steeds herstartende pc

• 

  pa3gds

  21-08-2011 21:50

  Hallo,

  Bedankt voor het lezen van dit berichtje.

  Sinds enige tijd heb ik last van een steeds, onregelmatig herstartende pc.

  Ook het opstarten gaat trager.

  Het stappenplan heb ik uitgevoerd, maar er werd niets gevonden.

  Misschien wil iemand eens naar mijn logfile kijken?

  Bedankt, Math

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 21:45:33, on 21-8-2011

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\PROGRA~1\AVG\AVG10\avgchsvx.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe

  C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

  C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe

  C:\Program Files\AVG\AVG10\avgwdsvc.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\WINDOWS\System32\GEARSec.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Trust\R-Series Mouse And Keyboard\KMWDSrv.exe

  C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe

  C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  D:\GHOST\Agent\VProSvc.exe

  C:\Program Files\AVG\AVG10\avgnsx.exe

  C:\Program Files\Nero\Nero BackItUp 4\IoctlSvc.exe

  C:\WINDOWS\system32\PSIService.exe

  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

  C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

  C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\IObit\Advanced SystemCare 4\PMonitor.exe

  C:\Program Files\AVG\AVG10\avgtray.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

  C:\PROGRA~1\AVG\AVG10\avgrsx.exe

  C:\Program Files\AVG\AVG10\avgcsrvx.exe

  C:\Program Files\Outlook Express\msimn.exe

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Windows Live\Messenger\msnmsgr.exe

  C:\Program Files\Windows Live\Contacts\wlcomm.exe

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nl.msn.com/

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

  O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

  O4 - HKLM\..\Run: C:\Program Files\AVG\AVG10\avgtray.exe

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: “C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe”

  O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Lokale service’)

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Netwerkservice’)

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

  O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html

  O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

  O9 - Extra ‘Tools’ menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

  O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)

  O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238881176171

  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

  O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

  O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

  O23 - Service: Advanced SystemCare Service (AdvancedSystemCareService) - IObit - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe

  O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

  O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe

  O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

  O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

  O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: IMF Service (IMFservice) - IObit - C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Trust\R-Series Mouse And Keyboard\KMWDSrv.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe

  O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

  O23 - Service: Norton Ghost - Symantec Corporation - D:\GHOST\Agent\VProSvc.exe

  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Program Files\Nero\Nero BackItUp 4\IoctlSvc.exe

  O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

  O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011\RpcAgentSrv.exe

  O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

  –

  End of file - 10680 bytes

  Rapporteren
• 

  Jos H

  21-08-2011 22:52

  Stappenplan gedaan, zet dan ook het mbam logje even hier neer .

  Rapporteren
• 

  Ben

  22-08-2011 13:22

  hallo,

  Welke programma's heb je allemaal van Norton ?

  ook de virus scanner?

  Gebruik je de railtime bescherming van IObit Malware Fighter en ad-aware?

  Dat werkt ook vertragend en beide programma's staan ook niet zo goed aangescheven!

  Dus aan jou de keus om ze te behouden!

  Gebruik je de Google toolbar zoniet ook verwijderen die vertraagd ook! (onder software)

  Als je wat van bovenstaande dingen heb verwijderd plaats dan een nieuw hijack this logje samen met het mbam logje.

  En geef aub antwoord op mijn vragen dan gaan we daarna door om het een en ander uit je logje te verwijderen.

  http://2.bp.blogspot.com/_NAn8-ZItaHE/Scq3w6FaicI/AAAAAAAACVY/QqPkGy7EU7U/s320/school69.gif

  Ben

  Rapporteren
• 

  pa3gds

  22-08-2011 22:15

  Hallo Jos en Ben,

  Bedankt voor jullie reactie.

  Van Norton heb ik Ghost verwijderd. Verder gebruik ik hier geen software van(bij mijn weten)

  Mijn virusscanner is van AVG.

  IObit Malware Fighter, ad-aware en Google toolbar heb ik verwijderd.

  MBAM logje:

  Malwarebytes' Anti-Malware 1.51.1.1800

  www.malwarebytes.org

  Databaseversie: 7537

  Windows 5.1.2600 Service Pack 3

  Internet Explorer 8.0.6001.18702

  22-8-2011 21:55:42

  mbam-log-2011-08-22 (21-55-42).txt

  Scantype: Volledige scan (C:\|)

  Objecten gescand: 241758

  Verstreken tijd: 1 uur/uren, 19 minuut/minuten, 12 seconde(n)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 0

  Registersleutels geïnfecteerd: 0

  Registerwaarden geïnfecteerd: 3

  Registerdata geïnfecteerd: 3

  Mappen geïnfecteerd: 0

  Bestanden geïnfecteerd: 4

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registerwaarden geïnfecteerd:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_XMLLookup (Hijacker.XMLLookup) -> Value: bak_XMLLookup -> Quarantined and deleted successfully.

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_Application (Hijacker.Application) -> Value: bak_Application -> Quarantined and deleted successfully.

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_intl (Hijacker.intl) -> Value: bak_intl -> Quarantined and deleted successfully.

  Registerdata geïnfecteerd:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\XMLLookup (Hijacker.XMLLookup) -> Bad: (http://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (http://shell.windows.com/fileassoc/fileassoc.asp?LangID=%04x&Ext=%s) -> Quarantined and deleted successfully.

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\Application (Hijacker.Application) -> Bad: (http://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (http://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s) -> Quarantined and deleted successfully.

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\intl (Hijacker.intl) -> Bad: (http://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (http://shell.windows.com/fileassoc/fileassoc.asp?LangID=%04x&Ext=%s) -> Quarantined and deleted successfully.

  Mappen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Bestanden geïnfecteerd:

  c:\cisco network magic pro v5.5.9195.0 multilanguage\patch\Patch.exe (Patch.NetworkMagic) -> Quarantined and deleted successfully.

  c:\program files\alcohol soft\alcohol 120\Langs\AX_RU.dll (Malware.Packer.GenX) -> Quarantined and deleted successfully.

  c:\program files\purenetwork\cisco network magic pro v5.5.9195.0 multilanguage\patch\Patch.exe (Patch.NetworkMagic) -> Quarantined and deleted successfully.

  c:\system volume information\_restore{e69b3283-4c77-458f-9ddc-f53e97d00e18}\RP720\A0196092.rbf (Adware.WidgiToolbar) -> Quarantined and deleted successfully.

  In een volgende post plaats ik nogmaals een nieuw hijack this logje.

  Bedankt voor de hulp,

  Groet,

  Math

  Rapporteren
• 

  pa3gds

  22-08-2011 22:18

  Bij deze nog het Hijack this logje:

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 22:13:11, on 22-8-2011

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\PROGRA~1\AVG\AVG10\avgchsvx.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

  C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe

  C:\Program Files\AVG\AVG10\avgwdsvc.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Trust\R-Series Mouse And Keyboard\KMWDSrv.exe

  C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe

  C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  C:\Program Files\AVG\AVG10\avgtray.exe

  C:\Program Files\Nero\Nero BackItUp 4\IoctlSvc.exe

  C:\WINDOWS\system32\PSIService.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

  C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

  C:\Program Files\AVG\AVG10\avgnsx.exe

  C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

  C:\PROGRA~1\AVG\AVG10\avgrsx.exe

  C:\Program Files\AVG\AVG10\avgcsrvx.exe

  C:\Program Files\Mozilla Firefox\firefox.exe

  C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nl.msn.com/

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

  O4 - HKLM\..\Run: C:\Program Files\AVG\AVG10\avgtray.exe

  O4 - HKLM\..\Run: “C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe” /runcleanupscript

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Netwerkservice’)

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

  O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html

  O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

  O9 - Extra ‘Tools’ menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

  O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)

  O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238881176171

  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

  O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

  O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

  O23 - Service: Advanced SystemCare Service (AdvancedSystemCareService) - IObit - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe

  O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

  O23 - Service: Google Updateservice (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe (file missing)

  O23 - Service: Google Update-service (gupdatem) (gupdatem) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe (file missing)

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Trust\R-Series Mouse And Keyboard\KMWDSrv.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe

  O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Program Files\Nero\Nero BackItUp 4\IoctlSvc.exe

  O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

  O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011\RpcAgentSrv.exe

  O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  –

  End of file - 8615 bytes

  Ben benieuwd naar jullie bevindingen.

  Groet,

  Math

  Rapporteren
• 

  Ben

  23-08-2011 13:11

  Hallo Math,

  Start HijackThis, klik op scan en vink de volgende regels aan:

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

  O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)

  O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)

  Sluit alle vensters, behalve HijackThis en klik op fix checked.

  Ga naar: C:\Program Files\Lavasoft en verwijder daar de vet aangegeven map.

  Download http://www.filehippo.com/download_ccleaner

  Bij het installeren van de nieuwste Ccleaner wordt nu ook Google Chrome (helaas) mee geinstalleerd.

  Je moet tijdens het installeren een vinkje weg halen, zodat Google Chrome niet geinstalleerd word

  Installeer CCleaner en start CCleaner op.

  • Klik in de linkse kolom op Cleaner.

  • Klik achtereenvolgens op Analyseren en Opschonen.

  • Klik vervolgens in de linkse kolom op Register en klik op Scan naar problemen.

  • Als er fouten gevonden worden klik je op Herstel geselecteerde problemen en OK.

  • Dan krijg je de vraag om een back-up te maken, klik op JA. en kies dan Herstel alle geselecteerde fouten.

  • Sluit hierna CCleaner af.

  Herstart hierna je pc en plaats een nieuw Hijack this logje en vertel hoe het met je problemmen staat??

  http://2.bp.blogspot.com/_NAn8-ZItaHE/Scq3w6FaicI/AAAAAAAACVY/QqPkGy7EU7U/s320/school69.gif

  Ben

  Rapporteren
• 

  pa3gds

  23-08-2011 22:02

  Hoi Ben,

  Ik heb die vier regels in Hijack this verwijderd.

  Ik krijg deze map niet verwijderd: C:\Program Files\Lavasoft, ook niet via -configuratiescherm -software verwijderen

  Ik heb CC cleaner geinstalleerd en voorgestelde akties uitgevoerd.

  Ik vind de pc nog traag met opstarten. Ik heb tot dusver geen last meer gehad van een spontaan herstartende pc.

  Nogmaals een Hijack this file:

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 21:58:03, on 23-8-2011

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\PROGRA~1\AVG\AVG10\avgchsvx.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

  C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe

  C:\Program Files\AVG\AVG10\avgwdsvc.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Trust\R-Series Mouse And Keyboard\KMWDSrv.exe

  C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe

  C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  C:\Program Files\AVG\AVG10\avgtray.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

  C:\Program Files\Nero\Nero BackItUp 4\IoctlSvc.exe

  C:\WINDOWS\system32\PSIService.exe

  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

  C:\Program Files\AVG\AVG10\avgnsx.exe

  C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\WINDOWS\system32\wuauclt.exe

  C:\PROGRA~1\AVG\AVG10\avgrsx.exe

  C:\Program Files\AVG\AVG10\avgcsrvx.exe

  C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nl.msn.com/

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll

  O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O4 - HKLM\..\Run: C:\Program Files\AVG\AVG10\avgtray.exe

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Netwerkservice’)

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

  O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html

  O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

  O9 - Extra ‘Tools’ menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238881176171

  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

  O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

  O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

  O23 - Service: Advanced SystemCare Service (AdvancedSystemCareService) - IObit - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe

  O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe

  O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

  O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Trust\R-Series Mouse And Keyboard\KMWDSrv.exe

  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe

  O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Program Files\Nero\Nero BackItUp 4\IoctlSvc.exe

  O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

  O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011\RpcAgentSrv.exe

  O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  –

  End of file - 8017 bytes

  Groet,

  Math

  Rapporteren
• 

  fazantje

  23-08-2011 23:00

  Hoi Math,

  Download DDS Hier en bewaar het op je bureaublad (en schakel antivirusprogramma's die scripts blokkeren uit, indien je problemen tijdens het uitvoeren ondervindt.)

  Dubbelklik op dds.scr om de tool te starten.

  Na het voltooien van de scan worden 2 tekstbestanden geopend:

  DDS.txt en Attach.txt.

  Sla beide tekstbestanden op op je bureaublad, waarna je het “D.D.S. - How to post the logs” venstertje mag sluiten door op OK te klikken..

  Kopieer en plak ENKEL het DDS.txt log in je volgende post.

  Vertel gelijk hoe het met probleem is..

  Succes,

  Huib;)

  

  Rapporteren
• 

  pa3gds

  24-08-2011 09:41

  Hoi Huib,

  Bedankt voor je reactie.

  Ik heb de pc deze nacht laten aanstaan, en deze ochtend had ik weer geen signaaal op het beeldscherm.(de voeding stond wel aan)

  Het opstarten gaat ook nog steeds traag.

  Hierbij de logfile zoals je verzocht:

  .

  DDS (Ver_2011-06-23.01) - NTFSx86

  Internet Explorer: 8.0.6001.18702

  Run by PA3GDS at 9:29:20 on 2011-08-24

  Microsoft Windows XP Home Edition 5.1.2600.3.1252.31.1043.18.1535.535

  .

  AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

  .

  ============== Running Processes ===============

  .

  C:\PROGRA~1\AVG\AVG10\avgchsvx.exe

  C:\WINDOWS\system32\svchost -k DcomLaunch

  svchost.exe

  C:\WINDOWS\System32\svchost.exe -k netsvcs

  svchost.exe

  C:\WINDOWS\System32\svchost.exe -k netsvcs

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

  C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe

  C:\Program Files\AVG\AVG10\avgwdsvc.exe

  C:\Program Files\Bonjour\mDNSResponder.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Trust\R-Series Mouse And Keyboard\KMWDSrv.exe

  C:\Program Files\AVG\AVG10\avgtray.exe

  C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

  C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

  C:\Program Files\Nero\Nero BackItUp 4\IoctlSvc.exe

  C:\WINDOWS\system32\PSIService.exe

  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

  C:\WINDOWS\System32\svchost.exe -k imgsvc

  C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

  C:\Program Files\AVG\AVG10\avgnsx.exe

  C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  C:\Program Files\Spotnet\Spotnet.exe

  C:\Program Files\Spotnet\SABnzbd.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\AVG\AVG10\avgmfapx.exe

  C:\WINDOWS\system32\wuauclt.exe

  C:\PROGRA~1\AVG\AVG10\avgrsx.exe

  C:\Program Files\AVG\AVG10\avgcsrvx.exe

  .

  ============== Pseudo HJT Report ===============

  .

  uStart Page = hxxp://www.startpagina.nl/

  uInternet Settings,ProxyOverride = *.local

  mURLSearchHooks: H - No File

  BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

  BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll

  BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

  BHO: Windows Live Aanmelden - Help: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

  BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

  BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File

  uRun: c:\windows\system32\ctfmon.exe

  mRun: c:\program files\avg\avg10\avgtray.exe

  uPolicies-explorer: NoInstrumentation = 1 (0x1)

  IE: E&xporteren naar Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

  IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html

  IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

  IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

  IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

  IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

  DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab

  DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238881176171

  DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab

  DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

  DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab

  DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab

  DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab

  DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

  TCP: DhcpNameServer = 212.54.40.25 212.54.35.25

  TCP: Interfaces\{1EDE7F12-F163-43C6-B14E-07428E984275} : DhcpNameServer = 212.54.40.25 212.54.35.25

  TCP: Interfaces\{79B61CB6-5EF0-4813-A33A-DFBC095EB72C} : DhcpNameServer = 212.54.40.25 212.54.35.25

  Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

  Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll

  Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll

  SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

  SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

  SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

  Hosts: 127.0.0.1 www.spywareinfo.com

  .

  ================= FIREFOX ===================

  .

  FF - ProfilePath - c:\documents and settings\pa3gds\application data\mozilla\firefox\profiles\ajd1s8ho.default\

  FF - prefs.js: browser.search.selectedEngine - Google

  FF - prefs.js: browser.startup.homepage - hxxp://www.startpagina.nl/

  FF - prefs.js: keyword.URL - hxxp://nl.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=382950&p=

  FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll

  FF - component: c:\program files\avg\avg10\firefox4\components\avgssff5.dll

  FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll

  FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll

  .

  —- FIREFOX POLICIES —-

  FF - user.js: browser.cache.memory.capacity - 65536

  FF - user.js: browser.chrome.favicons - false

  FF - user.js: browser.display.show_image_placeholders - true

  FF - user.js: browser.turbo.enabled - true

  FF - user.js: browser.urlbar.autocomplete.enabled - true

  FF - user.js: browser.urlbar.autofill - true

  FF - user.js: content.interrupt.parsing - true

  FF - user.js: content.max.tokenizing.time - 2250000

  FF - user.js: content.notify.backoffcount - 5

  FF - user.js: content.notify.interval - 750000

  FF - user.js: content.notify.ontimer - true

  FF - user.js: content.switch.threshold - 750000

  FF - user.js: network.http.max-connections - 48

  FF - user.js: network.http.max-connections-per-server - 16

  FF - user.js: network.http.max-persistent-connections-per-proxy - 16

  FF - user.js: network.http.max-persistent-connections-per-server - 8

  FF - user.js: network.http.pipelining - true

  FF - user.js: network.http.pipelining.firstrequest - true

  FF - user.js: network.http.pipelining.maxrequests - 8

  FF - user.js: network.http.proxy.pipelining - true

  FF - user.js: network.http.request.max-start-delay - 0

  FF - user.js: nglayout.initialpaint.delay - 0

  FF - user.js: plugin.expose_full_path - true

  FF - user.js: ui.submenuDelay - 0

  .

  ============= SERVICES / DRIVERS ===============

  .

  R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys

  R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys

  R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys

  R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys

  R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys

  R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys

  R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys

  R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys

  R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\iobit\advanced systemcare 4\ASCService.exe

  R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe

  R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe

  R2 drhard;drhard;c:\windows\system32\drivers\drhard.sys

  R2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files\trust\r-series mouse and keyboard\KMWDSrv.exe

  R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe

  R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys

  R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys

  R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys

  R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;c:\windows\system32\drivers\PhTVTune.sys

  R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe

  S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe

  S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe

  S3 APL531;OVT Scanner;c:\windows\system32\drivers\ov550i.sys

  S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys

  S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe

  S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys

  S3 PRISM_A00;PRISM 802.11g Driver;c:\windows\system32\drivers\PRISMA00.sys

  S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8192su.sys

  S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys

  S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys

  S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys

  S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys

  S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys

  S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\sisoftware\sisoftware sandra lite 2011\RpcAgentSrv.exe

  S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM

  S3 WLAN_DCB;IEEE 802.11g Wireless LAN CardBus Driver;c:\windows\system32\drivers\WLANDCB.sys

  .

  =============== Created Last 30 ================

  .

  2011-08-23 19:42:10 ——– d–h–r- c:\documents and settings\pa3gds\Onlangs geopend

  2011-08-23 19:40:27 ——– d—–w- c:\program files\CCleaner

  2011-08-22 21:14:40 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

  2011-08-22 20:47:49 ——– dc-h–w- c:\windows\ie8

  2011-08-22 20:27:00 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll

  2011-08-22 20:26:57 89048 —-a-w- c:\program files\mozilla firefox\libEGL.dll

  2011-08-22 20:26:57 785368 —-a-w- c:\program files\mozilla firefox\mozsqlite3.dll

  2011-08-22 20:26:57 719832 —-a-w- c:\program files\mozilla firefox\mozcpp19.dll

  2011-08-22 20:26:57 478168 —-a-w- c:\program files\mozilla firefox\libGLESv2.dll

  2011-08-22 20:26:57 2106216 —-a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll

  2011-08-22 20:26:57 1998168 —-a-w- c:\program files\mozilla firefox\d3dx9_43.dll

  2011-08-22 20:26:57 1846232 —-a-w- c:\program files\mozilla firefox\mozjs.dll

  2011-08-22 20:26:57 16856 —-a-w- c:\program files\mozilla firefox\plugin-container.exe

  2011-08-22 20:26:57 15832 —-a-w- c:\program files\mozilla firefox\mozalloc.dll

  2011-08-21 19:29:46 388096 —-a-r- c:\documents and settings\pa3gds\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe

  2011-08-21 19:29:45 ——– d—–w- c:\program files\Trend Micro

  2011-08-20 13:39:08 ——– d—–w- c:\documents and settings\pa3gds\application data\RT Systems

  2011-08-20 13:39:08 ——– d—–w- c:\documents and settings\all users\application data\RT Systems

  2011-08-20 13:39:06 ——– d—–w- c:\program files\common files\RT SystemsV4

  2011-08-18 21:19:09 2263 —-a-w- c:\documents and settings\all users\application data\xmlC4.tmp

  2011-08-18 21:19:09 13146 —-a-w- c:\documents and settings\all users\application data\xmlC3.tmp

  2011-08-18 21:19:07 8320 —-a-w- c:\documents and settings\all users\application data\xmlC2.tmp

  2011-08-18 21:17:59 3497832 —-a-w- c:\windows\system32\d3dx9_34.dll

  2011-08-18 21:15:34 ——– d—–w- c:\windows\Logs

  2011-08-18 21:15:12 ——– d—–w- c:\program files\SiSoftware

  2011-08-14 21:39:03 ——– d—–w- c:\documents and settings\pa3gds\Incompleet

  2011-08-11 15:47:31 139656 -c—-w- c:\windows\system32\dllcache\rdpwd.sys

  2011-08-11 15:47:05 10496 -c—-w- c:\windows\system32\dllcache\ndistapi.sys

  .

  ==================== Find3M ====================

  .

  2011-07-15 13:29:31 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys

  2011-07-08 14:02:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys

  2011-07-06 17:52:42 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys

  2011-07-06 17:52:42 22712 —-a-w- c:\windows\system32\drivers\mbam.sys

  2011-06-24 14:10:39 139656 —-a-w- c:\windows\system32\drivers\rdpwd.sys

  2011-06-23 18:31:52 916480 —-a-w- c:\windows\system32\wininet.dll

  2011-06-23 18:31:52 43520 ——w- c:\windows\system32\licmgr10.dll

  2011-06-23 18:31:52 1469440 ——w- c:\windows\system32\inetcpl.cpl

  2011-06-23 12:05:34 385024 ——w- c:\windows\system32\html.iec

  2011-06-20 17:44:48 293888 —-a-w- c:\windows\system32\winsrv.dll

  2011-06-06 11:35:33 1859072 —-a-w- c:\windows\system32\win32k.sys

  2011-05-31 19:26:12 73096 —-a-w- c:\windows\system32\drivers\ftser2k.sys

  2011-05-31 19:26:12 52616 —-a-w- c:\windows\system32\ftserui2.dll

  2011-05-31 19:26:10 69000 —-a-w- c:\windows\system32\ftcserco.dll

  2011-05-31 19:26:10 61704 —-a-w- c:\windows\system32\drivers\ftdibus.sys

  2011-05-31 19:26:10 203144 —-a-w- c:\windows\system32\ftd2xx.dll

  2011-05-31 19:26:10 201096 —-a-w- c:\windows\system32\FTLang.dll

  2011-05-31 19:26:10 105352 —-a-w- c:\windows\system32\ftbusui.dll

  .

  ============= FINISH: 9:33:21,84 ===============

  Bedankt alvast,

  Math

  Rapporteren
• 

  Ben

  24-08-2011 14:31

  Hallo Math,

  eerst zeg je:IObit Malware Fighter, ad-aware en Google toolbar heb ik verwijderd.(hoe dan)

  dan zeg je:Ik krijg deze map niet verwijderd: C:\Program Files\Lavasoft, ook niet via -configuratiescherm -software verwijderen

  Staan IObit en ad-aware nog in de software lijst dan ? want je had ze eerst verwijderd zij je?

  doe nog even deze stap;

  Start HijackThis, klik op scan en vink de volgende regel aan:

  O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

  Sluit alle vensters, behalve HijackThis en klik op fix checked.

  Start pc opnieuw op en plaats daarna een nieuw hijack this logje, de antwooden op mijn vragen en hoe gaat met je probleem??

  http://2.bp.blogspot.com/_NAn8-ZItaHE/Scq3w6FaicI/AAAAAAAACVY/QqPkGy7EU7U/s320/school69.gif

  Ben

  Rapporteren