Probleem met virus en dll files

[Fred1958uk]

Ik heb sinds kort problemen met mijn PC. Norton heeft succesvol aanvallen afgeslagen van trojans virussen (JUAN?) maar ik blijf problemen houden. Het lijkt erop dat ik op mijn TEMP file en mijn register met dll files zit die er niet thuishoren maar ook niet verwijderd krijg.
Ik kreeg bij openen van Explorer na een paar minuten vier extra schermen die geopend werden met reclame en vragen om bepaalde programma's te installeren ter beveiliging.

In eerste instantie heb ik via hijackthis .de mijn logfile laten scannen en de files verwijderd die als vervelend werden gezien. Deze kwamen echter weer terug of ze wilden niet verwijderd worden.

Ik heb toen Hitman pro laten lopen en via MS config een regel uit het register laten uitschakelen (eindigt op irbnqfvl.dll). ik krijg deze namelijk niet verwijderd via hijackthis.
Op mijn TEMP schijf staat ook een gerelateerde dll die niet verwijderd wil worden:irbnqfvl.dll

en ik krijg ook melding dat WLLoginProxy. exe niet meer werkt.
Bijgaand mij logfile en ook de vraag om hulp.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:30:34, on 13-4-2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\SurfRight\Caretaker\Notifier.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Windows\system32\schtasks.exe
C:\Windows\ehome\ehmsas.exe
C:\hp\kbd\kbd.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
E:\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nu.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_nl&c=81&bd=Pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_nl&c=81&bd=Pavilion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe"
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\Windows\p_981116.exe /Q:A
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CaretakerNotifier] C:\Program Files\SurfRight\Caretaker\Notifier.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BM319d382f] Rundll32.exe "C:\Users\Fred\AppData\Local\Temp\irbnqfvl.dll",s
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL-werkbalk Search - c:\program files\aol\aol toolbar 5.0\resources\nl-NL\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O13 - Gopher Prefix:
O23 - Service: Planner voor Automatische LiveUpdate (Automatic LiveUpdate Scheduler) - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Caretaker Antispam Service (CaretakerAntispam) - SurfRight B.V. - C:\Program Files\SurfRight\Caretaker\AntispamService.exe
O23 - Service: Caretaker Proxy (CaretakerProxy) - SurfRight B.V. - C:\Program Files\SurfRight\Caretaker\CaretakerProxy.exe
O23 - Service: Caretaker Service (CaretakerSvc) - SurfRight B.V. - C:\Program Files\SurfRight\Caretaker\CaretakerService.exe
O23 - Service: Caretaker Updater (CaretakerUpdate) - SurfRight B.V. - C:\Program Files\SurfRight\Caretaker\CaretakerUpdater.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP Chasis Button Service (HPBtnSrv) - Unknown owner - c:\hp\HPEZBTN\HPBtnSrv.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 9661 bytes

[smeenk]

Download ATF cleaner (mirror)(gemaakt door Atribune)

Start de computer in veilige modus.

Rechtsklik Hijackthis.exe en kies voor "Run as administrator"
Start HijackThis nog een keer en plaats alleen een vinkje voor de volgende regels:
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\Windows\p_981116.exe /Q:A
O4 - HKCU\..\Run: [BM319d382f] Rundll32.exe "C:\Users\Fred\AppData\Local\Temp\irbnqfvl.dll",s
Sluit alle open vensters(behalve HijackThis), klik daarna op "Fix checked" en sluit HijackThis af.

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Het volgende doen als je ook FireFox als browser hebt:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit haalt het vinkje weer weg bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Het volgende doen als je ook Opera als browser hebt:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

Herstart je computer in normale modus.

Post een nieuw logje van Hijackthis

[Fred1958uk]

Hier is de nieuwe logfile:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:41:49, on 13-4-2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\SurfRight\Caretaker\Notifier.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\schtasks.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live Toolbar\msn_sl.exe
C:\hp\kbd\kbd.exe
E:\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nu.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_nl&c=81&bd=Pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_nl&c=81&bd=Pavilion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe"
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CaretakerNotifier] C:\Program Files\SurfRight\Caretaker\Notifier.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL-werkbalk Search - c:\program files\aol\aol toolbar 5.0\resources\nl-NL\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O13 - Gopher Prefix:
O23 - Service: Planner voor Automatische LiveUpdate (Automatic LiveUpdate Scheduler) - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Caretaker Antispam Service (CaretakerAntispam) - SurfRight B.V. - C:\Program Files\SurfRight\Caretaker\AntispamService.exe
O23 - Service: Caretaker Proxy (CaretakerProxy) - SurfRight B.V. - C:\Program Files\SurfRight\Caretaker\CaretakerProxy.exe
O23 - Service: Caretaker Service (CaretakerSvc) - SurfRight B.V. - C:\Program Files\SurfRight\Caretaker\CaretakerService.exe
O23 - Service: Caretaker Updater (CaretakerUpdate) - SurfRight B.V. - C:\Program Files\SurfRight\Caretaker\CaretakerUpdater.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP Chasis Button Service (HPBtnSrv) - Unknown owner - c:\hp\HPEZBTN\HPBtnSrv.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

Alvast bedankt voor de controle

[smeenk]

Open kladbok en kopieer en plak het volgende vetgedrukte erin:

regedit /e peek1.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg"
regedit /e peek2.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder"
type peek1.txt >> startup.txt
type peek2.txt >> startup.txt
del peek*.txt
start notepad startup.txt

Bewaar dit als msconfig.bat , kies om op te slaan als *alle bestanden en bewaar het op je bureaublad.
Zo zal het er achteraf uit moeten zien:
Dubbelklik nu op msconfig.bat en een logje zal openen met wat tekst erin, kopieer en plak dit in je volgende post


Download dit bestand: zoek.exe
Dubbelklik het, na een tijdje opent er een logje.
Post de inhoud van dit logje in je volgende bericht

[Fred1958uk]

Na opstarten van msconfig.bat krijg ik de volgende file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BM319d382f]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="BM319d382f"
"hkey"="HKCU"
"command"="Rundll32.exe \"C:\\Users\\Fred\\AppData\\Local\\Temp\\irbnqfvl.dll\",s"
"inimapping"="0"
"YEAR"=dword:000007d8
"MONTH"=dword:00000004
"DAY"=dword:0000000d
"HOUR"=dword:0000000a
"MINUTE"=dword:00000019
"SECOND"=dword:0000000f

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]



Na gebruik van zoek.exe krijg ik het volgende overzicht:

======C:\Windows====
--s-a-w 67,584 2008-04-14 14:54:53 C:\Windows\bootstat.dat
----a-w 90,704 2008-04-09 21:58:54 C:\Windows\DirectX.log
----a-w 4,516 2008-03-30 15:41:57 C:\Windows\DPINST.LOG
----a-w 9,173 2008-04-08 19:07:10 C:\Windows\hpdj3600.bu1
----a-w 208,655 2008-04-08 19:07:10 C:\Windows\hpdj3600.hi1
----a-w 209,925 2008-04-08 19:09:19 C:\Windows\hpdj3600.his
----a-w 9,125 2008-04-08 19:09:19 C:\Windows\hpdj3600.ini
----a-w 261,884 2008-04-10 18:10:45 C:\Windows\msxml4-KB936181-enu.LOG
----a-w 261,114 2008-04-12 01:01:13 C:\Windows\msxml4-KB941833-enu.LOG
----a-w 392 2008-04-14 12:48:10 C:\Windows\ODBC.INI
----a-w 16,348 2008-04-13 17:36:19 C:\Windows\PFRO.log
----a-w 24,125 2008-04-09 22:20:00 C:\Windows\setupact.log
----a-w 240 2008-04-03 06:18:50 C:\Windows\win.ini
----a-w 1,643,034 2008-04-14 12:26:47 C:\Windows\WindowsUpdate.log

Entries: 14 (13)
Directories: 0 Files: 14
Bytes: 2,806,819 Blocks: 5,488
======C:\Windows\system32=====
---ha-w 3,472 2008-04-14 18:54:54 C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
---ha-w 3,472 2008-04-14 18:54:54 C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
----a-w 2,048 2008-03-28 21:43:51 C:\Windows\System32\asferror.dll
----a-w 12,800 2008-03-28 21:45:07 C:\Windows\System32\batt.dll
----a-w 19,456 2008-03-28 21:45:08 C:\Windows\System32\cfgmgr32.dll
----a-w 224,824 2008-03-28 21:45:08 C:\Windows\System32\clfs.sys
----a-w 35,328 2008-03-28 21:45:07 C:\Windows\System32\dispci.dll
----a-w 260,096 2008-03-28 21:45:08 C:\Windows\System32\dpx.dll
----a-w 101,888 2008-03-28 21:45:08 C:\Windows\System32\drvinst.exe
----a-w 300,464 2008-04-10 05:34:04 C:\Windows\System32\FNTCACHE.DAT
----a-w 1,686,528 2008-03-28 21:43:39 C:\Windows\System32\gameux.dll
----a-w 4,247,552 2008-03-28 21:43:40 C:\Windows\System32\GameUXLegacyGDFs.dll
----a-w 6,656 2008-03-28 21:45:07 C:\Windows\System32\kbd106.dll
----a-w 9,728 2008-03-28 21:43:51 C:\Windows\System32\LAPRXY.DLL
----a-w 48,328 2008-03-28 21:26:04 C:\Windows\System32\license.rtf
----a-w 115,200 2008-03-28 21:45:06 C:\Windows\System32\loadperf.dll
----a-w 39,424 2008-03-28 21:45:06 C:\Windows\System32\lodctr.exe
----a-w 1,244,672 2008-03-28 21:40:33 C:\Windows\System32\mcmde.dll
----a-w 19,836,024 2008-04-06 05:56:20 C:\Windows\System32\mrt.exe
----a-w 118 2008-04-09 22:12:12 C:\Windows\System32\MRT.INI
----a-w 188 2008-04-09 22:02:20 C:\Windows\System32\MsiExec.exe.log
----a-w 24,064 2008-03-28 21:44:11 C:\Windows\System32\netcfg.exe
----a-w 22,016 2008-03-28 21:44:11 C:\Windows\System32\netiougc.exe
----a-w 23,552 2008-03-28 21:45:06 C:\Windows\System32\nshhttp.dll
----a-w 3,505,720 2008-03-28 21:44:23 C:\Windows\System32\ntkrnlpa.exe
----a-w 3,471,928 2008-03-28 21:44:23 C:\Windows\System32\ntoskrnl.exe
----a-w 558,080 2008-03-28 21:45:08 C:\Windows\System32\oleaut32.dll
----a-w 103,726 2008-04-14 12:29:09 C:\Windows\System32\perfc009.dat
----a-w 122,590 2008-04-14 12:29:09 C:\Windows\System32\perfc013.dat
----a-w 609,944 2008-04-14 12:29:09 C:\Windows\System32\perfh009.dat
----a-w 689,380 2008-04-14 12:29:09 C:\Windows\System32\perfh013.dat
----a-w 1,515,942 2008-04-14 12:29:09 C:\Windows\System32\PerfStringBackup.INI
----a-w 17,408 2008-03-28 21:45:06 C:\Windows\System32\prflbmsg.dll
----a-w 1,327,104 2008-03-28 21:44:01 C:\Windows\System32\quartz.dll
----a-w 11,776 2008-03-28 21:43:28 C:\Windows\System32\sbunattend.exe
----a-w 595,456 2008-03-28 21:45:06 C:\Windows\System32\schedsvc.dll
----a-w 1,585,664 2008-03-28 21:45:07 C:\Windows\System32\setupapi.dll
----a-w 661 2008-04-14 19:01:33 C:\Windows\System32\startup.txt
----a-w 167,424 2008-03-28 21:44:11 C:\Windows\System32\tcpipcfg.dll
----a-w 2,048 2008-03-28 21:42:45 C:\Windows\System32\tzres.dll
----a-w 221,696 2008-03-28 21:45:08 C:\Windows\System32\umpnpmgr.dll
----a-w 32,256 2008-03-28 21:45:06 C:\Windows\System32\unlodctr.exe
----a-w 2,272 2008-03-29 14:45:51 C:\Windows\System32\w95inf16.dll
----a-w 4,608 2008-03-29 14:45:51 C:\Windows\System32\w95inf32.dll
----a-w 194,560 2008-03-28 21:46:00 C:\Windows\System32\WebClnt.dll
----a-w 905,400 2008-03-28 21:45:06 C:\Windows\System32\winresume.exe
----a-w 223,232 2008-03-28 21:43:51 C:\Windows\System32\WMASF.DLL
----a-w 613,888 2008-03-28 21:45:08 C:\Windows\System32\wpd_ci.dll
----a-w 549,720 2008-03-28 21:28:51 C:\Windows\System32\wuapi.dll
----a-w 31,232 2008-03-28 21:28:38 C:\Windows\System32\wuapp.exe
----a-w 53,080 2008-03-28 21:29:24 C:\Windows\System32\wuauclt.exe
----a-w 1,712,984 2008-03-28 21:29:24 C:\Windows\System32\wuaueng.dll
----a-w 1,524,224 2008-03-28 21:29:24 C:\Windows\System32\wucltux.dll
----a-w 80,896 2008-03-28 21:28:51 C:\Windows\System32\wudriver.dll
----a-w 33,624 2008-03-28 21:28:51 C:\Windows\System32\wups.dll
----a-w 43,352 2008-03-28 21:29:24 C:\Windows\System32\wups2.dll
----a-w 163,000 2008-03-28 21:28:38 C:\Windows\System32\wuwebv.dll

Entries: 57 (55)
Directories: 0 Files: 57
Bytes: 48,942,773 Blocks: 95,604
======C:\Windows\system32\drivers=====
--sha-r 1,867 2008-03-28 21:32:55 C:\Windows\System32\drivers\103C_HP_CPC_KE465AA-ABH m9190.nl_YC_0Pavi_QCZH804_E81NLv3PrA2_49_IBenicia_SASUSTeK Computer INC._V1.01_B5.17_T080117_WUH0_L413_M3071_J250_7Intel_8Core2 Quad Q6600_92.4_#080328_N10EC8168_Z_G10DE0611.MRK
----a-w 54,784 2008-03-28 21:45:07 C:\Windows\System32\drivers\i8042prt.sys
----a-w 35,384 2008-03-28 21:45:07 C:\Windows\System32\drivers\kbdclass.sys
----a-w 15,872 2008-03-28 21:45:07 C:\Windows\System32\drivers\kbdhid.sys
----a-w 41,984 2008-03-28 21:44:36 C:\Windows\System32\drivers\monitor.sys
----a-w 34,360 2008-03-28 21:45:07 C:\Windows\System32\drivers\mouclass.sys
----a-w 15,872 2008-03-28 21:45:07 C:\Windows\System32\drivers\mouhid.sys
----a-w 110,080 2008-03-28 21:46:00 C:\Windows\System32\drivers\mrxdav.sys
----a-w 101,888 2008-03-28 21:43:07 C:\Windows\System32\drivers\mrxsmb.sys
----a-w 58,368 2008-03-28 21:43:07 C:\Windows\System32\drivers\mrxsmb20.sys
----a-w 216,632 2008-03-28 21:44:11 C:\Windows\System32\drivers\netio.sys
----a-w 1,060,920 2008-03-28 21:44:36 C:\Windows\System32\drivers\ntfs.sys
----a-w 154,624 2008-03-28 21:44:23 C:\Windows\System32\drivers\nwifi.sys
----a-w 19,968 2008-03-28 21:45:07 C:\Windows\System32\drivers\sermouse.sys
----a-w 130,048 2008-03-28 21:43:07 C:\Windows\System32\drivers\srv2.sys
----a-w 84,992 2008-03-28 21:43:07 C:\Windows\System32\drivers\srvnet.sys
----a-w 10,740 2008-03-29 10:16:59 C:\Windows\System32\drivers\SYMEVENT.CAT
----a-w 805 2008-03-29 10:16:59 C:\Windows\System32\drivers\SYMEVENT.INF
----a-w 123,952 2008-03-29 10:16:59 C:\Windows\System32\drivers\SYMEVENT.SYS
----a-w 803,328 2008-03-28 21:44:11 C:\Windows\System32\drivers\tcpip.sys
----a-w 211,000 2008-03-28 21:44:23 C:\Windows\System32\drivers\volsnap.sys
----a-w 495,160 2008-03-28 21:45:07 C:\Windows\System32\drivers\Wdf01000.sys
----a-w 35,384 2008-03-28 21:45:07 C:\Windows\System32\drivers\WdfLdr.sys

Entries: 23 (22)
Directories: 0 Files: 23
Bytes: 3,818,012 Blocks: 7,465
=======C:\Program Files=====
Entries: 0 (0)
Directories: 0 Files: 0
Bytes: 0 Blocks: 0
=======C:=====
--sha-w 3,220,480,000 2008-04-14 12:23:47 C:\hiberfil.sys
--sha-w 3,534,422,016 2008-04-14 12:23:45 C:\pagefile.sys

Entries: 2 (0)
Directories: 0 Files: 2
Bytes: 6,754,902,016 Blocks: 13,193,168
======C:\Users\Fred\AppData\Roaming======
Entries: 0 (0)
Directories: 0 Files: 0
Bytes: 0 Blocks: 0
======C:\Temp======
Entries: 0 (0)
Directories: 0 Files: 0
Bytes: 0 Blocks: 0
======C:\Users\Fred======
----a-w 1,024 2008-04-09 22:02:16 C:\Users\Fred\.rnd
----a-w 7,734 2008-04-12 11:46:05 C:\Users\Fred\hijackthis.log
--sha-w 3,145,728 2008-04-13 07:34:49 C:\Users\Fred\NTUSER.bak
----a-w 3,145,728 2008-04-14 19:03:02 C:\Users\Fred\NTUSER.DAT
---ha-w 262,144 2008-04-14 19:03:02 C:\Users\Fred\ntuser.dat.LOG1
---ha-w 0 2008-03-28 21:31:51 C:\Users\Fred\ntuser.dat.LOG2
--sha-w 65,536 2008-04-11 12:57:59 C:\Users\Fred\NTUSER.DAT{2aa56b62-07a0-11dd-a105-001e8c98d84a}.TM.blf
--sha-w 524,288 2008-04-11 12:57:59 C:\Users\Fred\NTUSER.DAT{2aa56b62-07a0-11dd-a105-001e8c98d84a}.TMContainer00000000000000000001.regtrans-ms
--sha-w 524,288 2008-04-11 12:57:59 C:\Users\Fred\NTUSER.DAT{2aa56b62-07a0-11dd-a105-001e8c98d84a}.TMContainer00000000000000000002.regtrans-ms
--sha-w 65,536 2008-03-28 21:47:02 C:\Users\Fred\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
--sha-w 524,288 2008-04-09 22:19:43 C:\Users\Fred\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
--sha-w 524,288 2008-03-28 21:47:02 C:\Users\Fred\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
--sha-w 65,536 2008-04-13 07:40:58 C:\Users\Fred\NTUSER.DAT{9a96f0c2-0927-11dd-962b-001e8c98d84a}.TM.blf
--sha-w 524,288 2008-04-13 07:40:58 C:\Users\Fred\NTUSER.DAT{9a96f0c2-0927-11dd-962b-001e8c98d84a}.TMContainer00000000000000000001.regtrans-ms
--sha-w 524,288 2008-04-13 07:40:58 C:\Users\Fred\NTUSER.DAT{9a96f0c2-0927-11dd-962b-001e8c98d84a}.TMContainer00000000000000000002.regtrans-ms
--sh--w 20 2008-03-28 21:31:51 C:\Users\Fred\ntuser.ini
---ha-w 262,144 2008-04-13 07:34:11 C:\Users\Fred\NTUSER.tmp.LOG1
---ha-w 0 2008-04-13 07:34:11 C:\Users\Fred\NTUSER.tmp.LOG2

Entries: 18 (3)
Directories: 0 Files: 18
Bytes: 10,166,858 Blocks: 19,859
======C:\Windows\Downloaded Program Files====
----a-w 144 2008-03-19 17:36:24 C:\Windows\Downloaded Program Files\swdir.inf

Entries: 1 (1)
Directories: 0 Files: 1
Bytes: 144 Blocks: 1
=============

[smeenk]

Ik zie geen foute dingen in het logje

1) Open een kladblokbestand.
2) Kopieer onderstaande code in dit kladblokbestand.
3) Ga naar Bestand - Opslaan als.
-Bij "Opslaan in" kies je: Bureaublad
-Bij "Bestandsnaam" zet je: fix.reg
-Bij "Opslaan als type" selecteer je: Alle bestanden (*.*).
-Klik op de knop Opslaan.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BM319d382f]

4) Dubbelklik op de fix.reg file en laat de wijzigingen aan het register toevoegen.


Download ATF cleaner (mirror)(gemaakt door Atribune)

Belangrijk: Sluit al je browservensters(IE en/of Firefox en/of Opera) om de tool goed te kunnen laten werken.

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Het volgende doen als je ook FireFox als browser hebt:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit haalt het vinkje weer weg bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Het volgende doen als je ook Opera als browser hebt:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

Schakel Systeemherstel uit. Herstart de computer. Schakel Systeemherstel weer in.
Kijk hier hoe je je systeemherstel moet uitschakelen.
Hiermee verwijder je eventuele restanten van de infecties uit je systeemherstel.

Dan denk ik dat alles weer OK is

[Fred1958uk]

hartstikke bedankt voor je hulp.

Fred

[smeenk]

Graag gedaan hoor