Pc gaat traag - virus?

[Sarah]

Een vriend van me heeft een trage pc en denk aan virus-spyware.

Ik heb hem ff een logje laten aanmaken:

Kape kan je ff kijken als je tijd hebt? Thanks

Logfile of Trend Micro HijackThis v2.0.2

scan saved at 20:00:58, on 30/04/2008

platform: windows xp sp2 (winnt 5.01.2600)

msie: internet explorer v7.00 (7.00.6000.16640)

boot mode: normal

browser: Mozilla Firefox x.x

ColorCoder Build: 4136

Running Processes:

c:\windows\system32\smss.exe

c:\windows\system32\winlogon.exe

c:\windows\system32\services.exe

c:\windows\system32\lsass.exe

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe

c:\windows\system32\svchost.exe

c:\program files\common files\symantec shared\ccsvchst.exe

c:\program files\common files\symantec shared\appcore\appsvc32.exe

c:\windows\system32\spoolsv.exe

c:\program files\common files\logishrd\lvmvfm\lvprcsrv.exe

c:\program files\google\common\google updater\googleupdaterservice.exe

c:\program files\common files\logishrd\lvcomser\lvcomser.exe

c:\program files\common files\microsoft shared\vs7debug\mdm.exe

c:\windows\system32\nvsvc32.exe

c:\program files\symantec\liveupdate\aluschedulersvc.exe

c:\program files\cyberlink\shared files\richvideo.exe

c:\windows\system32\pastisvc.exe

c:\windows\system32\svchost.exe

c:\program files\common files\ulead systems\dvd\ulcdrsvr.exe

c:\windows\explorer.exe

c:\program files\common files\logishrd\lvcomser\lvcomser.exe

c:\program files\belgacom\bin\sprtcmd.exe

c:\program files\common files\symantec shared\ccapp.exe

c:\windows\alcxmntr.exe

c:\program files\java\jre1.6.0_05\bin\jusched.exe

c:\program files\quicktime\qttask.exe

c:\hp\kbd\kbd.exe

c:\program files\hp\hp software update\hpwuschd2.exe

c:\windows\system32\rundll32.exe

c:\program files\scansoft\omnipagese4.0\opwarese4.exe

c:\program files\common files\logishrd\lcommgr\communications_helper.exe

c:\windows\system32\ctfmon.exe

c:\program files\msn messenger\msnmsgr.exe

c:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe

c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe

c:\program files\msn messenger\usnsvc.exe

c:\windows\system32\svchost.exe

c:\windows\system32\wuauclt.exe

c:\windows\system32\dumprep.exe

c:\windows\system32\dumprep.exe

c:\windows\system32\dumprep.exe

c:\windows\system32\dumprep.exe

c:\windows\system32\dumprep.exe

c:\windows\system32\dumprep.exe

c:\program files\trend micro\hijackthis\hijackthis.exe

R0 - hkcu\software\microsoft\internet explorer\main,start page = skynet.be - le portail belge – de belgische portaalsite!

R1 - hklm\software\microsoft\internet explorer\main,default_page_url = msn.com

R1 - hklm\software\microsoft\internet explorer\main,default_search_url = live search

R1 - hklm\software\microsoft\internet explorer\main,search page = live search

R0 - hklm\software\microsoft\internet explorer\main,start page = msn.com

R0 - hkcu\software\microsoft\internet explorer\toolbar,linksfoldername = koppelingen

R3 - urlsearchhook: yahoo! toolbar - {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

O2 - bho: yahoo! toolbar helper - {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

O2 - bho: (no name) - {1e8a6170-7264-4d0f-beae-d42a53123c75} - c:\program files\common files\symantec shared\coshared\browser\1.0\nppbho.dll

O2 - bho: ewpbrowseobject class - {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\ewpbrowseloader.dll

O2 - bho: ssvhelper class - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll

O2 - bho: (no name) - {7e853d72-626a-48ec-a868-ba8d5e23e045} - (no file)

O2 - bho: windows live sign-in helper - {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll

O2 - bho: google toolbar helper - {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll

O2 - bho: google toolbar notifier bho - {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\2.1.1119.1736\swg.dll

O2 - bho: windows live toolbar helper - {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll

O3 - toolbar: easy-webprint - {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\toolband.dll

O3 - toolbar: windows live toolbar - {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll

O3 - toolbar: norton-werkbalk weergeven - {90222687-f593-4738-b738-fbee9c7b26df} - c:\program files\common files\symantec shared\coshared\browser\1.0\uibho.dll

O3 - toolbar: &google - {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll

O3 - toolbar: yahoo! toolbar - {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

O4 - HKLM\..\Run: [belgacom] "c:\program files\belgacom\bin\sprtcmd.exe" /p belgacom

O4 - HKLM\..\Run: [ccapp] "c:\program files\common files\symantec shared\ccapp.exe"

O4 - HKLM\..\Run: [oscheck] "c:\program files\norton internet security\oscheck.exe"

O4 - HKLM\..\Run: [alcxmonitor] alcxmntr.exe

O4 - HKLM\..\Run: [sunjavaupdatesched] "c:\program files\java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [quicktime task] "c:\program files\quicktime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [kbd] c:\hp\kbd\kbd.exe

O4 - HKLM\..\Run: [hp software update] c:\program files\hp\hp software update\hpwuschd2.exe

O4 - HKLM\..\Run: [nvcpldaemon] rundll32.exe c:\windows\system32\nvcpl.dll,nvstartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect

O4 - HKLM\..\Run: [nvmediacenter] rundll32.exe c:\windows\system32\nvmctray.dll,nvtaskbarinit

O4 - HKLM\..\Run: [nerofiltercheck] c:\program files\common files\ahead\lib\nerocheck.exe

O4 - HKLM\..\Run: [ssbkgdupdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\ssbkgdupdate.exe" -embedding -boot

O4 - HKLM\..\Run: [opwarese4] "c:\program files\scansoft\omnipagese4.0\opwarese4.exe"

O4 - HKLM\..\Run: [logitechcommunicationsmanager] "c:\program files\common files\logishrd\lcommgr\communications_helper.exe"

O4 - HKLM\..\Run: [symantec pif alerteng] "c:\program files\common files\symantec shared\pif\ {b8e1dd85-8582-4c61-b58f-2f227fca9a08} \pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\ {b8e1dd85-8582-4c61-b58f-2f227fca9a08} \alerteng.dll"

O4 - HKCU\..\Run: [ctfmon.exe] c:\windows\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "c:\program files\msn messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [swg] c:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe

O4 - hkus\s-1-5-19\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'lokale service')

O4 - hkus\s-1-5-20\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'netwerkservice')

O4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')

O4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')

O8 - extra context menu item: &windows live search - res://c:\program files\windows live toolbar\msntb.dll/search.htm

O8 - extra context menu item: add to windows &live favorites - add to windows live favorites

O8 - extra context menu item: e&xporteren naar microsoft excel - res://c:\micros~1\office11\excel.exe/3000

O8 - extra context menu item: easy-webprint afdrukken - res://c:\program files\canon\easy-webprint\toolband.dll/rc_print.html

O8 - extra context menu item: easy-webprint afdrukvoorbeeld - res://c:\program files\canon\easy-webprint\toolband.dll/rc_preview.html

O8 - extra context menu item: easy-webprint toevoegen aan afdruklijst - res://c:\program files\canon\easy-webprint\toolband.dll/rc_addtolist.html

O8 - extra context menu item: easy-webprint versneld afdrukken - res://c:\program files\canon\easy-webprint\toolband.dll/rc_hsprint.html

O8 - extra context menu item: openen in een nieuwe achtergrondtab - res://c:\program files\windows live toolbar\components\nl-be\msntabres.dll.mui/229?83af892df45c4561b35d6b504d8cff0b

O8 - extra context menu item: openen in een nieuwe voorgrondtab - res://c:\program files\windows live toolbar\components\nl-be\msntabres.dll.mui/230?83af892df45c4561b35d6b504d8cff0b

O9 - extra button: (no name) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - c:\program files\java\jre1.6.0_05\bin\ssv.dll

O9 - extra 'tools' menuitem: sun java console - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - c:\program files\java\jre1.6.0_05\bin\ssv.dll

O9 - extra button: onderzoek - {92780b25-18cc-41c8-b9be-3c9c571a8263} - c:\progra~1\micros~2\office11\refiebar.dll

O9 - extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe

O9 - extra 'tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe

O9 - extra button: messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe

O9 - extra 'tools' menuitem: windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe

O16 - dpf: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (yinststarter class) - c:\program files\yahoo!\common\yinsthelper.dll

O16 - dpf: {4f1e5b1a-2a80-42ca-8532-2d05cb959537} (msn photo upload tool) - [noparse]http://gfx2.hotmail.com/mail/w2/resources/msnpupld.cab[/noparse]

O16 - dpf: {5d6f45b3-9043-443d-a792-115447494d24} (unoctrl class) - [noparse]http://messenger.zone.msn.com/nl-be/.../game_uno1.cab[/noparse]

O16 - dpf: {6414512b-b978-451d-a0d8-fcfdf33e833c} (wuwebcontrol class) - [noparse]http://www.update.microsoft.com/wind...?1185964319057[/noparse]

O16 - dpf: {644e432f-49d3-41a1-8dd5-e099162eeec5} (symantec rufsi utility class) - [noparse]http://security.symantec.com/sscv6/s.../bin/cabsa.cab[/noparse]

O16 - dpf: {ab86ce53-ac9f-449f-9399-d8abca09ec09} (get_activex control) - [noparse]https://h17000.www1.hp.com/ewfrf-jav...oadmanager.ocx[/noparse]

O16 - dpf: {c3f79a2b-b9b4-4a66-b012-3ee46475b072} (messengerstatsclient class) - [noparse]http://messenger.zone.msn.com/binary...t.cab56907.cab[/noparse]

O16 - dpf: {e8f628b5-259a-4734-97ee-ba914d7be941} (driver agent activex control) - [noparse]http://www.driveragent.com/files/driveragent.cab[/noparse]

O23 - Service: symantec event manager (ccevtmgr) - symantec corporation - c:\program files\common files\symantec shared\ccsvchst.exe

O23 - Service: symantec settings manager (ccsetmgr) - symantec corporation - c:\program files\common files\symantec shared\ccsvchst.exe

O23 - Service: symantec lic netconnect service (cltnetcnservice) - symantec corporation - c:\program files\common files\symantec shared\ccsvchst.exe

O23 - Service: com host (comhost) - symantec corporation - c:\program files\common files\symantec shared\vascanner\comhost.exe

O23 - Service: google updater service (gusvc) - google - c:\program files\google\common\google updater\googleupdaterservice.exe

O23 - Service: wachtwoordvalidatie voor symantec is (ispwdsvc) - symantec corporation - c:\program files\norton internet security\ispwdsvc.exe

O23 - Service: liveupdate - symantec corporation - c:\progra~1\symantec\liveup~1\lucoms~1.exe

O23 - Service: liveupdate notice service ex (liveupdate notice ex) - symantec corporation - c:\program files\common files\symantec shared\ccsvchst.exe

O23 - Service: liveupdate notice service - symantec corporation - c:\program files\common files\symantec shared\pif\ {b8e1dd85-8582-4c61-b58f-2f227fca9a08} \pifsvc.exe

O23 - Service: lvcomser - logitech inc. - c:\program files\common files\logishrd\lvcomser\lvcomser.exe

O23 - Service: process monitor (lvprcsrv) - logitech inc. - c:\program files\common files\logishrd\lvmvfm\lvprcsrv.exe

O23 - Service: lvsrvlauncher - logitech inc. - c:\program files\common files\logishrd\srvlnch\srvlnch.exe

O23 - Service: nbservice - nero ag - c:\program files\nero\nero 7\nero backitup\nbservice.exe

O23 - Service: nvidia display driver service (nvsvc) - nvidia corporation - c:\windows\system32\nvsvc32.exe

O23 - Service: planner voor automatische liveupdate - symantec corporation - c:\program files\symantec\liveupdate\aluschedulersvc.exe

O23 - Service: cyberlink richvideo service(crvs) (richvideo) - unknown owner - c:\program files\cyberlink\shared files\richvideo.exe

O23 - Service: sti simulator - unknown owner - c:\windows\system32\pastisvc.exe

O23 - Service: symantec core lc - unknown owner - c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe

O23 - Service: symantec appcore service (symappcore) - symantec corporation - c:\program files\common files\symantec shared\appcore\appsvc32.exe

O23 - Service: ulead burning helper (uleadburninghelper) - ulead systems, inc. - c:\program files\common files\ulead systems\dvd\ulcdrsvr.exe

--

end of file - 12819 bytes

[kape]

Niet echt zware problemen in dit log en zeker geen aanwijzingen van virussen/spyware.

Start Hijackthis op en kies voor 'Do a system scan only'. Selecteer alleen de items hieronder genoemd:

O2 - bho: (no name) - {7e853d72-626a-48ec-a868-ba8d5e23e045} - (no file)

O4 - HKLM\..\Run: [alcxmonitor] alcxmntr.exe

Klik op 'Fix checked' om de items te verwijderen.

Volgende vetgedrukt bestand verwijderen via Windows Verkenner.

c:\windows\alcxmntr.exe

Alleen vallen me 2 dingen op :

1. PC is zwaar beladen met Norton/Symantec-spul en dan hangt het van de configuratie af of dat beestje dat allemaal wel kan trekken.

2. maar belangrijker : er zitten bij herhaling dumprep.exe bestanden in het log, wat wijst op automatisch herstel van ernstige fouten in de PC door Windows. De eigenaar van de PC zou eens moeten trachten te achterhalen in de logboeken, welk onderdeel deze fouten veroorzaakt. Dit onderdeel zou (mogelijk) ook de oorzaak van de traagheid kunnen zijn.

[marc]

o2 en 04 heb ik verwijderd met hijackthis

c:/windows/alcxmntr.exe , vind ik niet

je praat daar over logboeken , waar vind ik dat, daar ken ik nie veel van

alvast,bedankt voor je moeite

marc

[kape]

c:/windows/alcxmntr.exe , vind ik niet

Dat is wel heel erg vreemd, want in je log zit dit wel duidelijk in ???

HIER kan je wat basisinfo vinden over die logboeken, hoe je ze kan oproepen en wat je er zo al in aantreft. Bekijk dit eens even ... en doorblader de verschillende logboeken dan eens met een kritische blik. Misschien zit daar wel een hint naar de oorzaak van je trage PC.

[kape]

We nemen aan dat deze info volstond. Mocht je dit onderwerp toch nog terug willen openen, geef dan een seintje aan één van de moderators.