probleem met software

ikjoost · 14 augustus 2011

als ik program and features gedeelte , waar ik programma's die geinstaleerd en kan verwijderen en bekijken , open loopt windows vast en moet de explorer opnieuw gestart worden .

ik kan dus geen programma's die geinstaleerd staan bekijken en of verwijderen.

moet ik windows opnieuw instaleren of is er een andere oplossing

Dasle · 14 augustus 2011

We zullen eerst eens nagaan of malware of virussen de oorzaak zijn van je probleem.

1. Download HijackThis.

Klik bij "HijackThis Downloads" op "Installer".

Bestand HijackThis.msi opslaan. Daarna kiezen voor "uitvoeren".

Hijackthis wordt nu op je PC geïnstalleerd, een snelkoppeling wordt op je bureaublad geplaatst.

Als je geen netwerkverbinding meer hebt, kan je de download doen met een andere pc en het bestand met een usb stick overbrengen

Als je enkel nog in veilige modus kan werken, moet je de executable downloaden.

Sla deze op in een nieuwe map op de C schijf (bvb C:\hijackthis) en start hijackthis dan vanaf deze map.

De logjes kan je dan ook in die map terugvinden.

2. Klik op de snelkoppeling om HijackThis te starten

Klik ofwel op "Do a systemscan and save a logfile", ofwel eerst op "Scan" en dan op "Savelog".

Er opent een kladblokvenster, hou gelijktijdig de CTRL en A-toets ingedrukt, nu is alles geselecteerd. Hou gelijktijdig de CTRL en C-toets ingedrukt, nu is alles gekopieerd. Plak nu het HJT logje in je bericht door CTRL en V-toets.

Krijg je een melding ""For some reason your system denied writing to the Host file ....", klik dan gewoon door op de OK-toets.

Let op : Windows Vista & 7 gebruikers dienen HijackThis als “administrator” uit te voeren via rechtermuisknop “als administrator uitvoeren". Indien dit via de snelkoppeling niet lukt voer je HijackThis als administrator uit in de volgende map : C:\Program Files\Trend Micro\HiJackThis of C:\Program Files (x86)\Trend Micro\HiJackThis. (Bekijk hier de afbeelding ---> Bijlage 12634)

Dit (KLIK) filmpje kan je ook helpen om een hijackthis logje te plaatsen.

3. Na het plaatsen van je logje wordt dit door een expert (Kape of Kweezie Wabbit) nagekeken en begeleidt hij jou verder door het ganse proces.

ikjoost · 14 augustus 2011

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 20:04:55, on 14-8-2011

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal

Running processes:

C:\Windows\PixArt\Pac207\Monitor.exe

C:\Program Files (x86)\RocketDock\RocketDock.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Geinstaleerde Proggies C\poweriso\PWRISOVM.EXE

C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe

D:\Geinstaleerde Proggies D\VMware WorkStation v7\vmware-tray.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe

C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe

C:\Program Files (x86)\AVG\AVG10\avgtray.exe

C:\Geinstaleerde Proggies C\tightvnc remote desktop\TightVNC\tvnserver.exe

C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

C:\Users\joost\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

D:\Geinstaleerde Proggies D\Utorrent\uTorrent.exe

C:\Users\joost\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Java\jre6\bin\javaw.exe

C:\Users\joost\AppData\Local\Google\Chrome\Application\chrome.exe

D:\DropZone D\internet downloads\New folder\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Facemoods Search

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=bf&s={searchTerms}&f=4

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Search Result Optimizator - {D7BE8ED1-B138-48FD-BB22-9779A39130B1} - C:\Program Files (x86)\SaveTubeVideo.com\SaveTubeVideo\SearchBHO.dll

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: ShowBarObj Class - {2863E737-DD3F-4280-9AF8-E9E79C16F312} - C:\Program Files (x86)\SaveTubeVideo.com\SaveTubeVideo\MinBHO.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: facemoods Helper - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\bh\facemoods.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Search Result Optimizator - {D7BE8ED1-B138-48FD-BB22-9779A39130B1} - C:\Program Files (x86)\SaveTubeVideo.com\SaveTubeVideo\SearchBHO.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O2 - BHO: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.1\youtubedownloaderToolbarIE.dll

O3 - Toolbar: Save Tube Video - {F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} - C:\Program Files (x86)\SaveTubeVideo.com\SaveTubeVideo\SaveTubeVideo.dll

O3 - Toolbar: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.1\youtubedownloaderToolbarIE.dll

O3 - Toolbar: facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Geinstaleerde Proggies C\poweriso\PWRISOVM.EXE

O4 - HKLM\..\Run: [Gateway Photo Frame] C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe -A

O4 - HKLM\..\Run: [vmware-tray] "D:\Geinstaleerde Proggies D\VMware WorkStation v7\vmware-tray.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup

O4 - HKLM\..\Run: [{S8D8UIO1-VV7W-63J7-1RXT-34OHRYE0107Q}] C:\Windows\system32\rpcnetp\rpcnetp.exe

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [searchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"

O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe

O4 - HKLM\..\Run: [facemoods] "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe" /md I

O4 - HKLM\..\Run: [tvncontrol] "C:\Geinstaleerde Proggies C\tightvnc remote desktop\TightVNC\tvnserver.exe" -controlservice -slave

O4 - HKCU\..\Run: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [{S8D8UIO1-VV7W-63J7-1RXT-34OHRYE0107Q}] C:\Users\joost\AppData\Roaming\rpcnetp\rpcnetp.exe

O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - Startup: Microsoft Office Outlook 2007.lnk = ?

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\joost\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: d:\geinstaleerde proggies d\vmware workstation v7\vsocklib.dll

O16 - DPF: {DE64E08D-8F19-4D75-A277-855E9DE74AA5} (cachecleaner Class) - https://vpn.visionwaves.com/forticachecleaner.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe

O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Geinstaleerde Proggies C\FTP server\FileZilla Server\FileZilla Server.exe

O23 - Service: FortiClient SSL VPN (FortiSslvpnDaemon) - Fortinet Inc. - C:\Windows\SysWOW64\FortiSSLVPNdaemon.exe

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

O23 - Service: TVersityMediaServer - Unknown owner - C:\Geinstaleerde Proggies C\TVersity\Media Server\MediaServer.exe

O23 - Service: TightVNC Server (tvnserver) - GlavSoft LLC. - C:\Geinstaleerde Proggies C\tightvnc remote desktop\TightVNC\tvnserver.exe

O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - D:\Geinstaleerde Proggies D\VMware WorkStation v7\vmware-ufad.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - D:\Geinstaleerde Proggies D\VMware WorkStation v7\vmware-authd.exe

O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe

O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe

O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 15775 bytes

Dasle · 14 augustus 2011

De experts zijn verwittigd, als ze online komen helpen zij je verder.

kape · 14 augustus 2011

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc stop "Application Updater"

Druk op Enter.

Ga naar Start – Uitvoeren/Zoekopdracht en tik in: sc delete "Application Updater"

Druk op Enter.

Start Hijackthis op. Selecteer “Scan”. Selecteer alleen de items die hieronder zijn genoemd:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Facemoods Search

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=bf&s={searchTerms}&f=4

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Search Result Optimizator - {D7BE8ED1-B138-48FD-BB22-9779A39130B1} - C:\Program Files (x86)\SaveTubeVideo.com\SaveTubeVideo\SearchBHO.dll

O2 - BHO: ShowBarObj Class - {2863E737-DD3F-4280-9AF8-E9E79C16F312} - C:\Program Files (x86)\SaveTubeVideo.com\SaveTubeVideo\MinBHO.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: facemoods Helper - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\bh\facemoods.dll

O2 - BHO: Search Result Optimizator - {D7BE8ED1-B138-48FD-BB22-9779A39130B1} - C:\Program Files (x86)\SaveTubeVideo.com\SaveTubeVideo\SearchBHO.dll

O3 - Toolbar: Save Tube Video - {F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} - C:\Program Files (x86)\SaveTubeVideo.com\SaveTubeVideo\SaveTubeVideo.dll

O3 - Toolbar: facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll

O4 - HKLM\..\Run: [{S8D8UIO1-VV7W-63J7-1RXT-34OHRYE0107Q}] C:\Windows\system32\rpcnetp\rpcnetp.exe

O4 - HKLM\..\Run: [searchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"

O4 - HKLM\..\Run: [facemoods] "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe" /md I

O4 - HKCU\..\Run: [{S8D8UIO1-VV7W-63J7-1RXT-34OHRYE0107Q}] C:\Users\joost\AppData\Roaming\rpcnetp\rpcnetp.exe

O4 - Startup: Microsoft Office Outlook 2007.lnk = ?

Klik op 'Fix checked' om de items te verwijderen.

Download MBAM (Malwarebytes Anti-Malware)

Dubbelklik op mbam-setup.exe om het programma te installeren.

Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Start Malwarebytes' Anti-Malware, Klik daarna op "Voltooien".

Indien een update gevonden werd, zal die gedownload en geïnstalleerd worden.

Wanneer het programma volledig up to date is, selecteer dan in het tabblad Scanner : "Snelle Scan", daarna klik op Scan.

Het scannen kan een tijdje duren, dus wees geduldig.

Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.

Zorg ervoor dat daar alles aangevinkt is, daarna klik op: Verwijder geselecteerde.

Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie verder).

Indien er de rootkit (TDSS) aanwezig is, zal MBAM vragen te herstarten. Doe dit dan ook.

MBAM zal na de herstart opnieuw scannen en de rootkit verwijderen.

Het log wordt automatisch bewaard door MBAM en kan je terugvinden door op de "Logs" tab te klikken in het programma.

Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken. Daarna zal het vragen om de computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.

Plak de inhoud van het logje in je volgende bericht, samen met een nieuw HijackThis log.

kweezie wabbit · 15 augustus 2011

Ik zie dat het Service Pack 1 voor windows 7 nog niet geinstalleerd is.

Is daar een speciale reden voor?

ikjoost · 19 augustus 2011

dit is het log van malware

Malwarebytes' Anti-Malware 1.51.1.1800

Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Databaseversie: 7511

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

19-8-2011 20:28:47

mbam-log-2011-08-19 (20-28-47).txt

Scantype: Snelle scan

Objecten gescand: 187843

Verstreken tijd: 3 minuut/minuten, 49 seconde(n)

Geheugenprocessen geïnfecteerd: 1

Geheugenmodulen geïnfecteerd: 1

Registersleutels geïnfecteerd: 18

Registerwaarden geïnfecteerd: 1

Registerdata geïnfecteerd: 0

Mappen geïnfecteerd: 11

Bestanden geïnfecteerd: 73

Geheugenprocessen geïnfecteerd:

c:\program files (x86)\savetubevideo.com\savetubevideo\downloader.exe (Adware.SkyLab) -> 3980 -> Unloaded process successfully.

Geheugenmodulen geïnfecteerd:

c:\program files (x86)\savetubevideo.com\savetubevideo\transport_dll.dll (Adware.SkyLab) -> Delete on reboot.

Registersleutels geïnfecteerd:

HKEY_CLASSES_ROOT\CLSID\{F3FEE66E-E034-436a-86E4-9690573BEE8A} (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F3FEE66E-E034-436A-86E4-9690573BEE8A} (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{F3FEE66E-E034-436A-86E4-9690573BEE8A} (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{F3FEE66E-E034-436A-86E4-9690573BEE8A} (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} (Adware.SkyLab) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{70EF8B2A-3A34-4913-AAFC-5A2827E0B1B1} (Adware.SkyLab) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{AD49CE2B-B922-4E2A-AAD9-C1565855C7BC} (Adware.SkyLab) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\KBBar.KBBarBand.1 (Adware.SkyLab) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{F334C7B0-8774-4D5B-BD7A-4F448D03A1AE} (Adware.SkyLab) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{F334C7B0-8774-4D5B-BD7A-4F448D03A1AE} (Adware.SkyLab) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2863E737-DD3F-4280-9AF8-E9E79C16F312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2863E737-DD3F-4280-9AF8-E9E79C16F312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D7BE8ED1-B138-48FD-BB22-9779A39130B1} (Redir.GSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D7BE8ED1-B138-48FD-BB22-9779A39130B1} (Redir.GSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Cerberus (Backdoor.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\SkyMedia (Adware.SkyMedia) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SaveTubeVideo_is1 (Adware.SkyLab) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{B8D27088-FF5F-4B7C-98DC-0E91A1696286} (Adware.SkyLab) -> Quarantined and deleted successfully.

Registerwaarden geïnfecteerd:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{F3FEE66E-E034-436A-86E4-9690573BEE8A} (PUP.Dealio.TB) -> Value: {F3FEE66E-E034-436A-86E4-9690573BEE8A} -> Quarantined and deleted successfully.

Registerdata geïnfecteerd:

(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:

c:\program files (x86)\savetubevideo.com (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\content (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\locale (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\locale\en-US (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\components (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\google custom search (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv (Backdoor.Bot) -> Quarantined and deleted successfully.

Bestanden geïnfecteerd:

c:\program files (x86)\youtube downloader toolbar\IE\4.1\youtubedownloadertoolbarie.dll (PUP.Dealio.TB) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\savetubevideo.dll (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\spoolsv.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\browserstartpage.dll (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\Config.dat (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\downloader.exe (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\flvsplitter.ax (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\googlechromeextansion.exe (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\index.htm (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\installhelper.exe (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\lame.ax (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\preferencesoriginal (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\RegSetup.exe (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\starburnrds.dll (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\transport_dll.dll (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\unins000.dat (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\unins000.exe (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\Web Data (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\web data-journal (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\allkeywords.txt (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome.manifest (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\install.rdf (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\searchtoolbar@skywebsearch.com (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\content\about.xul (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\content\googlefeed.xml (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\content\googlesearch.htm (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\content\registerdialog.js (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\content\registerdialog.xul (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\content\settings.js (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\content\skysearchtoolbar.js (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\content\skysearchtoolbar.xul (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\content\startabout.js (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\content\unregister.xul (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\locale\en-US\skysearchtoolbar.dtd (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\locale\en-US\toolbar.properties (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\about.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\aboutDlg.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\addvideo.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\bigbutton.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\burnit.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\gripper.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\icon.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\icon16-16.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\register.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\savevideo.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\savevideo2.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\search.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\settings.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\showstatus.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\skysearchtoolbar.css (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\smile!.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\chrome\skin\videooftheday.png (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\components\ISwslib.xpt (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\components\nsirdshistoryservice.js (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\components\nsirdshistoryservice.xpt (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\components\rdstb-autocomplete.js (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\FF\components\swslib.dll (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\google custom search\index.htm (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\google custom search\manifest.json (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\program files (x86)\savetubevideo.com\savetubevideo\google custom search\redirect.html (Adware.SkyLab) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\a.reg (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\aliases.ini (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\com.mrc (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\control.ini (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\fullname.txt (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\ident.txt (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\mirc.ico (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\mirc.ini (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\remote.ini (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\s.mrc (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\servers.ini (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\users.ini (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\Windows\Temp\spoolsv\xmas.jpg (Backdoor.Bot) -> Quarantined and deleted successfully.

dit is het laatste log van hijackthis

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 20:45:32, on 19-8-2011

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal

Running processes:

C:\Windows\PixArt\Pac207\Monitor.exe

C:\Program Files (x86)\RocketDock\RocketDock.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Geinstaleerde Proggies C\poweriso\PWRISOVM.EXE

C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe

D:\Geinstaleerde Proggies D\VMware WorkStation v7\vmware-tray.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe

C:\Program Files (x86)\AVG\AVG10\avgtray.exe

C:\Geinstaleerde Proggies C\tightvnc remote desktop\TightVNC\tvnserver.exe

C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

C:\Geinstaleerde Proggies C\antimalware\Malwarebytes' Anti-Malware\mbam.exe

C:\Users\joost\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\SysWOW64\NOTEPAD.EXE

D:\DropZone D\internet downloads\New folder\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

F2 - REG:system.ini: UserInit=userinit.exe,