[OPGELOST] Pop-ups ?

28 december 2008

Hallo, pop-ups, het meest irritante iets en daar heb ik weer wat mee te maken -.-' Ik heb al Ad-aware, spybot s&d, Ccleaner, virusscan gedaan, maar dit heeft niet geholpen...

Ik heb Internetopties -> Privacy -> Instellingen -> "Toegestane Websites" gekeken, stond ook niets in... Ik krijg de popups alleen als ik Internet Explorer open heb, ik heb al 2 daagjes geprobeerd met Mozilla & dat nieuw ding van Google Chrome, ook Google toolbar erbij uitgeprobeerd, maar niets...

Hoe ben ik aan de pop-ups gekomen?

Ik ging vroegtijdig een E-card voor kerstmis opsturen bij Hallmark.

Ik zeg niet dat Hallmark hier schuldig aan is, maar voor ik dat deed, heb ik ook geen pop-ups gehad...

Telkens als ik me pc opstart, krijg ik wel van Windows Defender een soort iets "Geblokkeerd opstartprogramma's", volgens mij heeft dit hier iets mee te maken, want als ik rechtermuisknop -> afsluiten doe, dan krijg ik geen pop-ups, doe ik rechtermuisknop -> Geblokkeerde programma uitvoeren > Bird Stop Debug (geen idee wat dit is), dan krijg ik de popups wel...

Doe ik rechtermuisknop -> geblokkeerde opstart programma's weergeven of verwijderen, dan kan ik er al helemaal nietmeer aan uit...

EDIT : afbeelding weggenomen !!!

Ok, de Bird Stop Debug & ExtraLogLog ding weet ik niet wat het is, voor de rest vind ik ook niet echt wat over een pop up op me pc...

Waar gaan de popups over?

Alles! Ebay, Franse dingetjes waar ik niets van versta want ik kan geen frans, kerstmis, telefoons...

"WIN NU" dingetjes, dat franse ding is iets met een pen ofzo ...

De eerste keer dat ik die pop ups kreeg, kreeg ik er 12 meteen, allemaal hetzelfde, een paar keer :\

En vanaf toen kreeg ik er altijd maar 3 ongeveer, soms 1tje, soms 3 tegelijk ...

Heb al 3 popups, minder dan 10 minuten... De één gaat over Smile Together dingen weet ik veel (look below), de ander over Mobistar Tempo Music & dan nog ééntje over: WIN JE FAVORIETE KERSTCADEAU! :/

EDIT : afbeelding weggenomen !!!

Heeft iemand ideetje wat ik kan doen? ^^

Ik heb ook een HJThis log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 2:01:45, on 28/12/2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exe

C:\Program Files\Logitech\QuickCam\Quickcam.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Windows\System32\mobsync.exe

C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe

C:\Program Files\Internet Explorer\ieuser.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [CamWizard] C:\Program Files\Common Files\Logitech\QCDRV\BIN\CamWizrd.exe

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [LiveAcid] "C:\ProgramData\ExtraLogLog.gjyxp6"

O4 - HKCU\..\Run: [Hope Draw Obj Funk] "C:\ProgramData\bird stop debug.zxv5ho"

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: avgrsstx.dll

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe

--

End of file - 8398 bytes

Geen verstand van HJThis, maar met doorlezen denk ik er toch al 3 uitgevonden te hebben?

Ik wacht rustig de reactie van jullie af

kape · 28 december 2008

Start Hijackthis op. Ben je gebruiker van Vista kies dan voor “Run as administrator" of "Uitvoeren als administrator". Selecteer “Do a system scan only”. Selecteer alleen de items die hieronder zijn genoemd:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKCU\..\Run: [LiveAcid] "C:\ProgramData\ExtraLogLog.gjyxp6"

O4 - HKCU\..\Run: [Hope Draw Obj Funk] "C:\ProgramData\bird stop debug.zxv5ho"

Klik op 'Fix checked' om de items te verwijderen.

Download Combofix naar je Bureaublad.

OPMERKING: indien je, tijdens of na het downloaden van Combofix of tijdens het gebruik van Combofix een melding krijgt van je Antivirus- of een andere realtime scanner, schakel dan deze scanner uit en download Combofix opnieuw.

Sommige scanners zien bepaalde componenten die Combofix gebruikt als verdacht en gaan deze blokkeren of verwijderen!

Dubbelklik op Combofix.exe om het te starten.
Indien je Combofix al eerder hebt gebruikt, kan je een waarschuwing krijgen dat een update beschikbaar is. Sta toe dat ComboFix wordt geupdate.
Volg de instructies, aanvaard de disclaimer door op Ja te klikken.
Indien de Recovery Console niet geïnstalleerd is, wordt je gevraagd om dit alsnog te doen door op JA te klikken in het "Query - Recovery Console" venster (enkel voor XP, niet voor VISTA).
Klik op OK en Ja om automatisch de Recovery Console te laten installeren.
Klik na afloop terug op Ja om het scannen op malware te starten.
Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

Wanneer de fix voltooid is en na herstart, zal de log Combofix.txt openen.

Post dit logje in je volgende antwoord.

28 december 2008

ComboFix 08-12-26.03 - user 2008-12-28 17:00:05.1 - NTFSx86

Microsoft® Windows Vista™ Business 6.0.6001.1.1252.1.1043.18.3326.2240 [GMT 1:00]

Gestart vanuit: c:\users\user\Documents\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated)

* Nieuw herstelpunt werd aangemaakt

.

(((((((((((((((((((( Bestanden Gemaakt van 2008-11-28 to 2008-12-28 ))))))))))))))))))))))))))))))

.

2008-12-28 01:58 . 2008-12-28 01:58 <DIR> d-------- c:\program files\Trend Micro

2008-12-27 19:17 . 2008-12-27 19:17 <DIR> d-------- c:\users\user\AppData\Roaming\FlashGet

2008-12-27 19:16 . 2008-12-27 19:30 <DIR> d-------- c:\program files\FlashGet

2008-12-27 19:07 . 2008-12-27 19:07 <DIR> d-------- c:\users\All Users\Lavasoft

2008-12-27 19:07 . 2008-12-27 19:07 <DIR> d-------- c:\programdata\Lavasoft

2008-12-27 19:07 . 2008-12-27 19:07 <DIR> d-------- c:\program files\Lavasoft

2008-12-27 19:06 . 2008-12-27 19:06 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard

2008-12-25 16:54 . 2008-12-25 16:54 <DIR> d-------- c:\users\All Users\LICENSE FORD HOPE DRAW

2008-12-25 16:54 . 2008-12-25 16:55 <DIR> d-------- c:\users\All Users\grid web ping

2008-12-25 16:54 . 2008-12-25 16:54 <DIR> d-------- c:\programdata\LICENSE FORD HOPE DRAW

2008-12-25 16:54 . 2008-12-25 16:55 <DIR> d-------- c:\programdata\grid web ping

2008-12-25 15:36 . 2008-12-25 15:36 <DIR> d-------- c:\users\All Users\Messenger Plus!

2008-12-25 15:36 . 2008-12-25 15:36 <DIR> d-------- c:\programdata\Messenger Plus!

2008-12-25 15:33 . 2008-12-25 16:54 <DIR> d-------- c:\program files\Messenger Plus! Live

2008-12-25 15:33 . 2008-12-25 16:55 <DIR> d-------- c:\program files\Circle Developement

2008-12-23 01:18 . 2008-12-23 01:18 <DIR> d-------- c:\users\user\temp

2008-12-23 01:18 . 2008-12-23 01:21 <DIR> d-------- c:\users\user\AppData\Roaming\TeamViewer

2008-12-23 01:18 . 2008-12-23 01:18 <DIR> d-------- c:\program files\TeamViewer

2008-12-21 04:41 . 2008-12-21 04:41 <DIR> d-------- C:\.jagex_cache_32

2008-12-18 21:17 . 2008-12-18 21:17 410,984 --a------ c:\windows\System32\deploytk.dll

2008-12-12 17:20 . 2008-10-22 02:22 2,048 --a------ c:\windows\System32\tzres.dll

2008-12-12 15:53 . 2008-11-01 02:21 4,240,384 --a------ c:\windows\System32\GameUXLegacyGDFs.dll

2008-12-12 15:53 . 2008-10-21 06:25 296,960 --a------ c:\windows\System32\gdi32.dll

2008-12-12 15:53 . 2008-11-01 04:44 28,672 --a------ c:\windows\System32\Apphlpdm.dll

2008-12-12 15:52 . 2008-10-29 07:29 2,927,104 --a------ c:\windows\explorer.exe

2008-12-12 15:52 . 2008-06-23 02:59 2,868,736 --a------ c:\windows\System32\mf.dll

2008-12-12 15:52 . 2008-06-23 02:59 996,352 --a------ c:\windows\System32\WMNetMgr.dll

2008-12-12 15:52 . 2008-10-16 05:47 827,392 --a------ c:\windows\System32\wininet.dll

2008-12-12 15:52 . 2008-06-23 02:58 94,720 --a------ c:\windows\System32\logagent.exe

2008-12-11 23:47 . 2008-12-11 23:47 <DIR> d-------- c:\program files\Power Tab Software

2008-12-10 23:42 . 2008-12-10 23:42 <DIR> d-------- c:\program files\VirtualDJ

2008-12-09 21:17 . 2008-12-09 21:17 <DIR> d-------- c:\users\user\AppData\Roaming\Renegade Minds

2008-12-02 23:15 . 2008-12-27 19:49 <DIR> d-------- c:\users\user\AppData\Roaming\FrostWire

2008-12-02 23:15 . 2008-12-02 23:15 <DIR> d-------- c:\program files\FrostWire

2008-12-02 23:11 . 2008-12-02 23:11 <DIR> d-------- c:\users\user\.limewire

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-28 15:49 --------- d-----w c:\users\user\AppData\Roaming\Skype

2008-12-28 15:04 --------- d-----w c:\users\user\AppData\Roaming\skypePM

2008-12-24 09:32 31 ----a-w c:\users\user\jagex_runescape_preferences.dat

2008-12-18 20:17 --------- d-----w c:\program files\Java

2008-12-12 21:59 --------- d-----w c:\program files\Windows Mail

2008-12-12 16:23 --------- d-----w c:\programdata\Microsoft Help

2008-12-12 16:17 --------- d-----w c:\programdata\avg8

2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll

2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll

2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll

2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll

2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll

2008-10-29 14:50 --------- d-----w c:\programdata\NVIDIA

2008-10-22 03:57 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll

2008-10-21 05:25 1,645,568 ----a-w c:\windows\System32\connect.dll

2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll

2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll

2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe

2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll

2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll

2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll

2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll

2008-10-16 13:08 162,064 ----a-w c:\windows\System32\wuwebv.dll

2008-10-16 12:56 31,232 ----a-w c:\windows\System32\wuapp.exe

2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll

2008-09-03 19:23 56 ---ha-w c:\users\All Users\ezsidmv.dat

2008-09-03 19:23 56 ---ha-w c:\programdata\ezsidmv.dat

2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini

2008-08-08 16:49 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

2008-08-08 16:49 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

2008-08-08 16:49 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-08-12 21741864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-18 136600]

"CamWizard"="c:\program files\Common Files\Logitech\QCDRV\BIN\CamWizrd.exe" [2005-05-13 184320]

"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 563984]

"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 2027792]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-08-28 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-28 8473120]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-28 81920]

c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Schermopname en Snel starten.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-09-14 67128]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{BA1D8018-2FB9-4689-9335-7BF553A94388}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe

"{833DF113-9EE1-4919-99BE-E9C5F676AF21}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe

"{C9FACCC7-D850-49C9-8A35-A0BB159B2919}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

"TCP Query User{7C8B2C52-8AD9-4706-968C-5DD97E7BD514}e:\\mirc\\mirc.exe"= UDP:e:\mirc\mirc.exe:mIRC

"UDP Query User{4390BF8E-AE01-448E-B306-736946863A3A}e:\\mirc\\mirc.exe"= TCP:e:\mirc\mirc.exe:mIRC

"TCP Query User{A2975EDE-ADC8-4342-A0A2-8810096E8C79}e:\\programs\\stubinstaller.exe"= UDP:e:\programs\stubinstaller.exe:LimeWire swarmed installer

"UDP Query User{C90F3DC3-C62C-43FA-BF2C-298337B7579A}e:\\programs\\stubinstaller.exe"= TCP:e:\programs\stubinstaller.exe:LimeWire swarmed installer

"{F37B0B98-9CA9-424D-ACA6-FF35F63C53BE}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire

"{6C9C61EB-D275-49DB-A136-DD627323A693}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire

"TCP Query User{7CD28B09-4099-437F-883C-4A0691B81AEA}e:\\windrop\\eggdrop.exe"= UDP:e:\windrop\eggdrop.exe:eggdrop

"UDP Query User{A0C707BE-3451-4653-B727-BD40236D9D13}e:\\windrop\\eggdrop.exe"= TCP:e:\windrop\eggdrop.exe:eggdrop

"{931F7A48-9583-4A5D-93E9-A0182DA75F29}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{C98C7C6C-CDA7-469D-A1BE-F73C66707891}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{3E4FDEA4-6E4D-4E3C-BEE5-55EB6977107A}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{CA2D96E1-5234-4036-A364-DE6E167248C2}"= UDP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger

"{A99C42B6-7594-4AC6-AA26-49A421A79347}"= TCP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger

"{80FD4F86-982C-44CB-9BE5-F81A6C8AE741}"= UDP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger

"{48588AF4-B71A-486E-9FB9-69D4CBECD112}"= TCP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger

"TCP Query User{9EF4E899-4CA2-401A-8BBF-F5A147062F17}c:\\program files\\logitech\\desktop messenger\\8876480\\program\\logitechdesktopmessenger.exe"= UDP:c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe:Logitech Desktop Messenger

"UDP Query User{79F1D085-9B15-4F1F-B4C7-E50FF4A356DF}c:\\program files\\logitech\\desktop messenger\\8876480\\program\\logitechdesktopmessenger.exe"= TCP:c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe:Logitech Desktop Messenger

"TCP Query User{DE615107-5C17-4D17-BC14-12C222ED8512}c:\\users\\user\\appdata\\local\\temp\\low\\plauncher.exe"= UDP:c:\users\user\appdata\local\temp\low\plauncher.exe:plauncher.exe

"UDP Query User{BC332CF1-9F90-417F-A19A-BD4F6776CF85}c:\\users\\user\\appdata\\local\\temp\\low\\plauncher.exe"= TCP:c:\users\user\appdata\local\temp\low\plauncher.exe:plauncher.exe

"{63BFE897-691C-4086-8E29-B73C71EBDB0C}"= UDP:c:\users\user\AppData\Local\Temp\PurpleBean.exe:PurpleBean.exe

"{8481B50F-665F-4F43-ADBE-D79A0A27417C}"= TCP:c:\users\user\AppData\Local\Temp\PurpleBean.exe:PurpleBean.exe

"TCP Query User{12E28ECF-CBD5-45FD-AB12-9FF22A57CA36}c:\\ijji\\english\\u_sf\\soldierfront.exe"= UDP:c:\ijji\english\u_sf\soldierfront.exe:soldierfront

"UDP Query User{2C888547-9BF0-4910-BD22-88111821DB36}c:\\ijji\\english\\u_sf\\soldierfront.exe"= TCP:c:\ijji\english\u_sf\soldierfront.exe:soldierfront

"TCP Query User{53C7FCFB-20FD-488B-ADF8-B52F0C54FC29}c:\\ijji\\english\\u_sf\\soldierfront.exe"= UDP:c:\ijji\english\u_sf\soldierfront.exe:soldierfront

"UDP Query User{4DF17AB7-2284-4E03-B675-86FEBD422B24}c:\\ijji\\english\\u_sf\\soldierfront.exe"= TCP:c:\ijji\english\u_sf\soldierfront.exe:soldierfront

"TCP Query User{C04F2D9F-2FD5-4115-937B-D5854F342E67}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire

"UDP Query User{DF75BDBD-0C81-4FD3-9B59-0BE3FEE5C4E7}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire

"{E4BC4361-32F9-4710-B8C8-84502BE7C843}"= UDP:c:\program files\FrostWire\FrostWire.exe:FrostWire

"{B1E017DC-1424-4A31-9108-77BE10233BED}"= TCP:c:\program files\FrostWire\FrostWire.exe:FrostWire

"TCP Query User{9D74F792-BA5B-4967-8440-9A4D9F7451EA}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet

"UDP Query User{CB4A0445-4776-4561-AA8D-B1390B754494}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-08-08 97928]

R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-08-08 875288]

R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-08-08 231704]

R2 TeamViewer4;TeamViewer 4;"c:\program files\TeamViewer\Version4\TeamViewer_Service.exe" -service [2008-12-15 185640]

R3 AvgWfpX;AVG8 Firewall Driver x86;c:\windows\system32\Drivers\avgwfpx.sys [2008-08-08 69128]

R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1987f02-a0c3-11dc-9a88-806e6f6e6963}]

\shell\AutoRun\command - notepad copyright.txt

\shell\BuildInfo\command - notepad buildinfo.txt

\shell\Copyright\command - notepad copyright.txt

*Newly Created Service* - PROCEXP90

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-28 17:01:32

Windows 6.0.6001 Service Pack 1 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- DLLs Geladen Onder Lopende Processen ---------------------

- - - - - - - > 'winlogon.exe'(772)

c:\windows\system32\avgrsstx.dll

- - - - - - - > 'lsass.exe'(596)

c:\windows\system32\avgrsstx.dll

.

Voltooingstijd: 2008-12-28 17:05:58

ComboFix-quarantined-files.txt 2008-12-28 16:05:54

Pre-Run: 115.387.891.712 bytes beschikbaar

Post-Run: 115,080,765,440 bytes beschikbaar

176 --- E O F --- 2008-12-18 14:31:56

kape · 28 december 2008

Je Messenger Plus ! Live zal je ongetwijfeld mét sponsors gedownload hebben, één van de oorzaken van de pop-ups.

Kijk in Configuratiescherm -> Software of die Messenger Plus ! Live (of Messenger Plus !) daar staat en verwijder hem volledig. Later kun je deze terug downloaden - zonder sponsors - als je PC terug clean is en geen pop-ups meer vertoont.

Dan mag je volgende vetgedrukte mappen verwijderen met Windows Verkenner :

c:\users\All Users\LICENSE FORD HOPE DRAW

c:\users\All Users\grid web ping

c:\programdata\LICENSE FORD HOPE DRAW

c:\programdata\grid web ping

c:\users\All Users\Messenger Plus!

c:\programdata\Messenger Plus!

c:\program files\Messenger Plus! Live

En plaats dan een nieuw log van HJT en Combofix in je volgende bericht ... en laat ook even weten hoe het dan met de pop-ups gesteld is ?

28 december 2008

HiJackThis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:39:44, on 28/12/2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exe

C:\Program Files\Logitech\QuickCam\Quickcam.exe

C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Windows\System32\mobsync.exe

C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe