spyware - spam op sites met IE.

[RENIER LUC]

Iedere keer als ik een website open,krijg ik reklames binnen van o.a. Cofidis - verdien geld in 10minuten - prachtige Russische vrouwen klaar voor datings - speel mee op Casino enz.enz.

Zeer vevelend,want ik moet die steeds afklikken eer mijn gewenste site opent.

Hoe kan dat voorkomen worden?Met welke instellingen blokkeer ik deze sites??

Graag een oplossing voor Luc

[RENIER LUC]

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 18:20:04, on 4/02/2014

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

C:\Program Files\Fighters\Tray\FightersTray.exe

C:\Program Files\Fighters\SPAMfighter\sfagent.exe

C:\Program Files\Dell V310-V510 Series\dleamon.exe

C:\Program Files\Dell V310-V510 Series\ezprint.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\dleacoms.exe

C:\Program Files\Java\jre7\bin\jqs.exe

C:\Program Files\Rainlendar\Rainlendar.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Fighters\SPAMfighter\sfus.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Fighters\FighterSuiteService.exe

C:\WINDOWS\system32\ntvdm.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\trend micro\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = QVO6

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer wordt aangeboden door Belgacom Skynet

O2 - BHO: Dell Werkbalk - {09B71986-2AC5-482d-B6CB-42EA34F4F85B} - C:\Program Files\Dell Toolbar\toolband.dll

O2 - BHO: PassShow - {2d661e5b-7d7a-417c-b5b5-6479017bb314} - (no file)

O2 - BHO: VideoPlayerV3beta27 - {73a1712f-955b-4ab7-9f6d-fa868ff241b9} - C:\Program Files\VideoPlayerV3\VideoPlayerV3beta27\ie\VideoPlayerV3beta27.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

O2 - BHO: MediaPlayerV1alpha542 - {81c935ce-8812-461b-95bc-751d363bc47f} - C:\Program Files\MediaPlayerV1\MediaPlayerV1alpha542\ie\MediaPlayerV1alpha542.dll

O2 - BHO: Systweak NL - {d1070b52-8885-4fe7-8b6c-bd75b658be82} - (no file)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

O3 - Toolbar: Dell Werkbalk - {09B71986-2AC5-482d-B6CB-42EA34F4F85B} - C:\Program Files\Dell Toolbar\toolband.dll

O3 - Toolbar: Systweak NL Toolbar - {d1070b52-8885-4fe7-8b6c-bd75b658be82} - (no file)

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [CommonToolkitTray] C:\Program Files\Fighters\Tray\FightersTray.exe

O4 - HKLM\..\Run: [sfagent] C:\Program Files\Fighters\SPAMfighter\sfagent.exe

O4 - HKLM\..\Run: [dleamon.exe] "C:\Program Files\Dell V310-V510 Series\dleamon.exe"

O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Dell V310-V510 Series\ezprint.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Optimizer Pro] C:\Program Files\Optimizer Pro\OptProLauncher.exe

O4 - HKCU\..\Run: [Driver Pro] C:\Program Files\Driver Pro\DPLauncher.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun

O4 - HKCU\..\Run: [NextLive] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Luc\Application Data\newnext.me\nengine.dll",EntryPoint -m l

O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe -update activex (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe -update activex (User 'Default user')

O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre7\bin\jp2iexp.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre7\bin\jp2iexp.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1296289844390

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1352808708625

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: AV Engine Scanning Service - Unknown owner - C:/Program Files/Common Files/Common Toolkit Suite/AVEngine/AVScanningService.exe (file missing)

O23 - Service: AV Watch Service - Unknown owner - C:/Program Files/Common Files/Common Toolkit Suite/AVEngine/AVWatchService.exe (file missing)

O23 - Service: BonanzaDealsLive-service (bonanzadealslive) (bonanzadealslive) - Unknown owner - C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe (file missing)

O23 - Service: BonanzaDealsLive-service (bonanzadealslivem) (bonanzadealslivem) - Unknown owner - C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe (file missing)

O23 - Service: Search Protect by Conduit Updater (CltMngSvc) - Unknown owner - C:\Program Files\SearchProtect\bin\CltMngSvc.exe (file missing)

O23 - Service: dleaCATSCustConnectService - Unknown owner - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\dleaserv.exe

O23 - Service: dlea_device - - C:\WINDOWS\system32\dleacoms.exe

O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: SaveSenseLive Service (savesenselive) (savesenselive) - SaveSense - C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe

O23 - Service: SaveSenseLive Service (savesenselivem) (savesenselivem) - SaveSense - C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\Fighters\SPAMfighter\sfus.exe

O23 - Service: Suite Service - SPAMfighter ApS - C:\Program Files\Fighters\FighterSuiteService.exe

O23 - Service: VideoDownloadConverterService (VideoDownloadConverter_4zService) - Unknown owner - C:\PROGRA~1\VIDEOD~2\bar\1.bin\4zbarsvc.exe (file missing)

O23 - Service: WeatherBlinkService - Unknown owner - C:\PROGRA~1\WEATHE~2\bar\1.bin\gcbarsvc.exe (file missing)

--

End of file - 8713 bytes

[kape]

Start Hijackthis op. Selecteer “Scan”. Selecteer alleen de items die hieronder zijn genoemd:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = QVO6

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

O2 - BHO: PassShow - {2d661e5b-7d7a-417c-b5b5-6479017bb314} - (no file)

O2 - BHO: VideoPlayerV3beta27 - {73a1712f-955b-4ab7-9f6d-fa868ff241b9} - C:\Program Files\VideoPlayerV3\VideoPlayerV3beta27\ie\VideoPlayerV3beta27.dll

O2 - BHO: MediaPlayerV1alpha542 - {81c935ce-8812-461b-95bc-751d363bc47f} - C:\Program Files\MediaPlayerV1\MediaPlayerV1alpha542\ie\MediaPlayerV1alpha542.dll

O2 - BHO: Systweak NL - {d1070b52-8885-4fe7-8b6c-bd75b658be82} - (no file)

O3 - Toolbar: Systweak NL Toolbar - {d1070b52-8885-4fe7-8b6c-bd75b658be82} - (no file)

O4 - HKCU\..\Run: [Optimizer Pro] C:\Program Files\Optimizer Pro\OptProLauncher.exe

O4 - HKCU\..\Run: [NextLive] C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Luc\Application Data\newnext.me\nengine.dll",EntryPoint -m l

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O23 - Service: AV Engine Scanning Service - Unknown owner - C:/Program Files/Common Files/Common Toolkit Suite/AVEngine/AVScanningService.exe (file missing)

O23 - Service: AV Watch Service - Unknown owner - C:/Program Files/Common Files/Common Toolkit Suite/AVEngine/AVWatchService.exe (file missing)

O23 - Service: BonanzaDealsLive-service (bonanzadealslive) (bonanzadealslive) - Unknown owner - C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe (file missing)

O23 - Service: BonanzaDealsLive-service (bonanzadealslivem) (bonanzadealslivem) - Unknown owner - C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe (file missing)

O23 - Service: Search Protect by Conduit Updater (CltMngSvc) - Unknown owner - C:\Program Files\SearchProtect\bin\CltMngSvc.exe (file missing)

O23 - Service: SaveSenseLive Service (savesenselive) (savesenselive) - SaveSense - C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe

O23 - Service: SaveSenseLive Service (savesenselivem) (savesenselivem) - SaveSense - C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe

O23 - Service: VideoDownloadConverterService (VideoDownloadConverter_4zService) - Unknown owner - C:\PROGRA~1\VIDEOD~2\bar\1.bin\4zbarsvc.exe (file missing)

O23 - Service: WeatherBlinkService - Unknown owner - C:\PROGRA~1\WEATHE~2\bar\1.bin\gcbarsvc.exe (file missing)

Klik op 'Fix checked' om de items te verwijderen.

Let op : Windows Vista & 7 gebruikers dienen HijackThis als “administrator” uit te voeren via rechtermuisknop “als administrator uitvoeren". Indien dit via de snelkoppeling niet lukt voer je HijackThis als administrator uit in de volgende map : C:\Program Files\Trend Micro\HiJackThis of C:\Program Files (x86)\Trend Micro\HiJackThis.

Download RSIT van de onderstaande locaties en sla deze op het bureaublad op.

Hier staat een beschrijving hoe je kan kijken of je een 32- of 64-bitversie van Windows heeft.

• RSIT 32 bit (RSIT.exe)
  
• RSIT 64 bit (RSITx64.exe)
  

Dubbelklik op RSIT.exe om de tool te starten.

• Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
  
• Vervolgens wordt de "Disclaimer of warranty" getoond, klik vervolgens op "Continue"
  
• Wanneer de tool gereed is wordt er een kladblok bestand genaamd "Log" geopend.
  
• Plaats de inhoud hiervan in het volgende bericht.
  

Bekijk ook de instructievideo.