[OPGELOST] mail in offline bericht gekregen

darkwarriors · 3 september 2009

Hallo:-)

Ik heb van mijn vriend(er zit een virus in zijn computer<-hoogst waarschijnlijk) een offline bericht gekregen op msn en er stond op

'Hey je moet echt eens kijken naar mijn website'

En dan kreeg ik de link.Ik klikte erop.

Maar de volgende keer dat ik opstart had ik geen internet.

Dus ik had aldoor dat er een spyware was...

Ik heb mijn computer met 'avast!' gescand...

Hij had er een paar gevonden met trojans en VBS malware gen.

Het nadeel is dat avast van 15/08 is dus nog niet geupdate omdat ik niet op de computer zat (alleen die dag dus).

avast! verwijderde de virusen,maar ze komen altijd terug in dezelfde file ookal is het gedelete...(systeemherstel staat uit)

Zelfs met 'beveiligde modus met netwerkmogelijkheden' kreeg ik geen internet nochtans had ik 54mbs(zeer goed).

Ik hoop dat jullie hier iets op vinden want ik ben nu echt teneinde raad...

En dan is 'avast!' bijna verlopen...(het zorgt ervoor dat nu de computer niet freest)<-nog 2weken voor verloop:bawling:

reageer aub hier zosnel mogelijk op

dank u

kape · 3 september 2009

Download HiJackThis

Dubbelklik op HJTInstall.exe

Hijackthis wordt nu op je PC geïnstalleerd, een snelkoppeling wordt op je bureaublad geplaatst. Klik op "Do a systemscan and save a logfile". en hang dit logje aan je volgende bericht.

NB. Ben je een gebruiker van Windows Vista dan moet je eerst rechtsklikken op HijackThis.exe en dan kiezen voor "Run as Administrator".

darkwarriors · 4 september 2009

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:38:20, on 4/09/2009

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\htpatch.exe

C:\Program Files\Common Files\Logitech\QCDriver2\LVCOMS.EXE

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\Program Files\AVPersonal\AVGNT.EXE

C:\Program Files\ASUS\WLAN Card Utilities\Center.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\INCAInternet\nProtect Security Platform 2007\nspmain.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AVPersonal\AVWUPSRV.EXE

C:\WINDOWS\System32\INCAinternet\nProtect Security Platform 2007\nspsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\HPZipm12.exe

C:\WINDOWS\System32\PnkBstrA.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\WINDOWS\system32\INCAInternet\nProtect Security Platform 2007\nspupsvc.exe

C:\WINDOWS\System32\conime.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)

R3 - URLSearchHook: ToggleDU Toolbar - {3ad798d0-4642-4c55-bc14-cfe7dd19e0d1} - C:\Program Files\ToggleDU\tbTog1.dll

F2 - REGSystem.ini: UserInit=C:\WINDOWS\System32\Userinit.exe

O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: ToggleDU Toolbar - {3ad798d0-4642-4c55-bc14-cfe7dd19e0d1} - C:\Program Files\ToggleDU\tbTog1.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: ToggleDU Toolbar - {3ad798d0-4642-4c55-bc14-cfe7dd19e0d1} - C:\Program Files\ToggleDU\tbTog1.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [mouseElf] C:\Program Files\Genius NetScroll + Series Mouse\mouseElf.exe

O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver2\LVCOMS.EXE

O4 - HKLM\..\Run: [assistse] "C:\PROGRA~1\3721\assistse.exe"

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [iMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min

O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\Center.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [LXDBCATS] rundll32 C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\LXDBtime.dll,_RunDLLEntry@16

O4 - HKLM\..\Run: [nProtect Security Platform 2007] C:\Program Files\INCAInternet\nProtect Security Platform 2007\nspmain.exe -tray

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKUS\S-1-5-18\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java ??? - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: ?à¨?¨￠? - {4B87EE01-82ED-4030-A372-B3BEF4829ED5} - ±ÌÁÄ--¿ÉÊÓÓïÒôÁÄÌì (file missing)

O9 - Extra 'Tools' menuitem: ¨￠?¨?¨? - {4B87EE01-82ED-4030-A372-B3BEF4829ED5} - ±ÌÁÄ--¿ÉÊÓÓïÒôÁÄÌì (file missing)

O9 - Extra button: 3721CMail - {5D73EE86-05F1-49ed-B850-E423120EC329} - ÖÐÎÄÉÏÍø (file missing)

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O14 - IERESET.INF: START_PAGE_URL=http://www.telenet.be

O18 - Protocol: bw+0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw+0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: bwg0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwg0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0s - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: offline-8876480 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: lxdb_device - - C:\WINDOWS\System32\lxdbcoms.exe

O23 - Service: nProtect Security Platform 2007 Service (NSPService) - INCA Internet Co., Ltd. - C:\WINDOWS\System32\INCAinternet\nProtect Security Platform 2007\nspsvc.exe

O23 - Service: nProtect Security Platform 2007 Update Service (NSPUpdateService) - INCAInternet Co.,Ltd - C:\WINDOWS\system32\INCAInternet\nProtect Security Platform 2007\nspupsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--

End of file - 20399 bytes

ik heb een usb gebruikt om hijackthis te gebruiken,maar kan de usb geinfecteerd geraken?Want mijn laptop moest het logje zo over zenden...

kape · 5 september 2009

Ga naar Start - Uitvoeren en tik in: sc stop NSPService

Druk op Enter.

Ga naar Start - Uitvoeren en tik in: sc delete NSPService

Druk op Enter.

Ga naar Start - Uitvoeren en tik in: sc stop NSPUpdateService

Druk op Enter.

Ga naar Start - Uitvoeren en tik in: sc delete NSPUpdateService

Druk op Enter.

Start Hijackthis op. Ben je gebruiker van Vista kies dan voor “Run as administrator" of "Uitvoeren als administrator". Selecteer “Do a system scan only”. Selecteer alleen de items die hieronder zijn genoemd:

R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)

R3 - URLSearchHook: ToggleDU Toolbar - {3ad798d0-4642-4c55-bc14-cfe7dd19e0d1} - C:\Program Files\ToggleDU\tbTog1.dll

O2 - BHO: ToggleDU Toolbar - {3ad798d0-4642-4c55-bc14-cfe7dd19e0d1} - C:\Program Files\ToggleDU\tbTog1.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O3 - Toolbar: ToggleDU Toolbar - {3ad798d0-4642-4c55-bc14-cfe7dd19e0d1} - C:\Program Files\ToggleDU\tbTog1.dll

O4 - HKLM\..\Run: [assistse] "C:\PROGRA~1\3721\assistse.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [nProtect Security Platform 2007] C:\Program Files\INCAInternet\nProtect Security Platform 2007\nspmain.exe -tray

O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm

O9 - Extra button: ?à¨?¨￠? - {4B87EE01-82ED-4030-A372-B3BEF4829ED5} - ±ÌÁÄ--¿ÉÊÓÓïÒôÁÄÌì (file missing)

O9 - Extra 'Tools' menuitem: ¨￠?¨?¨? - {4B87EE01-82ED-4030-A372-B3BEF4829ED5} - ±ÌÁÄ--¿ÉÊÓÓïÒôÁÄÌì (file missing)

O9 - Extra button: 3721CMail - {5D73EE86-05F1-49ed-B850-E423120EC329} - ÖÐÎÄÉÏÍø (file missing)

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

ALLE 018-LIJNEN van dit type : O18 - Protocol: bw+0 - {3F0FF204-F318-4F35-8192-70F8DD9E9F99} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

Klik op 'Fix checked' om de items te verwijderen.

Download MBAM (Malwarebytes' Anti-Malware).

Dubbelklik op mbam-setup.exe om het programma te installeren.

Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Start Malwarebytes' Anti-Malware, Klik daarna op "Voltooien".

Indien een update gevonden werd, zal die gedownload en geïnstalleerd worden.

Wanneer het programma volledig up to date is, selecteer dan in het tabblad Scanner : "Snelle Scan", daarna klik op Scan.

Het scannen kan een tijdje duren, dus wees geduldig.

Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.

Zorg ervoor dat daar alles aangevinkt is, daarna klik op: Verwijder geselecteerde.

Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie verder). De log wordt automatisch bewaard door MBAM en kan je terugvinden door op de "Logs" tab te klikken in MBAM.

Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken. Daarna zal het vragen om de computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.

Plak de inhoud van het logje in je volgende bericht, samen met een nieuw HijackThis log.

darkwarriors · 6 september 2009

Malwarebytes' Anti-Malware 1.40

Database versie: 2551

Windows 5.1.2600 Service Pack 1

6/09/2009 16:22:08

mbam-log-2009-09-06 (16-22-08).txt

Scan type: Snelle Scan

Objecten gescand: 138667

Verstreken tijd: 17 minute(s), 56 second(s)

Geheugenprocessen geïnfecteerd: 0

Geheugenmodulen geïnfecteerd: 0

Registersleutels geïnfecteerd: 4

Registerwaarden geïnfecteerd: 0

Registerdata bestanden geïnfecteerd: 0

Mappen geïnfecteerd: 2

Bestanden geïnfecteerd: 38

Geheugenprocessen geïnfecteerd:

(Geen kwaadaardige items gevonden)

Geheugenmodulen geïnfecteerd:

(Geen kwaadaardige items gevonden)

Registersleutels geïnfecteerd:

HKEY_CLASSES_ROOT\coolbar.coolbarobj.1 (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Xstudio_Packet_Capture (Hijhack.LSP) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\3721 (Pup.BitSpirit) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\3721 (Pup.BitSpirit) -> Quarantined and deleted successfully.

Registerwaarden geïnfecteerd:

(Geen kwaadaardige items gevonden)

Registerdata bestanden geïnfecteerd:

(Geen kwaadaardige items gevonden)

Mappen geïnfecteerd:

C:\Program Files\3721 (Fake.Dropped.Malware) -> Delete on reboot.

C:\Program Files\3721\3721 (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

Bestanden geïnfecteerd:

C:\Program Files\3721\alliveex.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files\3721\autolive.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files\3721\autolive.ini (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files\3721\autolvsw.ini (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files\3721\cns01.dat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files\3721\cns03.dat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files\3721\CNSMIN.DAT (Fake.Dropped.Malware) -> Delete on reboot.

C:\Program Files\3721\helper.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files\3721\notifier.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files\3721\windex.dat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\Program Files\3721\winhex.dat (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

C:\8A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\8B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\8C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\8D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\8E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\8F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Lin Shu Chi Ying\Cookies\MM2048.DAT (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Lin Shu Chi Ying\Cookies\MM256.DAT (Trojan.Agent) -> Quarantined and deleted successfully.

C:\A0.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\A1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\A2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\A3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\A4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\A5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\A6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\A7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\A8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\A9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\AA.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\AB.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\AC.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\AD.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\AE.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\AF.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\Fonts\acrsecB.fon (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\Fonts\acrsecI.fon (Trojan.Agent) -> Quarantined and deleted successfully.

C:\31.tmp (Heuristics.Malware) -> Quarantined and deleted s

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:27:26, on 6/09/2009

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\htpatch.exe

C:\Program Files\Common Files\Logitech\QCDriver2\LVCOMS.EXE

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\Program Files\AVPersonal\AVGNT.EXE

C:\Program Files\AVPersonal\AVWUPSRV.EXE

C:\Program Files\ASUS\WLAN Card Utilities\Center.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\INCAInternet\nProtect Security Platform 2007\nspmain.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\System32\HPZipm12.exe

C:\WINDOWS\System32\PnkBstrA.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\WINDOWS\System32\conime.exe

C:\WINDOWS\System32\INCAinternet\nProtect Security Platform 2007\nspupsvc.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe