Wel/geen internet

Sjmur · 12 september 2010

op 2 van de 3 accounts op de computer doet sinds een tijdje internet het niet. Vanalles al geprobeerd maar internet beperkt zich nog steeds maar tot die ene account.

Kunnen jullie aan deze HiJackThis log zien of er dingen niet kloppen?

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 11:04:53, on 12-9-2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

C:\Program Files\Eset\nod32kui.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\System32\regsvr32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

C:\WINDOWS\system32\jpwnw64s.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\kcntqkdh.exe

C:\Program Files\Windows Live\Toolbar\wltuser.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\System32\dllhost.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.home.nl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer aangeboden door @Home

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: (no name) - {08A8068E-53D1-42B2-B197-6D568843721F} - :C:\WINDOWS\system32\rqRlJcBQ.dll (file missing)

O2 - BHO: targettedbanner.biz browser enhancer - {16B435F6-B6CE-4F24-A568-944B27ED919C} - :C:\WINDOWS\system32\atgban.dll (file missing)

O2 - BHO: hotrevenue browser enhancer - {4228AAB7-CE8F-C451-C5D7-ACFA1C240793} - C:\WINDOWS\system32\alhnqpuzgug.dll

O2 - BHO: (no name) - {676DC8C6-027D-73FC-0460-2E00B9B48EBB} - :C:\WINDOWS\system32\pnctkgcn.dll (file missing)

O2 - BHO: OIN Analytics - {6B221E01-F517-4959-8C41-81948E7F2F17} - :C:\Program Files\OINAnalytics\OINAnalytics2.dll (file missing)

O2 - BHO: (no name) - {6DDACD11-5EAE-7B2A-DF48-2CC0042E8DE8} - :C:\WINDOWS\system32\ldgoy.dll (file missing)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - :C:\Program Files\Java\jre6\bin\ssv.dll (file missing)

O2 - BHO: SmartAds browser enhancer dpwpcxdp - {822BC761-AA46-48AE-BCE0-2EC963072919} - C:\WINDOWS\system32\dpwpcxdp.dll

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll

O2 - BHO: (no name) - {B5B6CE0B-C1C2-426A-99BE-4EB4624B4AAF} - :C:\WINDOWS\system32\avifil3.dll (file missing)

O2 - BHO: {20705740-265e-224b-59f4-c8b060ae33cc} - {cc33ea06-0b8c-4f95-b422-e56204750702} - :C:\WINDOWS\system32\buhkcbou.dll (file missing)

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: Softonic VLC EN Toolbar - {e6570cd8-9978-4621-b1f9-6a62436f0466} - C:\Program Files\Softonic_VLC_EN\tbSof0.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - :C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (file missing)

O2 - BHO: (no name) - {EAD6D2B2-6C64-4EEF-87EA-FDEBA697B421} - :C:\WINDOWS\system32\fccbXQjg.dll (file missing)

O3 - Toolbar: Softonic VLC EN Toolbar - {e6570cd8-9978-4621-b1f9-6a62436f0466} - C:\Program Files\Softonic_VLC_EN\tbSof0.dll

O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [ATIPTA] :C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [NeroFilterCheck] :C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [soundMan] :SOUNDMAN.EXE

O4 - HKLM\..\Run: [Protect] SHVRTF.EXE

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

O4 - HKLM\..\Run: [HP Software Update] :C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [HP Component Manager] :"C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [DeviceDiscovery] :C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A

O4 - HKLM\..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe /WAITSERVICE

O4 - HKLM\..\Run: [{67-72-2F-FC-DW}] :C:\WINDOWS\system32\jpwnw64s.exe DWram

O4 - HKLM\..\Run: [LSA Shellu] :C:\Documents and Settings\Idi van Sambeek\lsass.exe

O4 - HKLM\..\Run: [bm(1)] :"C:\Program Files\Common Files\AntiVirusScherm\bm.exe" dm=http://antivirusscherm.com ad=http://antivirusscherm.com sd=http://arettich.antivirusscherm.com

O4 - HKLM\..\Run: [b0967253] :rundll32.exe "C:\WINDOWS\system32\ksbhjalc.dll",b

O4 - HKLM\..\Run: [CaretakerNotifier] :C:\Program Files\SurfRight\Caretaker\Notifier.exe

O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\kcntqkdh.exe DWram

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [kjjjwcdd] C:\Documents and Settings\Idi van Sambeek\Local Settings\Application Data\qxnqtuyni\giaimtqtssd.exe

O4 - HKLM\..\Run: [bMb3a541cf] Rundll32.exe "C:\WINDOWS\system32\ucrbeeyg.dll",s

O4 - HKLM\..\Run: [rwwsqyvadsklf] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\alhnqpuzgug.dll"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q

O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe

O4 - HKCU\..\Run: [trustreal] C:\DOCUME~1\ROBVAN~1\APPLIC~1\THISMA~1\16ViewCdrom.exe

O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe

O4 - HKCU\..\Policies\Explorer\Run: [{B09672FC-0BB6-1043-0623-05030920001f}] "C:\Program Files\Common Files\{B09672FC-0BB6-1043-0623-05030920001f}\Update.exe" mc-110-12-0000904

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')

O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\kcntqkdh.exe

O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\jpwnw64s.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: ~Disabled

O8 - Extra context menu item: Converteren naar Adobe PDF - res://D:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Converteren naar bestaand PDF-bestand - res://D:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Geselecteerde koppelingen converteren naar Adobe PDF - res://D:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Geselecteerde koppelingen converteren naar bestaand PDF-bestand - res://D:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

O8 - Extra context menu item: Koppelingdoel converteren naar Adobe PDF - res://D:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Koppelingdoel converteren naar bestaand PDF-bestand - res://D:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Selectie converteren naar Adobe PDF - res://D:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Selectie converteren naar bestaand PDF-bestand - res://D:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://start.home.nl/

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab

O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab

O16 - DPF: {1A26F07F-0D60-4835-91CF-1E1766A0EC56} - http://scanner2.malware-scan.com/setup/webinst.cab

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab30149.cab

O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://mirriej88.spaces.msn.com//PhotoUpload/MsnPUpld.cab

O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab

O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://62.100.53.122/activex/AxisCamControl.cab

O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (ZPA_HRTZ Object) - http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab40641.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab

O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/6c5b0a1ae398e3/player.virtools.com/downloads/player/Install2.5/Installer.exe

O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game11.zylomgames.com/activex/zylomloader.cab

O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://antu.popcap.com/games/popcaploader_v6.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab

O20 - Winlogon Notify: rqRlJcBQ - rqRlJcBQ.dll (file missing)

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Adobe Version Cue CS2 - Unknown owner - D:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe (file missing)

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Google Updateservice (gupdate1ca82f7f380806) (gupdate1ca82f7f380806) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 16020 bytes

Alvast bedankt!

kweezie wabbit · 12 september 2010

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc stop "Adobe Version Cue CS2"

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc delete "Adobe Version Cue CS2"

Druk op Enter.

Start Hijackthis op. Ben je gebruiker van Vista of windows 7 kies dan voor “Run as administrator" of "Uitvoeren als administrator".

Selecteer “Do a system scan only”. Selecteer alleen de items die hieronder zijn genoemd:

O2 - BHO: (no name) - {08A8068E-53D1-42B2-B197-6D568843721F} - :C:\WINDOWS\system32\rqRlJcBQ.dll (file missing)

O2 - BHO: targettedbanner.biz browser enhancer - {16B435F6-B6CE-4F24-A568-944B27ED919C} - :C:\WINDOWS\system32\atgban.dll (file missing)

O2 - BHO: hotrevenue browser enhancer - {4228AAB7-CE8F-C451-C5D7-ACFA1C240793} - C:\WINDOWS\system32\alhnqpuzgug.dll

O2 - BHO: (no name) - {676DC8C6-027D-73FC-0460-2E00B9B48EBB} - :C:\WINDOWS\system32\pnctkgcn.dll (file missing)

O2 - BHO: OIN Analytics - {6B221E01-F517-4959-8C41-81948E7F2F17} - :C:\Program Files\OINAnalytics\OINAnalytics2.dll (file missing)

O2 - BHO: (no name) - {6DDACD11-5EAE-7B2A-DF48-2CC0042E8DE8} - :C:\WINDOWS\system32\ldgoy.dll (file missing)

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - :C:\Program Files\Java\jre6\bin\ssv.dll (file missing)

O2 - BHO: SmartAds browser enhancer dpwpcxdp - {822BC761-AA46-48AE-BCE0-2EC963072919} - C:\WINDOWS\system32\dpwpcxdp.dll

O2 - BHO: (no name) - {B5B6CE0B-C1C2-426A-99BE-4EB4624B4AAF} - :C:\WINDOWS\system32\avifil3.dll (file missing)

O2 - BHO: {20705740-265e-224b-59f4-c8b060ae33cc} - {cc33ea06-0b8c-4f95-b422-e56204750702} - :C:\WINDOWS\system32\buhkcbou.dll (file missing)

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - :C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (file missing)

O2 - BHO: (no name) - {EAD6D2B2-6C64-4EEF-87EA-FDEBA697B421} - :C:\WINDOWS\system32\fccbXQjg.dll (file missing)

O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A

O4 - HKLM\..\Run: [{67-72-2F-FC-DW}] :C:\WINDOWS\system32\jpwnw64s.exe DWram

O4 - HKLM\..\Run: [b0967253] :rundll32.exe "C:\WINDOWS\system32\ksbhjalc.dll",b

O4 - HKLM\..\Run: [kjjjwcdd] C:\Documents and Settings\Idi van Sambeek\Local Settings\Application Data\qxnqtuyni\giaimtqtssd.exe

O4 - HKLM\..\Run: [bMb3a541cf] Rundll32.exe "C:\WINDOWS\system32\ucrbeeyg.dll",s

O4 - HKLM\..\Run: [rwwsqyvadsklf] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\alhnqpuzgug.dll"

O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe

O4 - HKCU\..\Policies\Explorer\Run: [{B09672FC-0BB6-1043-0623-05030920001f}] "C:\Program Files\Common Files\{B09672FC-0BB6-1043-0623-05030920001f}\Update.exe" mc-110-12-0000904

O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\kcntqkdh.exe

O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\jpwnw64s.exe

O4 - Global Startup: ~Disabled

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

Klik op 'Fix checked' om de items te verwijderen.

Verwijder volgende programma Ask.com via Software (indien aanwezig) of verwijder anders volgende vetgedrukte map : C:\Program Files\Ask.com

Download MBAM (Malwarebytes Anti-Malware)

Dubbelklik op mbam-setup.exe om het programma te installeren.

Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Start Malwarebytes' Anti-Malware, Klik daarna op "Voltooien".

Indien een update gevonden werd, zal die gedownload en geïnstalleerd worden.

Wanneer het programma volledig up to date is, selecteer dan in het tabblad Scanner : "Snelle Scan", daarna klik op Scan.

Het scannen kan een tijdje duren, dus wees geduldig.

Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.

Zorg ervoor dat daar alles aangevinkt is, daarna klik op: Verwijder geselecteerde.

Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie verder).

Indien er de rootkit (TDSS) aanwezig is, zal MBAM vragen te herstarten. Doe dit dan ook.

MBAM zal na de herstart opnieuw scannen en de rootkit verwijderen.

Het log wordt automatisch bewaard door MBAM en kan je terugvinden door op de "Logs" tab te klikken in het programma.

Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken. Daarna zal het vragen om de computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.

Plak de inhoud van het logje in je volgende bericht, samen met een nieuw HijackThis log.

Best ook XP SP3 installeren.

12 september 2010 aangepast door kweezie wabbit

Sjmur · 12 september 2010

MalwareBytes logje (nieuwe HiJack volgt zodra ik de computer opnieuw opgestart heb)

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Databaseversie: 4599

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702

12-9-2010 14:02:07

mbam-log-2010-09-12 (14-02-07).txt

Scantype: Snelle scan

Objecten gescand: 270633

Verstreken tijd: 37 minuut/minuten, 59 seconde(n)

Geheugenprocessen geïnfecteerd: 0

Geheugenmodulen geïnfecteerd: 1

Registersleutels geïnfecteerd: 52

Registerwaarden geïnfecteerd: 8

Registerdata geïnfecteerd: 0

Mappen geïnfecteerd: 19

Bestanden geïnfecteerd: 89

Geheugenprocessen geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geïnfecteerd:

C:\WINDOWS\system32\dpwpcxdp.dll (Adware.BHO) -> Delete on reboot.

Registersleutels geïnfecteerd:

HKEY_CLASSES_ROOT\oincs.oinanalytics (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\oincs.oinanalytics.1 (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\quantic.plug (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\quantic.plug.1 (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\testcpv6.bho (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\testcpv6.bho.1 (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{1601d447-7424-4866-8dcc-acf98a2a41e1} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{1e404d48-670a-4085-a6a0-d195793ddd33} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{9f593aac-ca4c-4a41-a7ff-a00812192d61} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{ceb9c60d-f0ad-4b73-a3ab-4fc822e38d66} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{cfcec0a5-e1da-4049-bdb6-8b461e7e1bf3} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\{a9722a0d-365f-47d2-b70b-37d046316d99} (Adware.EZlife) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\{8d71eeb8-a1a7-4733-8fa2-1cac015c967d} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\{f7fa36a4-3177-4b57-b9c1-e9c5b2e0d3a9} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{1e404d48-670a-4085-a6a0-d195793ddd33} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{ceb9c60d-f0ad-4b73-a3ab-4fc822e38d66} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{2386c4d3-e53a-4fd6-952b-89cbca337c83} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{749ec66f-a838-4b38-b8e5-e65d905fff74} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{c3c0ec2c-2c1c-495c-9ad0-1f0ef833d7b5} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{16b435f6-b6ce-4f24-a568-944b27ed919c} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6b221e01-f517-4959-8c41-81948e7f2f17} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1a26f07f-0d60-4835-91cf-1e1766a0ec56} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\oinanalytics (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\outerinfo (Adware.PurityScan) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\adproclient.adhlpr (Adware.SmartAds) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\adproclient.adhlpr.1 (Adware.SmartAds) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\OINAnalytics.dll (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\Sidebar.dll (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\testCPV6.dll (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\BitDownload (Trojan.Swizzor) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Quantic (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\jkwslist (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.

Registerwaarden geïnfecteerd:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\exploreupdsched (Trojan.AdSpy) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\adp (Rogue.Multiple) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsa shellu (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Products\prodname (Rogue.PCVirusless) -> Quarantined and deleted successfully.

Registerdata geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:

C:\Documents and Settings\All Users\Application Data\SalesMon (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\SalesMon\Data (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\Rob van Sambeek\Application Data\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.

C:\Documents and Settings\Rob van Sambeek\Application Data\Smart-Ads-Solutions\SmartAds (Adware.SmartAds) -> Quarantined and deleted successfully.

C:\Documents and Settings\Johan van Sambeek\Application Data\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.

C:\Documents and Settings\Johan van Sambeek\Application Data\Smart-Ads-Solutions\SmartAds (Adware.SmartAds) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mirjam van Sambeek\Application Data\WinTouch (Adware.WinPop) -> Quarantined and deleted successfully.

C:\Program Files\CPV (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Program Files\nvcoi (Trojan.Stars) -> Quarantined and deleted successfully.

C:\Program Files\OINAnalytics (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Outerinfo (Adware.PurityScan) -> Quarantined and deleted successfully.

C:\Program Files\Outerinfo\FF (Adware.PurityScan) -> Quarantined and deleted successfully.

C:\Program Files\Outerinfo\FF\components (Adware.PurityScan) -> Quarantined and deleted successfully.

C:\Program Files\Temporary (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Menu Start\Programma's\AntiSpywareMaster (Rogue.AntiSpywareMaster) -> Quarantined and deleted successfully.

C:\Documents and Settings\Johan van Sambeek\Menu Start\Programma's\MalwareAlarm (Rogue.Malware.Alarm) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mirjam van Sambeek\Menu Start\Programma's\Outerinfo (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\bharebio18 (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\Fonts\' (Worm.Archive) -> Files: 10458 -> Quarantined and deleted successfully.

Bestanden geïnfecteerd:

C:\WINDOWS\system32\dpwpcxdp.dll (Adware.BHO) -> Delete on reboot.

C:\WINDOWS\system32\kcntqkdh.exe (Trojan.AdSpy) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-5-21-4290336544-1750476147-4027534363-1007\Dc250.exe (Trojan.StartPage) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\pacxjnnv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\eu1.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\l61.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ldgoy.dll (Adware.PurityScan) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe (Trojan.BHO) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\myss_sb_uninstall.exe (Trojan.BHO) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\rqRlJcBQ.dll__DELETE_ON_REBOOT (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\rwwnw64d.exe (Adware.ZenoSearch) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\sa27d.exe (Adware.EZlife) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\sa3d.exe (Adware.EZlife) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\u61.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ucrbeeyg.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\gside.exe (Trojan.BHO) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\jpwnw64s.exe (Adware.ZenoSearch) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\buhkcbou.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\byXpOEww.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\wvUmjkIa.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ati2cqa.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\qswmcdfx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\go28d.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\go32d.exe (Adware.BHO) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\yvocgped.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kcntqkdj.exe (Trojan.AdSpy) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kcntqkdm.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kcntqkdn.exe (Adware.ZenoSearch) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\{c5dde060-2b85-cce8-2a5e-16737c31aa2e}.dll-uninst.exe (Trojan.BHO) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ddcCRJba.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Johan van Sambeek\Local Settings\Temp\s33c (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mirjam van Sambeek\Local Settings\Temp\Antiphishing Component Update 1 (Trojan.BHO) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mirjam van Sambeek\Local Settings\Temp\NDR3B10.tmp (Adware.PurityScan) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mirjam van Sambeek\Local Settings\Temp\tmpAE45.tmp (Trojan.BHO) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mirjam van Sambeek\Local Settings\Temp\tmpFAE.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Rob van Sambeek\Local Settings\Temp\BrowserHotfix10.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Rob van Sambeek\Local Settings\Temp\BrowserHotfix2.exe (Trojan.BHO) -> Quarantined and deleted successfully.

C:\Documents and Settings\Rob van Sambeek\Local Settings\Temp\COM Security Update Level 10 (Adware.BHO) -> Quarantined and deleted successfully.

C:\Documents and Settings\Rob van Sambeek\Local Settings\Temp\COM Security Update Level 9 (Adware.BHO) -> Quarantined and deleted successfully.

C:\Documents and Settings\Johan van Sambeek\Local Settings\Temporary Internet Files\Content.IE5\NXCT6CNP\setup[1].exe (Trojan.BHO) -> Quarantined and deleted successfully.

C:\Documents and Settings\Johan van Sambeek\Local Settings\Temporary Internet Files\Content.IE5\SVA1N9ZZ\get_file[1].php (Adware.BHO) -> Quarantined and deleted successfully.

C:\Documents and Settings\Rob van Sambeek\Local Settings\Temporary Internet Files\Content.IE5\LAEX0ADU\setup[1].exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mirjam van Sambeek\Application Data\WinTouch\wintouch.cfg (Adware.WinPop) -> Quarantined and deleted successfully.

C:\Program Files\nvcoi\mst.stt (Trojan.Stars) -> Quarantined and deleted successfully.

C:\Program Files\OINAnalytics\OINAnalytics2.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\OINAnalytics\Uninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Outerinfo\OiUninstaller.exe (Adware.PurityScan) -> Quarantined and deleted successfully.

C:\Program Files\Outerinfo\outerinfo.ico (Adware.PurityScan) -> Quarantined and deleted successfully.

C:\Program Files\Outerinfo\Terms.rtf (Adware.PurityScan) -> Quarantined and deleted successfully.

C:\Program Files\Outerinfo\FF\chrome.manifest (Adware.PurityScan) -> Quarantined and deleted successfully.

C:\Program Files\Outerinfo\FF\install.rdf (Adware.PurityScan) -> Quarantined and deleted successfully.

C:\Program Files\Outerinfo\FF\components\FF.dll (Adware.PurityScan) -> Quarantined and deleted successfully.

C:\Program Files\Outerinfo\FF\components\OuterinfoAds.xpt (Adware.PurityScan) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Menu Start\Programma's\AntiSpywareMaster\AntiSpywareMaster.lnk (Rogue.AntiSpywareMaster) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Menu Start\Programma's\AntiSpywareMaster\Uninstall AntiSpywareMaster.lnk (Rogue.AntiSpywareMaster) -> Quarantined and deleted successfully.

C:\Documents and Settings\Johan van Sambeek\Menu Start\Programma's\MalwareAlarm\MalwareAlarm.lnk (Rogue.Malware.Alarm) -> Quarantined and deleted successfully.

C:\Documents and Settings\Johan van Sambeek\Menu Start\Programma's\MalwareAlarm\Uninstall.lnk (Rogue.Malware.Alarm) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mirjam van Sambeek\Menu Start\Programma's\Outerinfo\Terms.lnk (Malware.Trace) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mirjam van Sambeek\Menu Start\Programma's\Outerinfo\Uninstall.lnk (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\bharebio18\bharebio182328.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Johan van Sambeek\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareMaster.lnk (Rogue.AntiSpyware) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mirjam van Sambeek\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareMaster.lnk (Rogue.AntiSpyware) -> Quarantined and deleted successfully.

C:\Documents and Settings\Johan van Sambeek\Menu Start\Programma's\Opstarten\Deewoo.lnk (Malware.Links) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mirjam van Sambeek\Menu Start\Programma's\Opstarten\Deewoo.lnk (Malware.Links) -> Quarantined and deleted successfully.

C:\Documents and Settings\Johan van Sambeek\Menu Start\Programma's\Opstarten\DW_Start.lnk (Malware.Links) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mirjam van Sambeek\Menu Start\Programma's\Opstarten\DW_Start.lnk (Malware.Links) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\byXNDsSI.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\cbswpbrk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\cbXPhfEX.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ClickToFindandFixErrorsIntl.ico (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ClickToFindandFixErrors_Intl.ico (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ClickToFindandFixErrors_RON.ico (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\efccdCSJ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\geBspnMC.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\jkkHBSIx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\jkkLbBUK.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\msnav32.ax (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\pac.txt (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\tuvUKcAs.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\tuvWnoNG.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\urqQgFXo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\winpfz33.sys (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\xxyxVlMd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\zxdnt3d.cfg (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\zxdnt3d.cfg. (Adware.ZenoSearch) -> Quarantined and deleted successfully.

C:\WINDOWS\BMb3a541cf.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\BMb3a541cf.xml (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

kweezie wabbit · 12 september 2010

Dat is al een heleboel rotzooi opgeruimd.

Je moet wel de pc herstarten om alle besmettingen te verwijderen.

Sjmur · 12 september 2010

Dat is inderdaad al een heleboel rotzooi opgeruimd

daarvoor alvast heel erg bedankt!

nieuwe HiJack log:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 14:15:57, on 12-9-2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\SHVRTF.EXE