapi.exe

  O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

  O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

  O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

  O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

  O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

  O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

  O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

  O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

  O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

  O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: @C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe

  O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

  –

  End of file - 9493 bytes

  Rapporteren
• 

  fazantje

  14-10-2010 18:45

  Hoi Marjo,

  Zie je het verschil nu met die oude versie en de nieuwe versie van MBAM;)

  Die heeft in ieder geval zijn werk gedaan.

  Over: c:\windows\system32\dlod562.dll is helemaal niets te vinden en hoort dus ook niet thuis op jou computer, maar komt wel steeds terug:(

  Doe het volgende:

  Download Combofix naar je Bureaublad.

  http://download.bleepingcomputer.com/sUBs/ComboFix.exe

  OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download Combofix opnieuw.

  Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

  Dubbelklik op Combofix.exe om het te starten.

  Indien je Combofix al eerder hebt gebruikt, kan je een waarschuwing krijgen dat een update beschikbaar is. Sta toe dat ComboFix wordt geupdate.

  Klik op OK in het “NirCmd” venstertje.

  Klik na afloop terug op Ja om het scannen op malware te starten.

  Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

  Wanneer de fix voltooid is en na herstart, zal de log Combofix.txt openen.

  Post het logje van ComboFix samen met een nieuw HijackThis logje, en vertel hoe het met jou probleem is.

  Deze scan kan een poosje duren, dus denk niet van hij zit vast.

  Succes,

  Huib;)

  

  Rapporteren
• 

  mar

  14-10-2010 19:49

  Goedenavond

  Ik heb geprobeerd dit progamma te downloaden maar helaas

  Ik heb mcfee en weet niet hoe ik het uit kan zetten.

  Misschien weet u het

  gr mar

  Rapporteren