Archief - Log

Ik wou gisteren een nieuwe (originele) versie van norton internet security installeren, daarvoor moest ik eerst de oude verwijderen. Ik heb de nieuwe versie dan geïnstalleerd maar toen begonnen de problemen (geen internet meer) en ik heb die er dan ook maar terug afgezwierd. nu heb ik constant pop-ups tijdens het surfen en naast de 'start'-knop linksonder zijn de icoontjes verdwenen. ik heb lavasoft ad-aware laten draaien maar nadat ad-aware de pc moet rebooten om een bepaalde file te kunnen verwijderen krijg ik een of andere foutmelding met rundll. spybot s&d ook al laten draaien maar veel soelaas bracht het niet. wat moet ik doen? hier alvast mijn log:


Logfile of HijackThis v1.99.1
Scan saved at 12:05:30, on 21/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5450.0004)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\{E4DFE12F-089A-2067-0617-050419050020}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\ssoftsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Downloads and games\Tooltjes\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dexia.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [defender] C:\\dfndrdd_6.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrddd_6.exe
O4 - HKLM\..\Run: [hzud292e] RUNDLL32.EXE w00251fe.dll,n 001d292d0000000a00251fe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global User Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {10093E98-C073-4C75-8D0E-FB5CD3A71D33} (ZoneUpwords Object) - http://messenger.zone.msn.com/binary/Upwords.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/14dc05bbb35aba6c3d05/netzip/RdxIE601.cab
O16 - DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} (PlayerOCX Control) - http://www.pysoft.com/Downloads/WebCamPlayerOCX.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: Run- - C:\WINDOWS\system32\gp60l3jm1.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\user\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Cryptainer service (ssoftservice) - Cypherix - C:\WINDOWS\SYSTEM32\ssoftsrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: User Profile Hive Cleanup (UPHClean) - Unknown owner - C:\Program Files\UPHClean\uphclean.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

Download Look2Me-Destroyer.exe naar je bureaublad.

• Sluit alle open venster.
• Dubbelklik Look2Me-Destroyer.exe om het te starten.
• Zet een vinkje naast Run this program as a task.
• Je zal een melding krijgen met: 'Look2Me-Destroyer will close and re-open in approximately 10 seconds'. Klik OK
• Wanneer Look2Me-Remover opnieuw opent, Klik de Scan for L2M knop.
• Je bureaublad icoontjes en taakbalk zullen verdwijnen, dit is normaal.
• Eénmaal gedaan met scannen, klik de Remove L2M knop.
• Je zal de boodschap Done Scanning krijgen, klik OK.
• Nadien zal je volgende melding krijgen: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, klik OK.
• Je computer zal dan afsluiten.
• Start je computer opnieuw op.
• Post de inhoud van C:\Look2Me-Destroyer.txt samen met een nieuw hijackthislogje.

Indien je een alert krijgt van je firewall dat dit programma probeert toegang te krijgen met het internet, sta het toe en blokkeer het niet!

Indien je een runtime error '339' krijgt, download MSWINSCK.OCX via onderstaande link en plaats het in je C:\Windows\System32 map.
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 21/07/2006 12:38:02

Infected! C:\WINDOWS\system32\gpjol3131.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314333.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314340.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314785.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314790.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314794.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314799.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314822.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314846.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314847.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314848.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314849.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314850.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314851.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314860.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314876.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314886.dll
Infected! C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314892.dll
Infected! C:\WINDOWS\system32\d6j0lg1m16.dll
Infected! C:\WINDOWS\system32\gp6ql3j51.dll

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\gpjol3131.dll
C:\WINDOWS\system32\gpjol3131.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314333.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314333.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314340.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314340.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314785.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314785.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314790.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314790.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314794.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314794.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314799.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314799.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314822.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314822.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314846.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314846.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314847.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314847.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314848.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314848.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314849.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314849.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314850.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314850.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314851.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314851.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314860.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314860.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314876.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314876.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314886.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314886.dll could not be deleted!

Attempting to delete: C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314892.dll
C:\System Volume Information\_restore{A81298B8-A661-4CD8-8C3D-24BD99B66868}\RP917\A0314892.dll could not be deleted!

Attempting to delete: C:\WINDOWS\system32\d6j0lg1m16.dll
C:\WINDOWS\system32\d6j0lg1m16.dll could not be deleted!

Attempting to delete: C:\WINDOWS\system32\gp6ql3j51.dll
C:\WINDOWS\system32\gp6ql3j51.dll could not be deleted!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Hints

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{88080E44-8DAC-4F34-A9E4-75BBCDBA7838}"
HKCR\Clsid\{88080E44-8DAC-4F34-A9E4-75BBCDBA7838}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{71324960-0E4B-4011-A49B-35B524854521}"
HKCR\Clsid\{71324960-0E4B-4011-A49B-35B524854521}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrators - Succeeded


Logfile of HijackThis v1.99.1
Scan saved at 12:46:32, on 21/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5450.0004)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ipwins\ipwins.exe
C:\Program Files\Common Files\{E4DFE12F-089A-2067-0617-050419050020}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\TClock\TClock.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\ssoftsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\Downloads and games\Tooltjes\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dexia.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [defender] C:\\dfndrdd_6.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrddd_6.exe
O4 - HKLM\..\Run: [hzud292e] RUNDLL32.EXE w00251fe.dll,n 001d292d0000000a00251fe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global User Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {10093E98-C073-4C75-8D0E-FB5CD3A71D33} (ZoneUpwords Object) - http://messenger.zone.msn.com/binary/Upwords.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/14dc05bbb35aba6c3d05/netzip/RdxIE601.cab
O16 - DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} (PlayerOCX Control) - http://www.pysoft.com/Downloads/WebCamPlayerOCX.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\oeethk32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\user\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Cryptainer service (ssoftservice) - Cypherix - C:\WINDOWS\SYSTEM32\ssoftsrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: User Profile Hive Cleanup (UPHClean) - Unknown owner - C:\Program Files\UPHClean\uphclean.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

* Download Alcanshorty, en plaats het op je bureaublad.

Dubbelklik op alcanshorty_nl om het te installeren.

Open daarna de map alcanshorty_nl , en dubbelklik op run.bat

De ikoontjes op je bureaublad zullen verdwijen en daarna terug verschijnen. Dit is normaal.

Wacht op de "Completed script execution"-boodschap en klik op "OK"

Sluit BFU af door op "EXIT" te klikken.

* * Download en installeer Ewido Anti-Spyware 4.0.

• 
  Na de installatie, open Ewido Anti-Spyware 4.0:
  * onder "Status", klik op Change state naast "Resident shield".
  * onder "Update", klik op de Start update knop.
  * onder "Scanner", tab "Settings":
  • - onder "How to act?", klik op "Recommended actions" en selecteer Quarantine.
    - onder "Reports", selecteer Automatically generate report after every scan en verwijder het vinkje bij Only if threats were found
  Sluit Ewido. Laat het nog niet scannen.

* Als je Adaware SE nog niet geïnstalleerd hebt, download, installeer en update het dan volgens de richtlijnen
die je kan vinden op: http://users.pandora.be/marcvn/spyware/1414188.htm

* Start je computer op in VEILIGE MODUS

* Voer een volledige scan uit met Adaware en verwijder alles wat gevonden wordt.

• open ewido en klik op de Scanner tab bovenaan en klik dan op Complete System Scan. Deze scan zal heel je systeem afcannen dus dit kan een tijdje duren
• Ewido zal alle geïnfecteerde objecten aan de linkerkant tonen. Waneer de scan gedaan is, zal het alles naar de 'Quarantine' optie zetten. klik dan op de Apply all actions knop. Ewido zal dan het volgend bericht tonen aan de rechterkant: "All actions have been applied"
• Klik dan op "Save Report", en dan op "Save Report As". dit zal een rapport maken Wees zeker dat je het rapport makkelijk kunt terugvinden (ijvoorbeeld op je bureaublad).

* start je pc weer normaal

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* post dan een nieuw hijackthis logje hier met het rapport van ewido

kheb het ondertussen kunnen oplossen na wat geprul, dus niet op deze manier (kan dus niet bevestigen of dit in mijn geval werkt), toch bedankt voor de hulp!

Dat geprul kan het misschien erger gemaakt hebben, dus doe de stappen dus toch maar.