Logfile - Trojan.SpyEyes

• 

  Pieter82

  28-08-2011 19:47

  Probleem:

  - Opstarten computer (na inloggen) gaat langzamer dan normaal

  - Websites openen traag

  - Typen op Internet, invoervakken zoals hier, Hotmail erg traag

  - Typen in Word gaat uitstekend

  Heb de stappen van de bovenstaande posting doorlopen, heb gescanned met Avira Antivirus.

  Hieronder Malware log en mijn Hijacklog.

  Alvast vriendelijk bedankt!

  Malwarebytes' Anti-Malware 1.50.1.1100

  www.malwarebytes.org

  Databaseversie: 7595

  Windows 5.1.2600 Service Pack 3

  Internet Explorer 8.0.6001.18702

  28-8-2011 19:25:41

  mbam-log-2011-08-28 (19-25-41).txt

  Scantype: Snelle scan

  Objecten gescand: 350432

  Verstreken tijd: 7 minuut/minuten, 12 seconde(n)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 0

  Registersleutels geïnfecteerd: 0

  Registerwaarden geïnfecteerd: 0

  Registerdata geïnfecteerd: 0

  Mappen geïnfecteerd: 0

  Bestanden geïnfecteerd: 0

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registerwaarden geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registerdata geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Mappen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Bestanden geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 19:46:22, on 28-8-2011

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\Avira\AntiVir Desktop\sched.exe

  C:\WINDOWS\system32\agrsmsvc.exe

  C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe

  C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe

  C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe

  C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe

  C:\Program Files\Common Files\Authentium\AntiVirus5\vseqrts.exe

  C:\Program Files\Microsoft Application Virtualization Client\sftdcc.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceUI.exe

  C:\WINDOWS\system32\igfxtray.exe

  C:\WINDOWS\system32\hkcmd.exe

  C:\WINDOWS\system32\igfxsrvc.exe

  C:\WINDOWS\system32\igfxpers.exe

  C:\Program Files\Analog Devices\Core\smax4pnp.exe

  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

  C:\Program Files\Java\jre6\bin\jusched.exe

  C:\WINDOWS\system32\TDxVGAUTIL.EXE

  C:\WINDOWS\system32\RunDll32.exe

  C:\Program Files\QuickTime\qttask.exe

  C:\Program Files\Common Files\Real\Update_OB\realsched.exe

  C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe

  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\WINDOWS\system32\wbem\wmiapsrv.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Avira\AntiVir Desktop\avcenter.exe

  C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

  C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

  C:\WINDOWS\system32\NOTEPAD.EXE

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://nl.woofi.info

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,“C:\Program Files\Microsoft Application Virtualization Client\sftdcc.exe”,

  O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

  O4 - HKLM\..\Run: C:\WINDOWS\system32\igfxtray.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\hkcmd.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\igfxpers.exe

  O4 - HKLM\..\Run: C:\Program Files\Analog Devices\Core\smax4pnp.exe

  O4 - HKLM\..\Run: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft Application Virtualization Client\SFTTray.exe” /autostart

  O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

  O4 - HKLM\..\Run: C:\WINDOWS\system32\TDxVGAUTIL.EXE

  O4 - HKLM\..\Run: RunDll32 cmcnfgu.cpl,CMICtrlWnd

  O4 - HKLM\..\Run: %SystemRoot%\system32\mobsync.exe /logon

  O4 - HKLM\..\Run: C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

  O4 - HKLM\..\Run: “C:\Program Files\Avira\AntiVir Desktop\avgnt.exe” /min

  O4 - HKLM\..\RunOnce: C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: “C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe” -nosplash -minimized

  O4 - HKCU\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  O4 - HKUS\S-1-5-19\..\Run: C:\Recycle.Bin\Recycle.Bin.exe (User ‘Lokale service’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - Startup: Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe

  O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

  O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} (BitDefender QuickScan Control) - http://quickscan.bitdefender.com/qsax/qsax.cab

  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1237553506019

  O16 - DPF: {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} (RealPlayer G2 Control) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ng.local

  O17 - HKLM\Software\..\Telephony: DomainName = ng.local

  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ng.local

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

  O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe

  O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

  O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  O23 - Service: eBeam Device Service - Luidia, Inc. - C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe

  O23 - Service: Google Updateservice (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe (file missing)

  O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: vseamps - Authentium, Inc - C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe

  O23 - Service: vsedsps - Authentium, Inc - C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe

  O23 - Service: vseqrts - Authentium, Inc - C:\Program Files\Common Files\Authentium\AntiVirus5\vseqrts.exe

  –

  End of file - 9562 bytes

  Rapporteren
• 

  Ben

  28-08-2011 19:57

  Hallo Pieter,

  Wil je Mbam even updaten zitten al aan 1.51.1.1800 versie 7595

  Even opnieuw scannen en nieuwe logjes plaatsen!

  suc6 Ben

  http://2.bp.blogspot.com/_NAn8-ZItaHE/Scq3w6FaicI/AAAAAAAACVY/QqPkGy7EU7U/s320/school69.gif

  Rapporteren
• 

  Pieter82

  28-08-2011 20:11

  Hoi Ben,

  Bedankt voor je snelle reactie,hierbij een nieuwe log van Malwarebytes:

  Malwarebytes' Anti-Malware 1.51.1.1800

  www.malwarebytes.org

  Databaseversie: 7595

  Windows 5.1.2600 Service Pack 3

  Internet Explorer 8.0.6001.18702

  28-8-2011 20:06:26

  mbam-log-2011-08-28 (20-06-26).txt

  Scantype: Snelle scan

  Objecten gescand: 350818

  Verstreken tijd: 4 minuut/minuten, 28 seconde(n)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 0

  Registersleutels geïnfecteerd: 0

  Registerwaarden geïnfecteerd: 0

  Registerdata geïnfecteerd: 0

  Mappen geïnfecteerd: 0

  Bestanden geïnfecteerd: 0

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registerwaarden geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Registerdata geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Mappen geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Bestanden geïnfecteerd:

  (Geen kwaadaardige objecten gedetecteerd)

  Rapporteren
• 

  Ben

  28-08-2011 20:19

  Hallo Pieter ,

  Is jou virusscanner Avira?

  Zo ja kijk of je onder software Authentium\AntiVirus5 kan verwijderen

  Lukt dat plaats dan een nieuw Haijck this logje.

  Ben

  http://2.bp.blogspot.com/_NAn8-ZItaHE/Scq3w6FaicI/AAAAAAAACVY/QqPkGy7EU7U/s320/school69.gif

  Rapporteren
• 

  Pieter82

  28-08-2011 21:01

  Was niet mogelijk via software dus heb het ‘beginmapje’ Authentium via de veilige modus verwijderd. Zie het helemaal onderaan de logfile toch weer genoemd worden.

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 20:56:02, on 28-8-2011

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\Avira\AntiVir Desktop\sched.exe

  C:\WINDOWS\system32\agrsmsvc.exe

  C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe

  C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe

  C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceUI.exe

  C:\Program Files\Microsoft Application Virtualization Client\sftdcc.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\system32\igfxtray.exe

  C:\WINDOWS\system32\igfxsrvc.exe

  C:\WINDOWS\system32\hkcmd.exe

  C:\WINDOWS\system32\igfxpers.exe

  C:\Program Files\Analog Devices\Core\smax4pnp.exe

  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

  C:\Program Files\Java\jre6\bin\jusched.exe

  C:\WINDOWS\system32\TDxVGAUTIL.EXE

  C:\WINDOWS\system32\RunDll32.exe

  C:\Program Files\QuickTime\qttask.exe

  C:\Program Files\Common Files\Real\Update_OB\realsched.exe

  C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe

  C:\WINDOWS\system32\wbem\wmiapsrv.exe

  C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://nl.woofi.info

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,“C:\Program Files\Microsoft Application Virtualization Client\sftdcc.exe”,

  O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

  O4 - HKLM\..\Run: C:\WINDOWS\system32\igfxtray.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\hkcmd.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\igfxpers.exe

  O4 - HKLM\..\Run: C:\Program Files\Analog Devices\Core\smax4pnp.exe

  O4 - HKLM\..\Run: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft Application Virtualization Client\SFTTray.exe” /autostart

  O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

  O4 - HKLM\..\Run: C:\WINDOWS\system32\TDxVGAUTIL.EXE

  O4 - HKLM\..\Run: RunDll32 cmcnfgu.cpl,CMICtrlWnd

  O4 - HKLM\..\Run: %SystemRoot%\system32\mobsync.exe /logon

  O4 - HKLM\..\Run: C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

  O4 - HKLM\..\Run: “C:\Program Files\Avira\AntiVir Desktop\avgnt.exe” /min

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: “C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe” -nosplash -minimized

  O4 - HKCU\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

  O4 - HKUS\S-1-5-19\..\Run: C:\Recycle.Bin\Recycle.Bin.exe (User ‘Lokale service’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - Startup: Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe

  O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

  O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} (BitDefender QuickScan Control) - http://quickscan.bitdefender.com/qsax/qsax.cab

  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1237553506019

  O16 - DPF: {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} (RealPlayer G2 Control) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ng.local

  O17 - HKLM\Software\..\Telephony: DomainName = ng.local

  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ng.local

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

  O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe

  O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

  O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  O23 - Service: eBeam Device Service - Luidia, Inc. - C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe

  O23 - Service: Google Updateservice (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe (file missing)

  O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  O23 - Service: vseamps - Unknown owner - C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe (file missing)

  O23 - Service: vsedsps - Unknown owner - C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe (file missing)

  O23 - Service: vseqrts - Unknown owner - C:\Program Files\Common Files\Authentium\AntiVirus5\vseqrts.exe (file missing)

  –

  End of file - 9041 bytes

  Rapporteren
• 

  Ben

  28-08-2011 21:12

  Hallo Pieter,

  Schakel Spybot's TeaTimer even uit omdat deze de fix in de weg kan zitten:

  - Start Spybot

  - Ga naar Mode > selecteer Advanced Mode

  - Ga naar Tools en klik op het Resident-icoon in de lijst

  - Haal het vinkje weg bij Resident TeaTimer en klik OK

  - Herstart de computer

  Als de computer schoon is, kun je TeaTimer weer aan zetten

  Start HijackThis, klik op scan en vink de volgende regels aan;

  R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

  O23 - Service: vseamps - Unknown owner - C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe (file missing)

  O23 - Service: vsedsps - Unknown owner - C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe (file missing)

  O23 - Service: vseqrts - Unknown owner - C:\Program Files\Common Files\Authentium\AntiVirus5\vseqrts.exe (file missing)

  Sluit alle open vensters(behalve HijackThis), klik daarna op Fix checked en bevestig het door in het volgende scherm op Ja te klikken

  Start pc opnieuw op en plaats een nieuw Hijack this logje en vertel hoe het met je probleem staat?

  Ben

  http://2.bp.blogspot.com/_NAn8-ZItaHE/Scq3w6FaicI/AAAAAAAACVY/QqPkGy7EU7U/s320/school69.gif

  Rapporteren
• 

  Pieter82

  28-08-2011 21:46

  Verandering: het typen op Internet gaat nu goed.

  Maar de rest is nog steeds traag : openen website, opstarten, zelfs het scrollen.

  Nieuwe log:

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 21:44:32, on 28-8-2011

  Platform: Windows XP SP3 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\Avira\AntiVir Desktop\sched.exe

  C:\WINDOWS\system32\agrsmsvc.exe

  C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe

  C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

  C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

  C:\Program Files\Java\jre6\bin\jqs.exe

  C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe

  C:\WINDOWS\system32\svchost.exe

  C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe

  C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceUI.exe

  C:\Program Files\Microsoft Application Virtualization Client\sftdcc.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\system32\igfxtray.exe

  C:\WINDOWS\system32\hkcmd.exe

  C:\WINDOWS\system32\igfxpers.exe

  C:\WINDOWS\system32\igfxsrvc.exe

  C:\Program Files\Analog Devices\Core\smax4pnp.exe

  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

  C:\Program Files\Java\jre6\bin\jusched.exe

  C:\WINDOWS\system32\TDxVGAUTIL.EXE

  C:\WINDOWS\system32\RunDll32.exe

  C:\Program Files\QuickTime\qttask.exe

  C:\Program Files\Common Files\Real\Update_OB\realsched.exe

  C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\WINDOWS\system32\wbem\wmiapsrv.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://nl.woofi.info

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,“C:\Program Files\Microsoft Application Virtualization Client\sftdcc.exe”,

  O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

  O4 - HKLM\..\Run: C:\WINDOWS\system32\igfxtray.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\hkcmd.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\igfxpers.exe

  O4 - HKLM\..\Run: C:\Program Files\Analog Devices\Core\smax4pnp.exe

  O4 - HKLM\..\Run: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft Application Virtualization Client\SFTTray.exe” /autostart

  O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

  O4 - HKLM\..\Run: C:\WINDOWS\system32\TDxVGAUTIL.EXE

  O4 - HKLM\..\Run: RunDll32 cmcnfgu.cpl,CMICtrlWnd

  O4 - HKLM\..\Run: %SystemRoot%\system32\mobsync.exe /logon

  O4 - HKLM\..\Run: C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

  O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

  O4 - HKLM\..\Run: “C:\Program Files\Avira\AntiVir Desktop\avgnt.exe” /min

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: “C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe” -nosplash -minimized

  O4 - HKUS\S-1-5-19\..\Run: C:\Recycle.Bin\Recycle.Bin.exe (User ‘Lokale service’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - Startup: Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe

  O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

  O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} (BitDefender QuickScan Control) - http://quickscan.bitdefender.com/qsax/qsax.cab

  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1237553506019

  O16 - DPF: {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} (RealPlayer G2 Control) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ng.local

  O17 - HKLM\Software\..\Telephony: DomainName = ng.local

  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ng.local

  O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

  O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

  O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe

  O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

  O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

  O23 - Service: eBeam Device Service - Luidia, Inc. - C:\Program Files\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe

  O23 - Service: Google Updateservice (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe (file missing)

  O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

  –

  End of file - 8272 bytes

  Rapporteren
• 

  fazantje

  28-08-2011 21:51

  Hoi Pieter,

  Komen die 017 regels jou bekend voor:

  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ng.local

  O17 - HKLM\Software\..\Telephony: DomainName = ng.local

  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ng.local

  Als ik zoek, kom in verre landen uit.

  Graag even antwoordt hier op.

  Groetjes Huib;)

  

  Rapporteren
• 

  Pieter82

  28-08-2011 22:21

  Ja komen me bekend voor: ng.local is netwerkomgeving van mijn werkgever.

  Rapporteren
• 

  fazantje

  28-08-2011 22:49

  Hoi Pieter,

  Bedankt voor jou antwoord(tu)

  Ben zal je weer verder helpen, want hij is lerende voor loglezen.

  Ik kijk over zijn schouder mee.

  Groetjes Huib;)

  

  Rapporteren