Mededeling

Collapse
No announcement yet.

HijackThis log na TEveel spyware

Collapse
X
Collapse
  •  
  • Page of 1
  • Tijd
  • Show
Clear All
new posts
Vorige template Volgende
  • #1

    HijackThis log na TEveel spyware

    Hieronder de log van m'n broertjes pc, eerst gescand met spybot (175 resultaten) en daarna met Adware (950 resultaten). Logje gemaakt,zie hieronder, wil iemand hier naar kijken, wordt gek van alle troep op de pc. Bij voorbaat dank,
    Japsur

    PS> de nieuwste versie vloog er telkens uit, daarom heb ik maar met de 1.92.2 gescand. Hoop dat dat ook goed is!

    Logfile:

    Logfile of HijackThis v1.98.2
    Scan saved at 11:59:51, on 24-12-2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
    C:\Program Files\Logitech\ImageStudio\LogiTray.exe
    C:\Program Files\Logitech\iTouch\iTouch.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\MSN Messenger\MsgPlus.exe
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    C:\WINDOWS\ewupdater.exe
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\System32\cisvc.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\PROGRA~1\Toolbar\TBPS.exe
    C:\WINDOWS\isrvs\desktop.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\PROGRA~1\Toolbar\PIB.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\WinTools\WSup.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\Documents and Settings\Herwin Voortman\Local Settings\Temporary Internet Files\Content.IE5\6AK3VWFP\HijackThis19802[1].exe
    C:\Program Files\Common Files\WinTools\WToolsA.exe
    c:\progra~1\intern~1\iexplore.exe
    C:\WINDOWS\explorer.exe
    C:\PROGRA~1\Toolbar\TBPSSvc.exe
    C:\Program Files\Common Files\WinTools\WToolsS.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Terms=
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.qdoaudzfcxheddeitbitje.com/OCJrlIFCR0Pj/QLVeedcx3/le_AC4x/IEQBToTqy/YIhkm9mD24BxEeFY0xnbyQd.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.seekerbar.com/ie.aspx?tb_id=50154
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.easywebsearch.nl
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.easywebsearch.nl
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.seekerbar.com/ie.aspx?tb_id=50154
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
    O2 - BHO: (no name) - SOFTWARE - (no file)
    O2 - BHO: (no name) - {2BBB8C5E-942A-B76C-6E13-39AFD41C4455} - C:\DOCUME~1\HERWIN~1\APPLIC~1\Liteante\MAILFORD.exe
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
    O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
    O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: C:\WINDOWS\lbbho.dll - {B5CA7C7C-A99B-475E-9AA1-3A8C884E1F96} - C:\WINDOWS\lbbho.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)
    O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
    O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
    O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MSN Messenger\MsgPlus.exe"
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe
    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
    O4 - HKLM\..\Run: [redirect] C:\windows\redirect7.exe
    O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
    O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
    O4 - HKLM\..\Run: [CSV7P88] C:\Program Files\CSBB\CSV7P88.exe
    O4 - HKLM\..\Run: [WebRebates0] C:\Program Files\Web_Rebates\WebRebates0.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
    O4 - HKLM\..\Run:[Listflawtraycool] C:\Documents and Settings\All Users\Application Data\Coal bolt list flaw\DASH DOES.exe
    O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
    O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
    O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MSN Messenger\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
    O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
    O4 - HKCU\..\Run: [areslite] "C:\My Shared Folder\AresLite.exe" -h
    O4 - HKCU\..\Run: [camp dent] C:\DOCUME~1\HERWIN~1\APPLIC~1\MFCDHO~1\Atom Joy.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Tsa2] C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
    O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - http://toolbar.isearch.com/general/drm.cab
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.8.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {3F2705D0-C9D8-4020-A15C-E495A0050EC6} (Easywebinstaller Control) - http://s7.blingblingcontent.com/toolbarcash/activex/easywebinstaller.ocx
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-nl/nl/games7.cab
    O16 - DPF: {99802379-7362-40E2-9D28-8A3B9AF880B7} - http://hotsearchbar.com/toolbar2/winhot32.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
    O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
    Labels: Geen
      • Citaat
    • #2
      Hi Japsur,

      PS> de nieuwste versie vloog er telkens uit, daarom heb ik maar met de 1.92.2 gescand. Hoop dat dat ook goed is!
      Hmmm.... Probeer steeds of je kan scannen met 1.99. En plaats een log wanneer dat mogelijk is.

      Verplaats HijackThis, bij voorkeur naar c:\Program Files\HijackThis. Overal is goed, behalve je Bureaublad of een tijdelijke map. Als HijackThis in een tijdelijke map loop je het risico dat backups verwijderd worden, en het Bureaublad wordt anders een puinhoop met alle backups.
      Als je Windows XP gebruikt, kan het zijn dat je hebt dubbelgeklikt op het bestand HijackThis.exe. Dan wordt het programma uitgepakt naar en tijdelijke map. Selecteer het bestand pak het uit.

      Hoe maak je een nieuwe map:

      Klik op "Mijn Computer", dan "C:\" en op "Program Files".
      Uit het menu kies "Bestand"->"Nieuw"->"Map"
      Dat maakt een map met de naam "Nieuwe map", die je kan hernoemen tot "HJT" of "HijackThis"
      Nu heb je "C:\Program Files\HijackThis". Plaats HijackThis.exe daar.

      Open het Configuratiescherm, dan "Software" en "Programma's wijzigen of verwijderen". Selecteer de volgende onderdelen en klik op "Verwijderen" voor elk van deze:
      • WinTools
      • MessengerPlus. <-- Indien je dit programma wilt gebruiken installer het dan zonder sponsors. Deze sponsor is nl. LOP.
      • TV Media


      Het is handig om deze pagina op te slaan in je favorieten zodat je deze makkelijker kan vinden wanneer je terugkomt.

      Start HijackThis, klik op "Scan" and kruis de volgende onderdelen aan.

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.isearch.com/index.php?app...DQ6NTo5&Terms=
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.seekerbar.com/ie.aspx?tb_id=50154
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.easywebsearch.nl
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.easywebsearch.nl
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.seekerbar.com/ie.aspx?tb_id=50154

      R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll

      O2 - BHO: (no name) - SOFTWARE - (no file)
      O2 - BHO: (no name) - {2BBB8C5E-942A-B76C-6E13-39AFD41C4455} - C:\DOCUME~1\HERWIN~1\APPLIC~1\Liteante\MAILFORD.exe
      O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
      O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
      O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
      O2 - BHO: C:\WINDOWS\lbbho.dll - {B5CA7C7C-A99B-475E-9AA1-3A8C884E1F96} - C:\WINDOWS\lbbho.dll

      O3 - Toolbar: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)
      O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll

      O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
      O4 - HKLM\..\Run: [redirect] C:\windows\redirect7.exe
      O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
      O4 - HKLM\..\Run: [CSV7P88] C:\Program Files\CSBB\CSV7P88.exe
      O4 - HKLM\..\Run: [WebRebates0] C:\Program Files\Web_Rebates\WebRebates0.exe
      O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
      O4 - HKLM\..\Run:[Listflawtraycool] C:\Documents and Settings\All Users\Application Data\Coal bolt list flaw\DASH DOES.exe
      O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
      O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
      O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
      O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
      O4 - HKCU\..\Run: [camp dent] C:\DOCUME~1\HERWIN~1\APPLIC~1\MFCDHO~1\Atom Joy.exe
      O4 - HKCU\..\Run: [Tsa2] C:\PROGRA~1\COMMON~1\tsa\tsm2.exe

      O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm

      O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - http://toolbar.isearch.com/general/drm.cab
      O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache...tup1.0.0.8.cab
      O16 - DPF: {3F2705D0-C9D8-4020-A15C-E495A0050EC6} (Easywebinstaller Control) - http://s7.blingblingcontent.com/tool...binstaller.ocx
      O16 - DPF: {99802379-7362-40E2-9D28-8A3B9AF880B7} - http://hotsearchbar.com/toolbar2/winhot32.cab

      O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll

      Sluit alle programma's, inclusief browsers, behalve HijackThis. Klik op "Fix checked".

      Start je computer in beveiligde modus. Hoe start ik mijn computer in veilige modus?

      Zorg dat je verborgen bestanden kan zien. Hoe toon ik verborgen bestanden?

      Mappen en bestanden met een tilde (~) betekenen dat er een map/bestand is dat begint met de 6 letters voor de tilde, houdt rekening ermee dat er spaties in kunnen staan. Als er meer dan één is, post dan wat gevonden is. Verwijder niet!

      Verwijder de volgende bestanden in rood (het kan zijn dat ze al verwijderd zijn):

      C:\WINDOWS\lbbho.dll
      C:\WINDOWS\ewupdater.exe
      C:\windows\redirect7.exe

      Verwijder de volgende mappen in rood (het kan zijn dat deze al verwijderd zijn):

      C:\Program Files\Common Files\WinTools
      C:\Documents and Settings\HERWIN~1\Application Data\Liteante
      C:\WINDOWS\isrvs
      C:\Program Files\Toolbar
      C:\Program Files\TV Media
      C:\Program Files\CSBB
      C:\Program Files\Web_Rebates
      C:\Documents and Settings\All Users\Application Data\Coal bolt list flaw
      C:\Documents and Settings\HERWIN~1\Application Data\MFCDHO~1
      C:\Program Files\Common Files\tsa

      Herstart de computer en post een nieuwe log in deze thread.
        • Citaat

        Comment

        • #3
          Sorry

          Ik kan nog steeds niet de nieuwe versie gebruiken.
          Heb de programma's verwijderd> msn plus 3, tvmedia en wintools

          Maar nu wil ik hijackthis het een en ander wat je zegt eruit gooien, maar het merendeel staat er niet meer tussen en zijn er anderen komen te staan
          Dus ik plaats maar even een nieuwe logfile.

          Logfile of HijackThis v1.98.2
          Scan saved at 17:04:58, on 24-12-2004
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
          C:\WINDOWS\System32\cisvc.exe
          C:\Program Files\Norton AntiVirus\navapsvc.exe
          C:\Program Files\Norton AntiVirus\SAVScan.exe
          C:\WINDOWS\System32\snmp.exe
          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          C:\WINDOWS\System32\svchost.exe
          C:\PROGRA~1\Toolbar\TBPSSvc.exe
          C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
          C:\WINDOWS\Explorer.EXE
          C:\PROGRA~1\Toolbar\TBPS.exe
          C:\PROGRA~1\Toolbar\PIB.exe
          C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
          C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
          C:\Program Files\Logitech\ImageStudio\LogiTray.exe
          C:\Program Files\Logitech\iTouch\iTouch.exe
          C:\Program Files\Common Files\Symantec Shared\ccApp.exe
          C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
          C:\Program Files\Logitech\MouseWare\system\em_exec.exe
          C:\WINDOWS\ewupdater.exe
          C:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
          C:\Program Files\Winamp\winampa.exe
          C:\WINDOWS\isrvs\desktop.exe
          C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
          C:\My Shared Folder\AresLite.exe
          C:\Program Files\Messenger\msmsgs.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\WINDOWS\system32\cidaemon.exe
          C:\Program Files\HijackThis\hijackthis\HijackThis.exe

          R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Terms=
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gdtfvzdasvposuznqgpecdjby.com/OCJrlIFCR0Pj/QLVeedcx3/le_AC4x/IEQBToTqy/YK3AJXNLxctvEeFY0xnbyQd.htm
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.easywebsearch.nl
          R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.easywebsearch.nl
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
          R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - C:\Program Files\TV Media\TvmBho.dll (file missing)
          O2 - BHO: (no name) - SOFTWARE - (no file)
          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
          O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
          O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
          O2 - BHO: C:\WINDOWS\lbbho.dll - {B5CA7C7C-A99B-475E-9AA1-3A8C884E1F96} - C:\WINDOWS\lbbho.dll
          O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
          O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
          O3 - Toolbar: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)
          O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll
          O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
          O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
          O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
          O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
          O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
          O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
          O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
          O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
          O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe
          O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
          O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
          O4 - HKLM\..\Run: [redirect] C:\windows\redirect7.exe
          O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
          O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
          O4 - HKLM\..\Run: [CSV7P88] C:\Program Files\CSBB\CSV7P88.exe
          O4 - HKLM\..\Run: [WebRebates0] C:\Program Files\Web_Rebates\WebRebates0.exe
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
          O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
          O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
          O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
          O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
          O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
          O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
          O4 - HKCU\..\Run: [areslite] "C:\My Shared Folder\AresLite.exe" -h
          O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
          O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
          O4 - HKCU\..\Run: [Tsa2] C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
          O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
          O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
          O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
          O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
          O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
          O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
          O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
          O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - http://toolbar.isearch.com/general/drm.cab
          O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.8.cab
          O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
          O16 - DPF: {3F2705D0-C9D8-4020-A15C-E495A0050EC6} (Easywebinstaller Control) - http://s7.blingblingcontent.com/toolbarcash/activex/easywebinstaller.ocx
          O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
          O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-nl/nl/games7.cab
          O16 - DPF: {99802379-7362-40E2-9D28-8A3B9AF880B7} - http://hotsearchbar.com/toolbar2/winhot32.cab
          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
          O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
          O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
            • Citaat

            Comment

            • #4
              Hi Japsur

              Start HijackThis, klik op "Scan" and kruis de volgende onderdelen aan.

              R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.isearch.com/index.php?app...DQ6NTo5&Terms=
              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gdtfvzdasvposuznqgpecdjby...eFY0xnbyQd.htm
              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.easywebsearch.nl
              R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.easywebsearch.nl

              R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - C:\Program Files\TV Media\TvmBho.dll (file missing)
              O2 - BHO: (no name) - SOFTWARE - (no file)
              O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
              O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
              O2 - BHO: C:\WINDOWS\lbbho.dll - {B5CA7C7C-A99B-475E-9AA1-3A8C884E1F96} - C:\WINDOWS\lbbho.dll

              O3 - Toolbar: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)
              O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll

              O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
              O4 - HKLM\..\Run: [redirect] C:\windows\redirect7.exe
              O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
              O4 - HKLM\..\Run: [CSV7P88] C:\Program Files\CSBB\CSV7P88.exe
              O4 - HKLM\..\Run: [WebRebates0] C:\Program Files\Web_Rebates\WebRebates0.exe
              O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
              O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
              O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
              O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
              O4 - HKCU\..\Run: [Tsa2] C:\PROGRA~1\COMMON~1\tsa\tsm2.exe

              O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm

              O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - http://toolbar.isearch.com/general/drm.cab
              O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache...tup1.0.0.8.cab
              O16 - DPF: {3F2705D0-C9D8-4020-A15C-E495A0050EC6} (Easywebinstaller Control) - http://s7.blingblingcontent.com/tool...binstaller.ocx
              O16 - DPF: {99802379-7362-40E2-9D28-8A3B9AF880B7} - http://hotsearchbar.com/toolbar2/winhot32.cab

              O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll

              Sluit alle programma's, inclusief browsers, behalve HijackThis. Klik op "Fix checked".

              Start je computer in beveiligde modus. Hoe start ik mijn computer in veilige modus?

              Zorg dat je verborgen bestanden kan zien. Hoe toon ik verborgen bestanden?

              Mappen en bestanden met een tilde (~) betekenen dat er een map/bestand is dat begint met de 6 letters voor de tilde, houdt rekening ermee dat er spaties in kunnen staan. Als er meer dan één is, post dan wat gevonden is. Verwijder niet!

              Verwijder de volgende bestanden in rood (het kan zijn dat ze al verwijderd zijn):

              C:\WINDOWS\lbbho.dll
              C:\WINDOWS\ewupdater.exe
              C:\windows\redirect7.exe

              Verwijder de volgende mappen in rood (het kan zijn dat deze al verwijderd zijn):

              C:\Program Files\TV Media
              C:\WINDOWS\isrvs
              C:\Program Files\Toolbar
              C:\Program Files\CSBB
              C:\Program Files\Web_Rebates
              C:\Program Files\Common Files\tsa

              Herstart de computer en post een nieuwe log in deze thread.
                • Citaat

                Comment

                • #5
                  Ok, hier na bijwerkingen van de pc m'n nieuwe logfile.

                  Logfile of HijackThis v1.98.2
                  Scan saved at 10:56:55, on 26-12-2004
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                  C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
                  C:\Program Files\Logitech\ImageStudio\LogiTray.exe
                  C:\Program Files\Logitech\iTouch\iTouch.exe
                  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
                  C:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
                  C:\Program Files\Winamp\winampa.exe
                  C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                  C:\Program Files\Logitech\MouseWare\system\em_exec.exe
                  C:\My Shared Folder\AresLite.exe
                  C:\Program Files\MSN Messenger\msnmsgr.exe
                  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
                  C:\Program Files\Messenger\msmsgs.exe
                  C:\WINDOWS\System32\cisvc.exe
                  C:\Program Files\Norton AntiVirus\navapsvc.exe
                  C:\Program Files\Norton AntiVirus\SAVScan.exe
                  C:\WINDOWS\System32\snmp.exe
                  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\WINDOWS\system32\wuauclt.exe
                  C:\Program Files\HijackThis\hijackthis\HijackThis.exe

                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
                  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
                  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                  O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)
                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                  O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
                  O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
                  O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
                  O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
                  O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
                  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                  O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
                  O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe
                  O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
                  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
                  O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
                  O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
                  O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
                  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                  O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
                  O4 - HKCU\..\Run: [areslite] "C:\My Shared Folder\AresLite.exe" -h
                  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                  O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
                  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
                  O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
                  O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
                  O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
                  O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
                  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                  O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-nl/nl/games7.cab
                  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
                  O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
                  O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
                    • Citaat

                    Comment

                    • #6
                      Hi Japsur,

                      Doet 1.99 het ondertussen?

                      Start HijackThis, klik op "Scan" and kruis de volgende onderdelen aan.

                      O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)

                      O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
                      O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe

                      O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll

                      Sluit alle programma's, inclusief browsers, behalve HijackThis. Klik op "Fix checked".

                      Start je computer in beveiligde modus. Hoe start ik mijn computer in veilige modus?

                      Zorg dat je verborgen bestanden kan zien. Hoe toon ik verborgen bestanden?

                      Verwijder de volgende mappen in rood (het kan zijn dat deze al verwijderd zijn):

                      C:\WINDOWS\isrvs
                      C:\PROGRAM FILES\Toolbar

                      Herstart de computer en post een nieuwe log in deze thread.

                      Download ServiceFilter van Rand1038. Pak dit uit naar een map als c:\ServiceFilter. Dubbelklik op ServiceFilter.vbs. Dit maakt een bestand aan genaamd Post_This.txt. Kopieer en plak de inhoud van dit bestand in een volgende post.
                        • Citaat

                        Comment

                        • #7
                          Hier m'n logfile na verbeteringen met de NIEUWSTE versie, deze werkte dus nu wel.

                          Ik kon: C:\WINDOWS\isrvs niet vinden in veilige modus incl. verborgen bestanden (de eerste keer ook al niet), ik zie nu zelf dat ie er weer tussen staat. Maar goed, m'n nieuwe log:


                          Logfile of HijackThis v1.99.0
                          Scan saved at 9:49:05, on 27-12-2004
                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
                          C:\WINDOWS\System32\cisvc.exe
                          C:\Program Files\Norton AntiVirus\navapsvc.exe
                          C:\Program Files\Norton AntiVirus\SAVScan.exe
                          C:\WINDOWS\System32\snmp.exe
                          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                          C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
                          C:\Program Files\Logitech\ImageStudio\LogiTray.exe
                          C:\Program Files\Logitech\iTouch\iTouch.exe
                          C:\Program Files\Common Files\Symantec Shared\ccApp.exe
                          C:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
                          C:\Program Files\Logitech\MouseWare\system\em_exec.exe
                          C:\Program Files\Winamp\winampa.exe
                          C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                          C:\My Shared Folder\AresLite.exe
                          C:\Program Files\MSN Messenger\msnmsgr.exe
                          C:\Program Files\Messenger\msmsgs.exe
                          C:\Program Files\Internet Explorer\iexplore.exe
                          C:\WINDOWS\system32\cidaemon.exe
                          C:\Program Files\HijackThis\hijackthis99.exe

                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
                          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
                          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                          O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)
                          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                          O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                          O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                          O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                          O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
                          O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
                          O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
                          O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
                          O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
                          O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                          O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
                          O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe
                          O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
                          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                          O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
                          O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
                          O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
                          O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                          O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
                          O4 - HKCU\..\Run: [areslite] "C:\My Shared Folder\AresLite.exe" -h
                          O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                          O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
                          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                          O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                          O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
                          O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
                          O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
                          O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
                          O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
                          O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                          O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                          O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-nl/nl/games7.cab
                          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
                          O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
                          O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
                          O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
                          O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
                          O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
                          O23 - Service: Norton AntiVirus Auto-Protect - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
                          O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
                          O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
                          O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                          O23 - Service: Sony SPTI Service - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
                          O23 - Service: WebSeach Toolbar support NT service - Unknown - C:\PROGRA~1\Toolbar\TBPSSvc.exe (file missing)
                            • Citaat

                            Comment

                            • #8
                              Hi Japsur,

                              Ik kon: C:\WINDOWS\isrvs niet vinden in veilige modus incl. verborgen bestanden (de eerste keer ook al niet), ik zie nu zelf dat ie er weer tussen staat.
                              Heb je ook het vinkje voor "Beveiligde besturingssysteembestanden vebergen (aanbevolen)" weggehaald?

                              Start HijackThis, klik op "Scan" and kruis de volgende onderdelen aan.

                              O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)

                              O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
                              O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe

                              O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-nl/nl/games7.cab

                              O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll

                              O23 - Service: WebSeach Toolbar support NT service - Unknown - C:\PROGRA~1\Toolbar\TBPSSvc.exe (file missing)

                              Sluit alle programma's, inclusief browsers, behalve HijackThis. Klik op "Fix checked".

                              Start je computer in beveiligde modus. Hoe start ik mijn computer in veilige modus?

                              Zorg dat je verborgen bestanden kan zien. Hoe toon ik verborgen bestanden?

                              Verwijder de volgende mappen in rood (het kan zijn dat deze al verwijderd zijn):

                              C:\WINDOWS\isrvs
                              C:\PROGRAM FILES\Toolbar

                              Herstart de computer en post een nieuwe log in deze thread.
                                • Citaat

                                Comment

                                • #9
                                  Oorspronkelijk geplaatst door Bobbi Flekman
                                  Verwijder de volgende mappen in rood (het kan zijn dat deze al verwijderd zijn):

                                  C:\WINDOWS\isrvs
                                  C:\PROGRAM FILES\Toolbar
                                  De eerste kan al helemaal niet vinden op de gehele pc. En de onderste heb ik niet in die map gevonden, maar in C:\Program Files\PowerSearch\Toolbar

                                  Verder wat moet ik met mappen in program files waar staat ... search als naam. In die mappen staat nie veel bijzonders, maar toch lijkt het op spyware.

                                  Hier m'n verdere logfile:

                                  Logfile of HijackThis v1.99.0
                                  Scan saved at 12:13:38, on 27-12-2004
                                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                                  Running processes:
                                  C:\WINDOWS\System32\smss.exe
                                  C:\WINDOWS\system32\winlogon.exe
                                  C:\WINDOWS\system32\services.exe
                                  C:\WINDOWS\system32\lsass.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\WINDOWS\system32\spoolsv.exe
                                  C:\WINDOWS\Explorer.EXE
                                  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                  C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
                                  C:\Program Files\Logitech\ImageStudio\LogiTray.exe
                                  C:\Program Files\Logitech\iTouch\iTouch.exe
                                  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
                                  C:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
                                  C:\Program Files\Winamp\winampa.exe
                                  C:\Program Files\Logitech\MouseWare\system\em_exec.exe
                                  C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                                  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
                                  C:\My Shared Folder\AresLite.exe
                                  C:\Program Files\MSN Messenger\msnmsgr.exe
                                  C:\Program Files\Messenger\msmsgs.exe
                                  C:\WINDOWS\System32\cisvc.exe
                                  C:\Program Files\Norton AntiVirus\navapsvc.exe
                                  C:\Program Files\Norton AntiVirus\SAVScan.exe
                                  C:\WINDOWS\System32\snmp.exe
                                  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
                                  C:\Program Files\Internet Explorer\iexplore.exe
                                  C:\WINDOWS\system32\wuauclt.exe
                                  C:\Program Files\HijackThis\hijackthis99.exe

                                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
                                  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
                                  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                  O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)
                                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                                  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                                  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                                  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                  O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
                                  O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
                                  O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
                                  O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
                                  O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
                                  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                                  O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
                                  O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe
                                  O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
                                  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                                  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
                                  O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
                                  O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
                                  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                                  O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
                                  O4 - HKCU\..\Run: [areslite] "C:\My Shared Folder\AresLite.exe" -h
                                  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                                  O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
                                  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                                  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                                  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                                  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
                                  O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
                                  O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
                                  O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
                                  O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
                                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                  O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
                                  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                                  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                                  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
                                  O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
                                  O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
                                  O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
                                  O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
                                  O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
                                  O23 - Service: Norton AntiVirus Auto-Protect - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
                                  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
                                  O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
                                  O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                                  O23 - Service: Sony SPTI Service - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe

                                  Alvast bedankt!
                                    • Citaat

                                    Comment

                                    • #10
                                      Hi Japsur,

                                      De eerste kan al helemaal niet vinden op de gehele pc. En de onderste heb ik niet in die map gevonden, maar in C:\Program Files\PowerSearch\Toolbar
                                      Voer je wel de rest van mijn instrukties uit? Anders weet ik niet of er een herinfectie plaatsvindt of niet...

                                      Verder wat moet ik met mappen in program files waar staat ... search als naam. In die mappen staat nie veel bijzonders, maar toch lijkt het op spyware.
                                      Welke mappen zijn dat en wat staat er in?

                                      Start HijackThis, klik op "Scan" and kruis de volgende onderdelen aan.

                                      O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)

                                      O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
                                      O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe

                                      O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll

                                      Sluit alle programma's, inclusief browsers, behalve HijackThis. Klik op "Fix checked".

                                      Start je computer in beveiligde modus. Hoe start ik mijn computer in veilige modus?

                                      Zorg dat je verborgen bestanden kan zien. Hoe toon ik verborgen bestanden?

                                      Verwijder de volgende bestanden in rood (het kan zijn dat ze al verwijderd zijn):

                                      Verwijder de volgende mappen in rood (het kan zijn dat deze al verwijderd zijn):

                                      C:\WINDOWS\isrvs

                                      Herstart de computer en post een nieuwe log in deze thread.


                                      Start Kladblok, kopieer en plak de tekst in het vak in een nieuw tekstbestand. Sla dit op als map.bat op je Bureaublad.

                                      Code:
                                      dir c:\Windows\i* /a h /a s > map.txt
notepad map.txt
                                      Zoek map.bat op je Bureaublad en dubbelklik hierop. Kladblok zal openen met wat tekst erin. Kan je dat posten.
                                        • Citaat

                                        Comment

                                        • #11
                                          Nou, ik kan je verzekeren dat ik exact doe wat je zegt, maar zoals ik al zei de map C:\Windows\isrvs is er niet en dat is het rare, zie het map.bat bestandje.

                                          Verder staat er dit in program files dit zo'n beetje:

                                          Program Files\ClearSearch >
                                          bin bestanden
                                          neromediaplayer mediafiles
                                          toepassingen > csAOLldr en FNuninstaller
                                          toepassinguitbreiding bestanden

                                          Program Files\IncredFind\BHO > date (textdoc)

                                          Program Files\iSearch FireFox Installer
                                          Uninst > textdoc
                                          uninst > toepassing

                                          Program Files\PowerSearch\Toolbar = leeg

                                          Program Files\SimpelInternet = leeg

                                          Dit is dus m'n nieuwe logfile (zelfde als de vorige geloof ik):

                                          Logfile of HijackThis v1.99.0
                                          Scan saved at 11:08:12, on 28-12-2004
                                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                                          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                                          Running processes:
                                          C:\WINDOWS\System32\smss.exe
                                          C:\WINDOWS\system32\winlogon.exe
                                          C:\WINDOWS\system32\services.exe
                                          C:\WINDOWS\system32\lsass.exe
                                          C:\WINDOWS\system32\svchost.exe
                                          C:\WINDOWS\System32\svchost.exe
                                          C:\WINDOWS\system32\spoolsv.exe
                                          C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
                                          C:\WINDOWS\System32\cisvc.exe
                                          C:\Program Files\Norton AntiVirus\navapsvc.exe
                                          C:\Program Files\Norton AntiVirus\SAVScan.exe
                                          C:\WINDOWS\System32\snmp.exe
                                          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                                          C:\WINDOWS\System32\svchost.exe
                                          C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
                                          C:\WINDOWS\Explorer.EXE
                                          C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                          C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
                                          C:\Program Files\Logitech\ImageStudio\LogiTray.exe
                                          C:\Program Files\Common Files\Symantec Shared\ccApp.exe
                                          C:\Program Files\Logitech\MouseWare\system\em_exec.exe
                                          C:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
                                          C:\Program Files\Winamp\winampa.exe
                                          C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                                          C:\My Shared Folder\AresLite.exe
                                          C:\Program Files\MSN Messenger\msnmsgr.exe
                                          C:\Program Files\Messenger\msmsgs.exe
                                          C:\Program Files\HijackThis\hijackthis99.exe

                                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
                                          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
                                          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                          O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)
                                          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                                          O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                                          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                                          O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                                          O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                          O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
                                          O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
                                          O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
                                          O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
                                          O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
                                          O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                                          O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
                                          O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe
                                          O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
                                          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                                          O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
                                          O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
                                          O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
                                          O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                                          O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
                                          O4 - HKCU\..\Run: [areslite] "C:\My Shared Folder\AresLite.exe" -h
                                          O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                                          O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
                                          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                                          O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                                          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                                          O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
                                          O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
                                          O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
                                          O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
                                          O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
                                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                          O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
                                          O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                                          O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                                          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
                                          O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
                                          O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
                                          O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
                                          O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
                                          O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
                                          O23 - Service: Norton AntiVirus Auto-Protect - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
                                          O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
                                          O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
                                          O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                                          O23 - Service: Sony SPTI Service - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe

                                          en dit is het map.bat bestandje:

                                          Het volume in station C heeft geen naam.
                                          Het volumenummer is 9810-9E20

                                          Map van c:\Windows

                                          03-03-2003 15:26 34.304 ieuninst.exe
                                          15-12-2004 17:34 38.949 iis6.log
                                          24-10-2004 10:59 45 IJKIGHHM.ini
                                          24-10-2004 11:01 <DIR> ime
                                          15-12-2004 17:34 1.393 imsins.BAK
                                          15-12-2004 17:34 1.393 imsins.log
                                          24-12-2004 11:58 <DIR> inf
                                          21-12-2004 18:41 <DIR> inst
                                          24-12-2004 09:43 <DIR> Installer
                                          13-11-1998 12:08 308.224 IsUn0413.exe
                                          29-10-1998 15:45 306.688 IsUninst.exe
                                          28-12-2004 10:46 51 iTouch.ini
                                          07-12-2004 21:03 729.088 iun6002.exe
                                          9 bestand(en) 1.420.135 bytes

                                          Map van C:\Documents and Settings\Herwin Voortman\Bureaublad


                                          Map van C:\Documents and Settings\Herwin Voortman\Bureaublad
                                            • Citaat

                                            Comment

                                            • #12
                                              Hi Japsur,

                                              Kan je als laatste nog een log plaatsen uit Safe Mode. Misschien dat er iets is dat het tegenhoudt in gewone mode. Als dat ook niets oplevert, dan weet ik het niet meer...

                                              Hoe doet je computer het nu?
                                                • Citaat

                                                Comment

                                                • #13
                                                  Tja, ik vind het ook vreemd. Ook jammer dat wanneer hier ook niets meer uit komt dat je er ook niets meer aan kunt doen.
                                                  Verder draait de pc lekker, ik zie geen spyware 1,2,3 meer verschijnen, alle toolbars bij internet explorer zijn weg, dus het werkt wel goed. Hier de logfiles uit de veilige modus:

                                                  Het volume in station C heeft geen naam.
                                                  Het volumenummer is 9810-9E20

                                                  Map van c:\Windows

                                                  03-03-2003 15:26 34.304 ieuninst.exe
                                                  15-12-2004 17:34 38.949 iis6.log
                                                  24-10-2004 10:59 45 IJKIGHHM.ini
                                                  24-10-2004 11:01 <DIR> ime
                                                  15-12-2004 17:34 1.393 imsins.BAK
                                                  15-12-2004 17:34 1.393 imsins.log
                                                  24-12-2004 11:58 <DIR> inf
                                                  21-12-2004 18:41 <DIR> inst
                                                  24-12-2004 09:43 <DIR> Installer
                                                  13-11-1998 12:08 308.224 IsUn0413.exe
                                                  29-10-1998 15:45 306.688 IsUninst.exe
                                                  28-12-2004 12:40 51 iTouch.ini
                                                  07-12-2004 21:03 729.088 iun6002.exe
                                                  9 bestand(en) 1.420.135 bytes

                                                  Map van C:\Documents and Settings\Herwin Voortman\Bureaublad


                                                  Map van C:\Documents and Settings\Herwin Voortman\Bureaublad

                                                  Logfile of HijackThis v1.99.0
                                                  Scan saved at 17:23:27, on 28-12-2004
                                                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                                                  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                                                  Running processes:
                                                  C:\WINDOWS\System32\smss.exe
                                                  C:\WINDOWS\system32\winlogon.exe
                                                  C:\WINDOWS\system32\services.exe
                                                  C:\WINDOWS\system32\lsass.exe
                                                  C:\WINDOWS\system32\svchost.exe
                                                  C:\WINDOWS\system32\svchost.exe
                                                  C:\WINDOWS\Explorer.EXE
                                                  C:\Program Files\HijackThis\hijackthis99.exe

                                                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
                                                  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
                                                  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                                                  O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)
                                                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                                                  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                                                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                                                  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
                                                  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                                                  O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
                                                  O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
                                                  O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
                                                  O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
                                                  O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
                                                  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                                                  O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
                                                  O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe
                                                  O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~4\GAMECO~1\common\swtrayv4.exe
                                                  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                                                  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
                                                  O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
                                                  O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
                                                  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
                                                  O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
                                                  O4 - HKCU\..\Run: [areslite] "C:\My Shared Folder\AresLite.exe" -h
                                                  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                                                  O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
                                                  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                                                  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
                                                  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                                                  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
                                                  O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
                                                  O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
                                                  O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
                                                  O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
                                                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                                  O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
                                                  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                                                  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                                                  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
                                                  O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
                                                  O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
                                                  O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
                                                  O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
                                                  O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
                                                  O23 - Service: Norton AntiVirus Auto-Protect - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
                                                  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
                                                  O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
                                                  O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
                                                  O23 - Service: Sony SPTI Service - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
                                                    • Citaat

                                                    Comment

                                                    • #14
                                                      Hi Japsur,

                                                      ik vind het ook vreemd. Ook jammer dat wanneer hier ook niets meer uit komt dat je er ook niets meer aan kunt doen.
                                                      Verder draait de pc lekker, ik zie geen spyware 1,2,3 meer verschijnen, alle toolbars bij internet explorer zijn weg, dus het werkt wel goed. Hier de logfiles uit de veilige modus:
                                                      Dit zegt ook al niks... Grrrr. Alleen dezelfde vier regels die niet weg willen. Dan weet ik het ook niet meer. Het belangrijkste is dat je computer het nu weer normaal doet.

                                                      Als ik iets weet te vinden dan post ik wel weer wat in deze thread.

                                                      Succes.
                                                        • Citaat

                                                        Comment

                                                        • #15
                                                          Ja ok, bedankt voor de moeite
                                                          Ik wacht je antwoord ooit wel eens af!
                                                            • Citaat

                                                            Comment

                                                            Vorige template Volgende
                                                            Sorry, you are not authorized to view this page
                                                            Working...
                                                            X
                                                            😀
                                                            🥰
                                                            🤢
                                                            😎
                                                            😡
                                                            👍
                                                            👎